joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3eb0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5568e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x30
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov esi, 0x80
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], esi
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
jne 0x4c3f18
add esi, 0x10
cmp esi, 0x800
jbe 0x4c3ef2
cmp esi, 0x800
jae 0x4c3f3c
push 0x800
call fcn.004423dc
mov edi, eax
add esp, 4
test edi, edi
jne 0x4c3f51
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x800
push 0
push edi
call fcn.004359a0
mov esi, dword [ebp - 0x1c]
mov ecx, 0x7ff
cmp esi, 0x800
mov eax, esi
cmova eax, ecx
push eax
push dword [ebp - 0x18]
push edi
call fcn.00435260
add esp, 0x18
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x3c]
movups xmmword [ebp - 0x3c], xmm0
push esi
push edi
call fcn.00403040
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
mov esi, dword [ebp - 0x14]
cmp esi, eax
je 0x4c3fdb
mov ecx, esi
call fcn.00402df0
movups xmm0, xmmword [ebp - 0x3c]
mov eax, 0xf
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x3c], 0
jmp 0x4c3fde
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xf
jbe 0x4c4014
mov edx, dword [ebp - 0x3c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4c400a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c404d
push ecx
push edx
call fcn.004338e3
add esp, 8
push edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
call fcn.00441c86
add esp, 4
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00438c60
int3
Function at 0x4c5940
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
push ebx
push esi
push edi
lea eax, [esp + 0x38]
mov dword [esp + 0x14], ecx
push eax
push 0x202
mov ebx, edx
mov dword [esp + 0x14], 0
or edi, 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4c5a46
push eax
push 0x14c2
call fcn.004e77d0
push 0
push 0x141a
movzx eax, byte [eax + 0x5860c0]
cdq
mov esi, eax
mov dword [esp + 0x20], edx
call fcn.004e77d0
add esp, 0x10
cmp esi, eax
jne 0x4c59ae
cmp dword [esp + 0x10], edx
je 0x4c5a46
lea eax, [esp + 0xc]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
push ebx
push dword [esp + 0x20]
xorps xmm0, xmm0
mov dword [esp + 0x30], 1
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x34], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x4c5a40
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4c5a54
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x4c5a40
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4c5a50
push edi
call ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4c5a04
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp edi, 0xffffffff
je 0x4c5a40
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d3470
Capabilities:
Get hostname
Get session user name
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x250
push 0x100
lea eax, [ebp - 0x150]
mov dword [ebp - 0x24], 0x100
push 0
push eax
mov dword [ebp - 0x28], 0x100
call fcn.004359a0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x100
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.004359a0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 8], 0xc7e8bbe7
mov dword [ebp - 4], 0xf3a57195
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 8], 0x61453c76
mov dword [ebp - 4], 0xa0df89f8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], 0xa980d4ad
mov dword [ebp - 4], 0xf3c01ed1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0x61453c76
mov dword [ebp - 4], 0xa0df89f8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 4]
movaps xmm1, xmmword [ebp - 0x40]
push eax
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x150]
xorps xmm1, xmmword [ebp - 0x20]
push eax
movaps xmmword [ebp - 0x40], xmm1
call fcn.00434e50
add esp, 8
test eax, eax
jne 0x4d360b
mov dword [ebp - 8], 0x90cc95e5
mov dword [ebp - 4], 0xf3c05685
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 8], 0x61453c76
mov dword [ebp - 4], 0xa0df89f8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 8], 0xa980d4ad
mov dword [ebp - 4], 0xf3c01ed1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0x61453c76
mov dword [ebp - 4], 0xa0df89f8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 4]
movaps xmm1, xmmword [ebp - 0x50]
push eax
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x250]
xorps xmm1, xmmword [ebp - 0x20]
push eax
movaps xmmword [ebp - 0x50], xmm1
call fcn.00434e50
add esp, 8
test eax, eax
jne 0x4d360b
xor al, al
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4d3630
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d3f50
Capabilities:
Copy file
Create restart manager session
Enumerate processes that use resource

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55789e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x340
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
mov ebx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], edx
call edi
cmp eax, 0x20
jne 0x4d40c9
lea eax, [ebp - 0x60]
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d3fa4
sub ecx, edx
push ecx
push ebx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x60]
call fcn.00429070
add esp, 0xc
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0xffffffff
mov edi, 1
mov dword [ebp - 0x14], edi
and edi, 0xfffffffe
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 1
lea eax, [ebp - 0xa8]
push 0x42
push 0
push eax
call fcn.004359a0
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
mov esi, eax
test esi, esi
jne 0x4d40a4
mov byte [ebp - 4], 2
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x44]
call fcn.00415eb0
push esi
or edi, 2
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x30], 7
push esi
cmova eax, dword [ebp - 0x44]
push esi
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebp - 0x18]
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
mov esi, eax
test esi, esi
jne 0x4d4092
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.RstrtMgr.DLL_RmGetList]
mov esi, eax
test esi, esi
je 0x4d407d
cmp esi, 0xea
jne 0x4d4092
cmp dword [ebp - 0x1c], 0
jbe 0x4d4092
push 0
push 1
push dword [ebp - 0x18]
call dword [sym.imp.RstrtMgr.DLL_RmShutdown]
mov esi, eax
and edi, 0xfffffffd
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.004188d0
push dword [ebp - 0x18]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.004188d0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push dword [ebp - 0x20]
push ebx
call esi
test eax, eax
setne cl
mov byte [ebp - 0xd], cl
test eax, eax
jne 0x4d4123
call edi
cmp eax, 0x20
jne 0x4d410f
mov ecx, ebx
call fcn.004e4b90
push 0
push dword [ebp - 0x20]
push ebx
call esi
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov al, cl
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e3fc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558875
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push 0x5864f8
mov esi, ecx
mov dword [ebp - 0x10], 0x5864f8
call fcn.00432b89
add esp, 4
test eax, eax
jne 0x4e4032
cmp dword [0x586524], 0x7fffffff
je 0x4e4039
mov dword [ebp - 4], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
push 0x5864f8
call fcn.00432b9a
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
push 5
call fcn.00432524
push 6
mov dword [0x586524], 0x7ffffffe
call fcn.00432524
int3

Function at 0x4e4050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55888e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push 0x5864f8
mov esi, ecx
mov dword [ebp - 0x10], 0x5864f8
call fcn.00432b89
add esp, 4
test eax, eax
jne 0x4e40fd
cmp dword [0x586524], 0x7fffffff
je 0x4e4104
mov dword [ebp - 4], eax
test esi, esi
je 0x4e40d5
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e40a0
sub ecx, edx
je 0x4e40d5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e40d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x4e40d1
cmp eax, 0x20
je 0x4e40d1
cmp eax, 0x45
je 0x4e40d1
cmp eax, 0x24
jne 0x4e40d5
mov bl, 1
jmp 0x4e40d7
xor bl, bl
mov dword [ebp - 4], 0xffffffff
push 0x5864f8
call fcn.00432b9a
mov ecx, dword [ebp - 0xc]
add esp, 4
mov al, bl
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
call fcn.00432524
push 6
mov dword [0x586524], 0x7ffffffe
call fcn.00432524
int3
Function at 0x4e42d0
Capabilities:
Check os version

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xe0
mov dword [ebp - 8], 0xeeeca0ff
mov dword [ebp - 4], 0x96966ab4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 8], 0xe2c4f04
mov dword [ebp - 4], 0xa0df8996
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 8], 0xa980d4ad
mov dword [ebp - 4], 0xf3c01ed1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], 0x61453c76
mov dword [ebp - 4], 0xa0df89f8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 4]
movaps xmm1, xmmword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
xorps xmm1, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x40], xmm1
mov dword [ebp - 8], 0xc5e4a0e3
mov dword [ebp - 4], 0x9fa430bd
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], 0x61453c1a
mov dword [ebp - 4], 0xa0df89f8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0xa980d4ad
mov dword [ebp - 4], 0xf3c01ed1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0x61453c76
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xa0df89f8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], ecx
xorps xmm1, xmmword [ebp - 0x20]
push eax
movaps xmmword [ebp - 0x30], xmm1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e43f8
lea ecx, [ebp - 0xe0]
push ecx
call eax
jmp 0x4e4405
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xdc]
cmp eax, 0xb
je 0x4e4415
cmp eax, 0xa
jne 0x4e4427
cmp dword [ebp - 0xd8], 0
je 0x4e4444
xor al, al
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp eax, 6
jne 0x4e441e
mov eax, dword [ebp - 0xd8]
cmp eax, 3
je 0x4e4444
cmp eax, 2
sete al
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov al, 1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4e46e0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55892d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
push esi
mov eax, ecx
mov dword [ebp - 0x1c], edx
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
call fcn.0041ae80
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x28], 0xa980b6df
mov dword [ebp - 0x24], 0xf3c01ed1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], 0x61453c76
mov dword [ebp - 0x24], 0xa0df89f8
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], 0xa980d4ad
mov dword [ebp - 0x24], 0xf3c01ed1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x28], 0x61453c76
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x24], 0xa0df89f8
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
cmp dword [ebx + 0x1c], 0xf
movaps xmm1, xmmword [ebp - 0x40]
mov dword [ebp - 0x48], eax
lea eax, [ebx + 8]
cmova eax, dword [ebx + 8]
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x40]
xorps xmm1, xmmword [ebp - 0x50]
push ecx
push eax
movaps xmmword [ebp - 0x40], xmm1
call fcn.00439810
mov edi, eax
add esp, 8
test edi, edi
je 0x4e4841
push 2
push 0
push edi
call fcn.0043d5e6
add esp, 0xc
push edi
call fcn.0043939b
add esp, 4
mov esi, eax
push 0
push 0
push edi
call fcn.0043d5e6
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp esi, dword [ebp - 0x1c]
cmova esi, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
cmp esi, edx
ja 0x4e4815
mov dword [ecx + 0x10], esi
cmp dword [ecx + 0x14], 0xf
jbe 0x4e480f
mov ecx, dword [ecx]
mov byte [ecx + esi], 0
jmp 0x4e4824
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.00418dc0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x14], 0xf
jbe 0x4e482e
mov eax, dword [eax]
push edi
push esi
push 1
push eax
call fcn.0044208f
push edi
call fcn.0043d098
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebx + 8]
call fcn.00402df0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4e4870
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558962
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x38
push esi
mov eax, ecx
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
call fcn.0041ae80
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x20], 0xa980b6df
mov dword [ebp - 0x1c], 0xf3c01ed1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], 0x61453c76
mov dword [ebp - 0x1c], 0xa0df89f8
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0xa980d4ad
mov dword [ebp - 0x1c], 0xf3c01ed1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0x61453c76
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x1c], 0xa0df89f8
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp dword [ebx + 0x1c], 0xf
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x38], eax
lea eax, [ebx + 8]
cmova eax, dword [ebx + 8]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x30]
xorps xmm1, xmmword [ebp - 0x40]
push ecx
push eax
movaps xmmword [ebp - 0x30], xmm1
call fcn.00439810
mov edi, eax
add esp, 8
test edi, edi
je 0x4e49c7
push 2
push 0
push edi
call fcn.0043d5e6
add esp, 0xc
push edi
call fcn.0043939b
add esp, 4
mov esi, eax
push 0
push 0
push edi
call fcn.0043d5e6
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
cmp esi, edx
ja 0x4e499b
mov dword [ecx + 0x10], esi
cmp dword [ecx + 0x14], 0xf
jbe 0x4e4995
mov ecx, dword [ecx]
mov byte [ecx + esi], 0
jmp 0x4e49aa
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.00418dc0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x14], 0xf
jbe 0x4e49b4
mov eax, dword [eax]
push edi
push esi
push 1
push eax
call fcn.0044208f
push edi
call fcn.0043d098
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebx + 8]
call fcn.00402df0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4e49f0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558997
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x38
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0xa980b6df
mov dword [ebp - 0x14], 0xf3c01ed1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0x61453c76
mov dword [ebp - 0x14], 0xa0df89f8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], 0xa980d4ad
mov dword [ebp - 0x14], 0xf3c01ed1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], 0x61453c76
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], 0xa0df89f8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp dword [ebx + 0x1c], 0xf
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x38], eax
lea eax, [ebx + 8]
cmova eax, dword [ebx + 8]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x30]
xorps xmm1, xmmword [ebp - 0x40]
push ecx
push eax
movaps xmmword [ebp - 0x30], xmm1
call fcn.00439810
mov edi, eax
add esp, 8
mov dword [ebp - 0x14], edi
test edi, edi
je 0x4e4b6c
push 2
push 0
push edi
call fcn.0043d5e6
add esp, 0xc
push edi
call fcn.0043939b
add esp, 4
mov edi, eax
push 0
push 0
push dword [ebp - 0x14]
call fcn.0043d5e6
mov ecx, dword [esi + 0x10]
add esp, 0xc
cmp edi, ecx
ja 0x4e4b3d
mov dword [esi + 0x10], edi
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x4e4b37
mov eax, dword [esi]
mov byte [eax + edi], 0
jmp 0x4e4b4b
mov eax, edi
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00418dc0
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x4e4b55
mov eax, dword [esi]
push dword [ebp - 0x14]
push edi
push 1
push eax
call fcn.0044208f
push dword [ebp - 0x14]
call fcn.0043d098
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebx + 8]
call fcn.00402df0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret