joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4727ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x47280f
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4728e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x47290a
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x472ac3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x472ae6
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x485a54
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.0048e760
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x485b07
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.0048e760
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
jmp 0x485b0f
mov eax, dword [ebp - 4]
jmp 0x485b0f
mov esp, ebp
pop ebp
ret 8
Function at 0x48ed10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebp
push esi
push edi
push eax
call fcn.00497540
mov esi, dword [esp + 0x38]
mov ebp, eax
xor edx, edx
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0xc], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebp, edx
mov dword [esp + 0x18], edx
je 0x48edf7
cmp ecx, edx
je 0x48edf7
inc ecx
push ebx
push ecx
call fcn.004b8c87
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004b8c60
mov esi, eax
add esp, 0xc
test esi, esi
je 0x48ed8d
mov byte [esi], 0
inc esi
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x48ede5
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
mov edi, 4
push esi
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48edda
cmp dword [esp + 0x14], edi
jne 0x48edda
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.004b8c4c
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
pop ebx
jne 0x48ee03
mov eax, dword [esp + 0x48]
test eax, eax
mov eax, dword [esp + 0x40]
jne 0x48ee07
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x48ee10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00497540
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x48ef60
test ecx, ecx
je 0x48ef60
inc ecx
push ecx
call fcn.004b8c87
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004b8c60
mov edi, eax
add esp, 0xc
test edi, edi
je 0x48ee89
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x48ef4d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.004b8c87
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x48ef11
cmp eax, 0xea
jne 0x48ef39
push esi
call fcn.004b8c4c
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004b8c87
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x48eedc
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x48ef1f
cmp eax, 2
jne 0x48ef39
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00497590
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.004b8c4c
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.004b8c4c
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x48ef8e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x48ef9a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x48ef9a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00497590
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x48f740
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x48f7a9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0048e540
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x48f860
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
mov al, 0x20
mov cl, byte [edi]
inc edi
cmp cl, 0x22
jne 0x48f87a
mov al, cl
mov dl, byte [edi]
inc edi
cmp dl, al
je 0x48f888
mov cl, byte [edi]
inc edi
cmp cl, al
jne 0x48f881
cmp al, 0x20
je 0x48f892
cmp byte [edi], 0x20
jne 0x48f892
inc edi
lea ecx, [esp + 0xc]
call fcn.00497690
mov dword [esp + 0xc], 0x4cb5f4
mov al, byte [edi]
test al, al
je 0x48f956
mov esi, dword [esp + 0x28]
cmp al, 0x22
jne 0x48f8fe
mov al, byte [edi + 1]
inc edi
test al, al
mov esi, edi
je 0x48f8d9
mov al, byte [esi]
cmp al, 0x22
je 0x48f8d9
test al, al
jge 0x48f8d1
mov al, byte [esi + 1]
test al, al
je 0x48f8d9
inc esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x48f8bf
mov edx, esi
sub edx, edi
push edx
push edi
call fcn.00497590
add esp, 8
lea ecx, [esp + 0xc]
push eax
call fcn.00497920
mov al, byte [esi]
mov edi, esi
test al, al
je 0x48f94c
lea edi, [esi + 1]
jmp 0x48f94c
cmp al, 0x20
jg 0x48f90a
cmp byte [esi], 0
jl 0x48f90a
inc edi
jmp 0x48f94c
test al, al
mov esi, edi
je 0x48f932
mov al, byte [esi]
cmp al, 0x22
je 0x48f932
cmp al, 0x20
jg 0x48f91e
test al, al
jge 0x48f932
test al, al
jge 0x48f92a
mov al, byte [esi + 1]
test al, al
je 0x48f932
inc esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x48f910
mov eax, esi
sub eax, edi
push eax
push edi
call fcn.00497590
add esp, 8
lea ecx, [esp + 0xc]
push eax
call fcn.00497920
mov edi, esi
mov al, byte [edi]
test al, al
jne 0x48f8b1
mov ebx, dword [esp + 0x28]
mov eax, dword [ebx]
test eax, eax
je 0x48f969
push eax
call fcn.00497a50
add esp, 4
mov edi, dword [esp + 0x1c]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.0048e540
mov dword [eax], 1
mov edx, dword [esp + 0x20]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
mov dword [ebx], eax
mov dword [esp + 0xc], 0x4cb5f0
call fcn.00497890
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x48fe50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x48fe63
xor eax, eax
pop esi
add esp, 0x10
ret
push esi
call fcn.004980d0
add esp, 4
test eax, eax
jne 0x48fe75
pop esi
add esp, 0x10
ret
mov eax, dword [esi]
mov ecx, 1
push ebx
push ebp
cmp eax, ecx
push edi
mov dword [esp + 0x10], 0
jne 0x48ff36
mov eax, dword [esi + 4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x14], ecx
jle 0x48ffb3
lea ebx, [esp + 0x34]
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, reloc.WS2_32.dll_connect
jne 0x48febe
mov esi, dword [ebx]
jmp 0x48fed2
push ebx
call fcn.00497f30
mov esi, eax
add esp, 4
test esi, esi
je 0x48ff16
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x48fefd
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x48fefd
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x48ff0a
push esi
call fcn.004b8f88
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x48ffb3
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x48feae
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp eax, 2
jne 0x48ffb3
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 4]
cmp eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
jle 0x48ffb3
dec eax
lea ebx, [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, reloc.WS2_32.dll_connect
jne 0x48ff67
mov esi, dword [ebx]
jmp 0x48ff7b
push ebx
call fcn.00497f30
mov esi, eax
add esp, 4
test esi, esi
je 0x48ffa5
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x48ff98
mov eax, dword [esp + 0x18]
push ecx
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
test ebp, ebp
je 0x48ffa5
push esi
call fcn.004b8f88
add esp, 4
mov eax, dword [esp + 0x24]
add ebx, 0xc
dec eax
mov dword [esp + 0x24], eax
jne 0x48ff57
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x490020
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
test ebx, ebx
push edi
jne 0x490039
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push ebx
call fcn.004980d0
add esp, 4
test eax, eax
jne 0x49004e
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x34]
test edi, edi
je 0x490068
mov eax, dword [esp + 0x2c]
test eax, eax
jg 0x490068
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x490150
mov ebp, dword [ebx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push eax
push esi
push esi
push ebp
call edi
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
jne 0x4900a0
push 2
push esi
push esi
push ebp
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4900b7
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
sub esi, ebx
jmp 0x4900bb
mov esi, dword [esp + 0x2c]
push esi
call fcn.004b8c87
add esp, 4
mov ebx, eax
lea eax, [esp + 0x10]
push 0
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4900f4
push 2
push eax
push eax
push ebp
call edi
push ebx
call fcn.004b8c4c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
xor edi, edi
test edx, edx
mov ecx, ebx
jbe 0x490110
mov al, byte [ecx]
test al, al
je 0x490110
cmp al, 0x1a
je 0x490110
inc edi
inc ecx
cmp edi, edx
jb 0x490100
lea ecx, [edi + 1]
push ecx
call fcn.0048e540
mov edx, dword [esp + 0x18]
add esp, 4
mov esi, eax
push 0
lea eax, [edi + edx]
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push ebx
push esi
call fcn.004b9080
push ebx
mov byte [edi + esi], 0
call fcn.004b8c4c
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x4901cb
mov ebx, dword [ebx + 4]
mov ecx, ebx
mov edx, dword [ebx]
call dword [edx + 0x14]
test edi, edi
mov ebp, eax
jne 0x49016a
or eax, 0xffffffff
jmp 0x49016e
mov eax, dword [esp + 0x2c]
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
mov ecx, ebx
call dword [edx + 0x30]
mov edx, dword [esp + 0x10]
xor edi, edi
test eax, eax
jbe 0x49019d
mov cl, byte [edx]
test cl, cl
je 0x49019d
cmp cl, 0x1a
je 0x49019d
inc edi
inc edx
cmp edi, eax
jb 0x49018c
lea edx, [edi + 1]
push edx
call fcn.0048e540
add esp, 4
lea ecx, [edi + ebp]
mov esi, eax
mov eax, dword [ebx]
push 0
push ecx
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [esp + 0x10]
push edi
push edx
push esi
call fcn.004b9080
add esp, 0xc
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4901e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x490223
push edi
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
call fcn.00497590
add esp, 8
pop edi
pop esi
add esp, 0x104
ret
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x490380
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x49039e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x490393
pop esi
ret

Function at 0x4911b0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x4911c3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.004980d0
add esp, 4
test eax, eax
jne 0x4911d5
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x24]
test edi, edi
jg 0x4911e4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x49123b
mov ebx, dword [ebx + 4]
push edi
call fcn.004b8c87
add esp, 4
mov ebp, eax
lea eax, [esp + 0x18]
push esi
push eax
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49121e
push ebp
call fcn.004b8c4c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.00497650
push ebp
mov esi, eax
call fcn.004b8c4c
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x49127d
mov ebx, dword [ebx + 4]
lea edx, [edi + 8]
push edx
call fcn.0048e540
mov esi, eax
add esp, 4
lea ecx, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], edi
mov eax, dword [ebx]
push edi
push ecx
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
jne 0x49127a
push esi
call fcn.0048e5d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x491340
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1010
call fcn.004b9180
mov eax, dword [esp + 0x1014]
push ebx
push ebp
mov ebp, dword [esp + 0x1020]
push esi
push edi
xor edi, edi
push 1
push edi
push edi
push eax
mov dword [ebp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x491442
jmp 0x49137f
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1024]
xor esi, esi
lea ecx, [esp + 0x18]
push esi
push ecx
lea edx, [esp + 0x28]
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49145f
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], esi
cmp eax, esi
jbe 0x4913cb
mov cl, byte [esp + esi + 0x20]
test cl, cl
je 0x4913c2
inc esi
cmp esi, eax
jb 0x4913b3
jmp 0x4913cb
inc esi
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
mov ebx, edi
add edi, esi
test eax, eax
mov dword [esp + 0x1c], edi
je 0x4913e7
inc edi
push edi
push eax
call fcn.0048e590
add esp, 8
jmp 0x4913f1
inc edi
push edi
call fcn.0048e540
add esp, 4
mov edi, eax
lea ecx, [esp + 0x20]
add edi, ebx
push esi
push ecx
push edi
mov dword [ebp], eax
call fcn.004b9080
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
mov byte [edi + esi], 0
jne 0x491478
cmp dword [esp + 0x18], 0x1000
jb 0x4914ab
mov edx, dword [esp + 0x1024]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x49137b
mov eax, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
add esp, 0x1010
ret
mov ecx, dword [esp + 0x102c]
pop edi
mov eax, 1
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1024]
push 0
add esi, edx
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [ecx], 1
xor eax, eax
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [edx], 1
mov eax, 1
pop ebx
add esp, 0x1010
ret

Function at 0x4914d0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push edi
mov dword [esi], 0
call ebx
test eax, eax
je 0x49155c
cmp dword [esp + 0x14], 4
jb 0x49155c
mov edx, dword [esp + 0x10]
add edx, 8
push edx
call fcn.0048e540
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esi], eax
push 0
push ecx
add eax, 8
push edx
push eax
push edi
call ebx
test eax, eax
je 0x49154b
mov esi, dword [esi]
mov dword [esi], 1
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x10]
jne 0x49155c
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esi]
push edx
call fcn.0048e5d0
add esp, 4
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x491c30
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x491c3e
or eax, 0xffffffff
pop esi
ret
push esi
call fcn.004980d0
add esp, 4
test eax, eax
jne 0x491c50
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
or eax, 0xffffffff
cmp ecx, 1
jne 0x491c6b
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
ret
cmp ecx, 2
jne 0x491c78
mov ecx, dword [esi + 4]
call fcn.004a3c00
pop esi
ret

Function at 0x491f30
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x491f43
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.004980d0
add esp, 4
test eax, eax
jne 0x491f55
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x491fcc
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x491ffe
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x491fb8
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x491f88
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x491ffe
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x491ffe
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x491fe7
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret