joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469170
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push ebx
push dword [0x59caa8]
mov dword [esp + 0x14], 0
call fcn.00471c3d
mov ebp, eax
test ebp, ebp
je 0x4692da
push esi
push edi
push ebx
call fcn.00469840
cmp dword [ebp + 4], 0
mov esi, eax
mov edi, edx
je 0x4691be
push 4
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.004698b0
mov ecx, eax
mov dword [esp + 0x14], ecx
jmp 0x4691d9
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
cmp ecx, 2
jl 0x469209
lea edx, [esp + 0x10]
mov eax, 0xfeff
cmp word [edx], ax
jne 0x469209
add esi, 2
adc edi, 0
push edi
push esi
push ebx
call fcn.004699f0
pop edi
pop esi
pop ebp
mov eax, 0x19
pop ebx
add esp, 8
ret 4
cmp ecx, 3
jl 0x46923c
lea edx, [esp + 0x10]
cmp word [edx], 0xbbef
jne 0x46923c
cmp byte [edx + 2], 0xbf
jne 0x46923c
add esi, 3
adc edi, 0
push edi
push esi
push ebx
call fcn.004699f0
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 8
ret 4
cmp ecx, 2
jl 0x46926c
lea edx, [esp + 0x10]
mov eax, 0xfffe
cmp word [edx], ax
jne 0x46926c
add esi, 2
adc edi, 0
push edi
push esi
push ebx
call fcn.004699f0
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 8
ret 4
cmp ecx, 4
jl 0x4692c3
lea eax, [esp + 0x10]
cmp dword [eax], 0xfeff
jne 0x46929a
add esi, 4
adc edi, 0
push edi
push esi
push ebx
call fcn.004699f0
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 8
ret 4
lea eax, [esp + 0x10]
cmp dword [eax], 0xfffe0000
jne 0x4692c3
add esi, 4
adc edi, 0
push edi
push esi
push ebx
call fcn.004699f0
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 8
ret 4
push edi
push esi
push ebx
call fcn.004699f0
pop edi
pop esi
pop ebp
mov eax, 0x18
pop ebx
add esp, 8
ret 4
pop ebp
mov eax, 0x18
pop ebx
add esp, 8
ret 4
Function at 0x4694a0
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x59caa8]
call fcn.00471c3d
test eax, eax
je case.0x4694ce.3
mov ecx, dword [esp + 8]
add ecx, 0xfffffffe
cmp ecx, 0x17
ja case.0x4694ce.3
movzx ecx, byte [ecx + 0x4695d8]
jmp dword [ecx*4 + 0x4695c0]
cmp dword [eax + 4], 0
je 0x4694eb
push 2
push 0x550344
push eax
call fcn.00469f20
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x550344
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x46951a
push 3
push 0x54f768
push eax
call fcn.00469f20
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 3
push 0x54f768
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x469549
push 2
push 0x550348
push eax
call fcn.00469f20
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x550348
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x469578
push 4
push 0x55034c
push eax
call fcn.00469f20
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x55034c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x4695a7
push 4
push 0x550354
push eax
call fcn.00469f20
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x550354
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x469700
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x4696ee
cmp word [edx], 0
je 0x4696ee
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x46961e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x469674
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469630
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x469656
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00469f20
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
push edx
xor edx, edx
mov eax, 0xfde9
cmp ecx, 2
cmovne eax, edx
push eax
call fcn.0046a040
mov edi, eax
test edi, edi
je 0x46966a
cmp dword [esi + 4], 0
je 0x4696c1
push dword [esp + 0x14]
push edi
push esi
call fcn.00469f20
push edi
push 0
push dword [0x599ff8]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x599ff8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
push dword [esp + 4]
push dword [0x59caa8]
call fcn.00471c3d
test eax, eax
je 0x46971c
mov dword [esp + 4], eax
jmp 0x4695f0
xor eax, eax
ret 0xc
Function at 0x469730
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x59caa8]
call fcn.00471c3d
mov esi, eax
test esi, esi
je 0x4697af
cmp dword [esi + 4], 0
je 0x469780
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.004698b0
test eax, eax
je 0x469774
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4697ba
cmp dword [esp + 8], 0
je 0x4697ba
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x4697d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x469835
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x46982d
push dword [esp + 0x10]
push dword [0x59caa8]
call fcn.00471c3d
test eax, eax
je 0x469823
cmp dword [eax + 4], 0
je 0x469812
push edi
push esi
push eax
call fcn.00469f20
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc
Function at 0x4698b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
cmp dword [ebx + 0x14], 0
jne 0x4698d3
push ebx
call fcn.00468e30
mov dword [ebx + 0x14], 1
mov dword [ebx + 0xc], 0
mov esi, dword [ebx + 0xc]
mov eax, dword [ebx + 0x10]
mov ebp, dword [esp + 0x20]
sub eax, esi
add eax, dword [ebx + 4]
mov dword [esp + 0x10], esi
cmp esi, ebp
jl 0x469957
mov ecx, ebp
sub ecx, 1
je 0x469942
sub ecx, 1
je 0x46992b
sub ecx, 2
je 0x469916
push ebp
push eax
push dword [esp + 0x24]
call fcn.00449c90
add esp, 0xc
mov eax, ebp
sub dword [ebx + 0xc], ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], ecx
mov eax, ebp
sub dword [ebx + 0xc], ebp
pop ebp
pop ebx
pop ecx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov word [eax], cx
mov eax, ebp
sub dword [ebx + 0xc], ebp
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
mov dl, byte [eax]
mov eax, ebp
pop edi
pop esi
mov byte [ecx], dl
sub dword [ebx + 0xc], ebp
pop ebp
pop ebx
pop ecx
ret 0xc
push esi
push eax
mov eax, dword [esp + 0x24]
push eax
call fcn.00449c90
mov eax, dword [esp + 0x28]
add esp, 0xc
mov edx, dword [ebx + 8]
add eax, esi
mov ecx, dword [ebx]
sub ebp, esi
mov dword [esp + 0x1c], eax
push 0
cmp ebp, edx
jl 0x4699a0
lea edx, [esp + 0x1c]
push edx
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
pop edi
add eax, esi
mov dword [ebx + 0xc], 0
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
lea eax, [esp + 0x1c]
push eax
push edx
push dword [ebx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [esp + 0x18]
cmp ebp, esi
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
cmovle esi, ebp
push esi
push dword [ebx + 4]
push eax
call fcn.00449c90
sub dword [ebx + 0xc], esi
add esp, 0xc
mov eax, dword [esp + 0x10]
add eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x469a50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push 0x1000
push 0
push dword [0x599ff8]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x469be0
mov cl, byte [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov esi, edx
nop
cmp ebp, 0xffffffff
je 0x469a9e
test ebp, ebp
je 0x469b46
dec ebp
cmp dword [ebx + 4], 0
lea edi, [ebx + 4]
je 0x469aba
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.004698b0
mov dword [esp + 0x10], eax
jmp 0x469ad4
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + 0x24]
cmp eax, 1
jne 0x469b49
test cl, cl
je 0x469ae8
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x24]
mov eax, dword [esp + 0x14]
mov edi, esi
mov edx, dword [esp + 0x1c]
dec eax
sub edi, edx
cmp edi, eax
jle 0x469b23
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x599ff8]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x24]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [edi + edx]
test cl, cl
je 0x469b46
cmp dword [esp + 0x28], 0
jne 0x469a90
cmp cl, 0xd
je 0x469b52
cmp cl, 0xa
jne 0x469a90
dec esi
jmp 0x469bc3
lea edi, [ebx + 4]
cmp dword [esp + 0x28], 0
jne 0x469bc3
jmp 0x469b55
lea edi, [ebx + 4]
cmp cl, 0xa
jne 0x469b5d
dec esi
jmp 0x469bc3
cmp cl, 0xd
jne 0x469bc3
dec esi
cmp dword [edi], 0
je 0x469b7b
push 1
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.004698b0
mov dword [esp + 0x10], eax
jmp 0x469b91
push 0
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x30]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x24], 0xa
je 0x469bc3
cmp dword [edi], 0
je 0x469ba2
inc dword [ebx + 0xc]
jmp 0x469bc3
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x30]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10
Function at 0x469bf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push 0x1000
push 0
push dword [0x599ff8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 8], edx
test edx, edx
je 0x469daf
mov ax, word [esp + 0x1c]
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], 0x1000
mov dword [esp + 0x18], 0x7ff
mov ecx, dword [esp + 0x30]
cmp ecx, 0xffffffff
je 0x469c49
test ecx, ecx
je 0x469d0c
dec ecx
mov dword [esp + 0x30], ecx
cmp dword [ebx + 4], 0
lea ebp, [ebx + 4]
je 0x469c65
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.004698b0
mov dword [esp + 0x10], eax
jmp 0x469c7f
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
cmp eax, 2
mov ax, word [esp + 0x28]
jne 0x469d0f
test ax, ax
je 0x469c9d
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, edi
mov ecx, dword [esp + 0x18]
sub esi, edx
sar esi, 1
cmp esi, ecx
jle 0x469ce4
mov eax, dword [esp + 0x1c]
add ecx, 0x800
add eax, 0x1000
mov dword [esp + 0x18], ecx
push eax
push edx
push 8
push dword [0x599ff8]
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
mov ax, word [esp + 0x28]
mov dword [esp + 0x14], edx
lea edi, [edx + esi*2]
test ax, ax
je 0x469d0f
cmp dword [esp + 0x2c], 0
jne 0x469c33
cmp ax, 0xd
je 0x469d16
cmp ax, 0xa
jne 0x469c33
sub edi, 2
jmp 0x469d8e
lea ebp, [ebx + 4]
cmp dword [esp + 0x2c], 0
jne 0x469d8e
cmp ax, 0xa
jne 0x469d21
sub edi, 2
jmp 0x469d8e
cmp ax, 0xd
jne 0x469d8e
sub edi, 2
cmp dword [ebp], 0
je 0x469d43
push 2
lea eax, [esp + 0x2c]
push eax
push ebx
call fcn.004698b0
mov dword [esp + 0x10], eax
jmp 0x469d59
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x34]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x28], 0xa
je 0x469d8e
cmp dword [ebp], 0
je 0x469d6d
add dword [ebx + 0xc], 2
jmp 0x469d8e
push 1
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, edi
sub ecx, dword [esp + 0x14]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x469dc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x599ff8]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x469f10
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x469e0c
test edi, edi
je 0x469e7d
dec edi
push esi
push ebp
call fcn.0046a0b0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x469e1f
xor cl, cl
jmp 0x469e21
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x469e64
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x599ff8]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x469e7d
test eax, eax
jne 0x469e02
cmp cl, 0xd
je 0x469e81
cmp cl, 0xa
jne 0x469e02
dec esi
jmp 0x469ef3
test eax, eax
jne 0x469ef3
cmp cl, 0xa
jne 0x469e89
dec esi
jmp 0x469ef3
cmp cl, 0xd
jne 0x469ef3
dec esi
cmp dword [ebp + 4], 0
je 0x469ea8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004698b0
mov dword [esp + 0x20], eax
jmp 0x469ebf
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x469ef3
cmp dword [ebp + 4], 0
je 0x469ed1
inc dword [ebp + 0xc]
jmp 0x469ef3
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x469f20
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], 0
cmp dword [edi + 0x1c], 0
jne 0x46a037
cmp dword [edi + 0x14], 1
push ebx
push ebp
jne 0x469f6d
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x10]
push 1
neg eax
cdq
push ecx
push eax
push dword [edi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0xc]
push esi
mov esi, dword [esp + 0x24]
cmp eax, esi
jle 0x469ff6
mov ecx, dword [edi + 4]
sub ecx, eax
mov eax, esi
add ecx, dword [edi + 8]
sub eax, 1
je 0x469fdf
sub eax, 1
je 0x469fc6
sub eax, 2
je 0x469faf
push esi
push dword [esp + 0x24]
push ecx
call fcn.00449c90
add esp, 0xc
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov ax, word [eax]
mov word [ecx], ax
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov eax, dword [esp + 0x20]
mov al, byte [eax]
mov byte [ecx], al
mov eax, esi
sub dword [edi + 0xc], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
push edi
call fcn.00468e30
mov eax, dword [edi + 8]
cmp esi, eax
jl 0x46a025
push 0
lea eax, [esp + 0x20]
push eax
push esi
push dword [esp + 0x2c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret 0xc
mov ecx, dword [edi + 4]
sub ecx, dword [edi + 0xc]
push esi
push dword [esp + 0x24]
add ecx, eax
jmp 0x469f97
xor eax, eax
pop edi
add esp, 8
ret 0xc
Function at 0x46a0b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x46a0d7
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004698b0
mov dword [esp + 4], eax
jmp 0x46a0f1
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x46a1a4
mov cl, byte [esp + 0xc]
test cl, cl
js 0x46a116
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x46a126
mov esi, 2
jmp 0x46a142
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x46a135
mov esi, 3
jmp 0x46a142
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x46a190
mov esi, 4
mov eax, dword [esp + 0x14]
push ebx
lea ebx, [esi - 1]
mov byte [eax], cl
inc eax
cmp dword [edi + 4], 0
je 0x46a16b
push ebx
push eax
push edi
call fcn.004698b0
xor ecx, ecx
cmp eax, ebx
pop ebx
cmovne esi, ecx
mov eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea ecx, [esp + 0x10]
push ecx
push ebx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, ebx
pop ebx
cmovne esi, ecx
mov eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8
xor eax, eax
pop edi
pop ecx
ret 8

Function at 0x46b231
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46b2a7
cmp dword [esp + 8], esi
push ebx
push ebp
mov ebx, 0x54c268
cmovne ebx, dword [esp + 0x10]
push edi
push ebx
call fcn.0043ee11
pop ecx
lea ebp, [eax*2 + 2]
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x46b29e
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x46b29e
push ebp
push ebx
push eax
call fcn.00449c90
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
ret 4

Function at 0x46b2cd
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
push esi
mov ebx, esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46b30e
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x46b306
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x46b306
push esi
call fcn.0043ee11
pop ecx
mov ebx, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x46b311
mov edi, dword [ebp + 8]
push dword [ebp + 8]
push ebx
call fcn.00472320
test esi, esi
je 0x46b339
lea ecx, [ebx*2 + 2]
push ecx
push esi
push eax
call fcn.00449c90
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x46b33e
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x46b9c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x46b9d5
mov esi, ebx
jmp 0x46b9e7
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x46bad5
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x46baca
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.00449b30
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x46bac9
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x46bac9
mov ebp, dword [esp + 0x10]
push 3
pop ebx
movzx ecx, byte [ebp + 1]
xor edx, edx
movzx eax, byte [ebp + 2]
add eax, ecx
movzx ecx, byte [ebp]
add eax, ecx
div ebx
mov byte [ebp], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebp, dword [esp + 0x10]
add ebp, ebx
mov dword [esp + 0x10], ebp
sub edi, 1
jne 0x46ba8d
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x46bad5
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8