joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ef60
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x40efb0
mov edx, dword [0x4b705c]
test edx, edx
js 0x40efc0
mov esi, dword [0x4c3084]
test edx, edx
jne 0x40efd5
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
mov eax, ebx
mov dword [esp + 0x18], esi
call fcn.0040e9d0
cmp eax, 7
jne 0x40efff
lea eax, [esp + 0x18]
call fcn.0040e950
lea esi, [esi]
lea edi, [edi]
mov dword [esp], ebx
call fcn.0040ed30
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call fcn.0040e8b0
mov edx, dword [0x4b705c]
mov esi, dword [0x4c3084]
test edx, edx
je 0x40ef85
mov esi, dword [0x4c3080]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x40ef85
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x40f1d0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x4c3090], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x4c3094], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40f232
mov dword [esp + 4], 0x40f0f0
mov dword [esp], eax
mov dword [0x4c308c], eax
call fcn.00418370
test eax, eax
jne 0x40f23c
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40f22e
call sub.msvcrt.dll_abort
jmp fcn.0040f250
Function at 0x41a2e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov dword [esp], str.winhttp.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x41a33b
mov dword [esp + 4], str.Failed_to_load_winhttp.dll.
mov dword [esp], 0x4b86c0
call fcn.004afd90
mov dword [esp], 0x4adea0
mov ecx, eax
call fcn.00468c10
sub esp, 4
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.WinHttpOpen
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.WinHttpConnect
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.WinHttpOpenRequest
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.WinHttpCloseHandle
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.WinHttpSendRequest
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.WinHttpReceiveResponse
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.WinHttpQueryHeaders
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 4], str.WinHttpReadData
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], edx
nop
leave
ret

Function at 0x41b430
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_fread
mov edx, 0xffffffff
test eax, eax
jle 0x41b468
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x14
pop ebx
pop esi
ret 8
Function at 0x41b480
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x1c
ret 8
Function at 0x422380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x54
lea ebx, [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x3c]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
movzx ebx, byte [esp + 0x70]
mov dword [esp + 8], eax
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 0x3c], 0
call sym.unk_1219
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jne 0x422400
fld xword [esp + 0x40]
mov ecx, dword [esp + 0x7c]
fstp xword [ecx]
add esp, 0x54
pop ebx
pop esi
ret 0x20
mov ebx, dword [esp + 0x78]
mov dword [ebx], ecx
add esp, 0x54
pop ebx
pop esi
ret 0x20

Function at 0x422410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x54
lea ebx, [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x3c]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
movzx ebx, byte [esp + 0x70]
mov dword [esp + 8], eax
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x68]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 0x3c], 0
call sym.unk_462
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jne 0x422490
fld xword [esp + 0x40]
mov ecx, dword [esp + 0x7c]
fstp xword [ecx]
add esp, 0x54
pop ebx
pop esi
ret 0x20
mov ebx, dword [esp + 0x78]
mov dword [ebx], ecx
add esp, 0x54
pop ebx
pop esi
ret 0x20

Function at 0x422920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x60
lea edx, [esp + 0x50]
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x28], 0
mov esi, dword [esp + 0x78]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x24], edx
lea edx, [esp + 0x4c]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0xc], ebx
xor bx, bx
mov dword [esp + 0x1c], edx
movzx edx, byte [esp + 0x80]
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 0x4c], 0
call sym.unk_1220
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x3c], edx
movzx edx, word [esp + 0x3c]
mov dword [esp + 0x38], eax
or edx, ebx
test ecx, ecx
jne 0x4229c0
fld xword [esp + 0x50]
mov ecx, dword [esp + 0x8c]
fstp xword [ecx]
add esp, 0x60
pop ebx
pop esi
pop edi
ret 0x20
mov ebx, dword [esp + 0x88]
mov dword [ebx], ecx
add esp, 0x60
pop ebx
pop esi
pop edi
ret 0x20
Function at 0x4229e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x60
lea edx, [esp + 0x50]
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x28], 0
mov esi, dword [esp + 0x78]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x24], edx
lea edx, [esp + 0x4c]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0xc], ebx
xor bx, bx
mov dword [esp + 0x1c], edx
movzx edx, byte [esp + 0x80]
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov eax, dword [ecx + 8]
mov byte [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 0x4c], 0
call sym.unk_463
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x3c], edx
movzx edx, word [esp + 0x3c]
mov dword [esp + 0x38], eax
or edx, ebx
test ecx, ecx
jne 0x422a80
fld xword [esp + 0x50]
mov ecx, dword [esp + 0x8c]
fstp xword [ecx]
add esp, 0x60
pop ebx
pop esi
pop edi
ret 0x20
mov ebx, dword [esp + 0x88]
mov dword [ebx], ecx
add esp, 0x60
pop ebx
pop esi
pop edi
ret 0x20

Function at 0x42b680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x1c], 4
mov esi, dword [esp + 0x78]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov dword [esp], ebx
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call sym.unk_1041
sub esp, 0x28
mov ebx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x42b781
mov ecx, dword [esp + 0x48]
lea ebp, [ecx + 0x64]
lea eax, [ecx - 0x76c]
test ecx, ecx
mov ecx, dword [esp + 0x88]
cmovs eax, ebp
mov dword [ecx + 0x14], eax
cmp edx, 0xffffffff
sete al
test ebx, ebx
mov ebp, eax
setne al
mov ecx, ebp
and al, cl
mov byte [esp + 0x38], al
jne 0x42b790
cmp edi, 0xffffffff
sete al
test esi, esi
je 0x42b73c
test al, al
jne 0x42b760
mov ebx, ebp
cmp bl, al
jne 0x42b74c
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
xor eax, eax
mov edi, dword [esi + 0xc]
cmp dword [esi + 8], edi
jb 0x42b73c
mov eax, dword [esi]
mov dword [esp + 0x38], edx
mov ecx, esi
call dword [eax + 0x24]
mov edx, dword [esp + 0x38]
cmp eax, 0xffffffff
sete al
jmp 0x42b73c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x42b717
xor ebp, ebp
mov eax, dword [ebx + 0xc]
cmp dword [ebx + 8], eax
jb 0x42b72e
mov eax, dword [ebx]
mov dword [esp + 0x3c], edx
mov ecx, ebx
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
mov eax, 0
cmovne eax, ebx
cmove ebp, edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x34], eax
jmp 0x42b72e
Function at 0x42bab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
mov ebx, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov dword [esp + 0x38], eax
lea eax, [ecx + 0x6c]
mov edi, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.004af430
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], ecx
mov ecx, ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 0x18], 7
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.unk_1044
sub esp, 0x24
mov ebx, eax
mov ebp, eax
mov esi, edx
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x42bc23
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x40]
mov dword [eax + 0x18], edx
cmp esi, 0xffffffff
sete dl
test ebx, ebx
setne al
and al, dl
mov byte [esp + 0x3e], al
jne 0x42bc30
cmp dword [esp + 0x38], 0xffffffff
sete al
test edi, edi
je 0x42bbe2
test al, al
jne 0x42bc01
cmp dl, al
jne 0x42bbf0
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
xor eax, eax
mov ebx, dword [edi + 0xc]
cmp dword [edi + 8], ebx
jb 0x42bbe2
mov eax, dword [edi]
mov byte [esp + 0x38], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x38]
cmp eax, 0xffffffff
sete al
jmp 0x42bbe2
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x42bbbf
xor edx, edx
mov eax, dword [ebx + 0xc]
cmp dword [ebx + 8], eax
jb 0x42bbd2
mov eax, dword [ebx]
mov byte [esp + 0x3f], dl
mov ecx, ebx
mov ebp, 0
call dword [eax + 0x24]
movzx ecx, byte [esp + 0x3e]
movzx edx, byte [esp + 0x3f]
cmp eax, 0xffffffff
cmove edx, ecx
cmovne ebp, ebx
jmp 0x42bbd2
Function at 0x42e380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x7c]
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x24], ecx
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x80]
mov ebp, dword [esp + 0x6c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x70]
add eax, 0x6c
mov dword [esp], eax
call fcn.004af4f0
mov ecx, dword [esp + 0x74]
mov dword [ecx], 0
cmp byte [eax + 0x1c], 0
je 0x42e493
movzx ecx, byte [eax + 0x42]
cmp byte [esp + 0x20], 0
mov byte [esp + 0x3c], cl
je 0x42e480
movzx eax, byte [esp + 0x20]
mov byte [esp + 0x3f], 0
mov byte [esp + 0x3d], al
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x3e], al
lea eax, [esp + 0x3c]
mov dword [esp], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 4], esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 8], edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], eax
call sym.unk_1102
sub esp, 0x20
mov ebx, eax
cmp edx, 0xffffffff
mov esi, edx
sete dl
test ebx, ebx
setne al
and al, dl
mov byte [esp + 0x20], al
jne 0x42e4d0
cmp ebp, 0xffffffff
sete al
test edi, edi
je 0x42e463
test al, al
jne 0x42e510
cmp dl, al
jne 0x42e46e
mov eax, dword [esp + 0x74]
or dword [eax], 2
add esp, 0x4c
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3d], al
jmp 0x42e3fb
mov ecx, eax
mov dword [esp + 0x2c], eax
call sym.unk_871
mov eax, dword [esp + 0x2c]
mov ecx, 0x25
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
cmp edx, sym.unk_857
je 0x42e3d5
mov ecx, eax
mov dword [esp], 0x25
call edx
sub esp, 4
mov ecx, eax
jmp 0x42e3d5
xor edx, edx
mov eax, dword [ebx + 0xc]
cmp dword [ebx + 8], eax
jb 0x42e451
mov eax, dword [ebx]
mov ecx, ebx
mov byte [esp + 0x24], dl
call dword [eax + 0x24]
movzx ecx, byte [esp + 0x20]
movzx edx, byte [esp + 0x24]
cmp eax, 0xffffffff
mov eax, 0
cmove edx, ecx
cmove ebx, eax
jmp 0x42e451
xor eax, eax
mov ecx, dword [edi + 0xc]
cmp dword [edi + 8], ecx
jb 0x42e463
mov eax, dword [edi]
mov byte [esp + 0x20], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x20]
cmp eax, 0xffffffff
sete al
jmp 0x42e463
Function at 0x42e7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x1c], 4
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x14], 0
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp], eax
mov dword [esp + 0x4c], 0
call sym.unk_1357
sub esp, 0x28
mov esi, eax
mov dword [esp + 0x38], eax
movzx eax, dx
or ebx, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], esi
test eax, eax
jne 0x42e8e0
mov ecx, dword [esp + 0x48]
lea ebx, [ecx + 0x64]
test ecx, ecx
lea eax, [ecx - 0x76c]
mov ecx, dword [esp + 0x88]
cmovs eax, ebx
cmp dx, 0xffff
sete bl
test esi, esi
setne dl
mov dword [ecx + 0x14], eax
and dl, bl
jne 0x42e8fa
cmp bp, 0xffff
sete al
mov edx, eax
test edi, edi
je 0x42e89c
test al, al
jne 0x42e8c0
cmp bl, dl
jne 0x42e8aa
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x42e922
movzx eax, word [eax]
cmp ax, 0xffff
sete dl
cmp bl, dl
jne 0x42e8aa
jmp 0x42e8a0
mov eax, dword [esp + 0x84]
or dword [eax], 4
cmp dx, 0xffff
sete bl
test esi, esi
setne dl
and dl, bl
je 0x42e88b
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x42e930
movzx eax, word [eax]
cmp ax, 0xffff
mov eax, 0
mov ebx, 0
cmovne eax, esi
cmove ebx, edx
mov dword [esp + 0x30], eax
jmp 0x42e88b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
jmp 0x42e8cb
mov eax, dword [esi]
mov byte [esp + 0x30], dl
mov ecx, esi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x30]
jmp 0x42e905
Function at 0x42ec00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov esi, dword [esp + 0xb0]
mov eax, dword [esp + 0xac]
mov dword [esp + 0x34], ecx
mov ebp, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov dword [esp + 0x30], eax
lea eax, [esi + 0x6c]
mov edi, dword [esp + 0xa8]
mov dword [esp], eax
call fcn.004af490
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x18], 7
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.unk_1360
sub esp, 0x24
mov esi, eax
mov dword [esp + 0x38], eax
movzx eax, dx
mov ebp, esi
or ebx, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x3c], edx
test eax, eax
jne 0x42ed74
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x40]
mov dword [eax + 0x18], ecx
cmp dx, 0xffff
sete dl
test esi, esi
setne al
and al, dl
mov byte [esp + 0x34], al
jne 0x42ed80
cmp word [esp + 0x30], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x42ed41
test al, al
jne 0x42ed60
cmp dl, cl
jne 0x42ed4f
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x42edb0
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x42ed41
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x42ed1a
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x42edc2
movzx eax, word [eax]
movzx ecx, byte [esp + 0x34]
cmp ax, 0xffff
mov edx, 0
mov ebp, 0
cmovne ebp, esi
cmove edx, ecx
jmp 0x42ed2e
mov eax, dword [edi]
mov byte [esp + 0x30], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x30]
jmp 0x42ed6b
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
jmp 0x42ed8b
Function at 0x4318d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x78]
mov ebp, dword [esp + 0x70]
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0x8c]
mov edi, dword [esp + 0x90]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x80]
add eax, 0x6c
mov dword [esp], eax
call fcn.004af550
mov ecx, dword [esp + 0x84]
mov edx, dword [eax]
mov dword [ecx], 0
mov ecx, eax
mov dword [esp], 0x25
call dword [edx + 0x28]
sub esp, 4
mov word [esp + 0x48], ax
mov eax, esi
movsx si, al
mov eax, edi
test al, al
jne 0x431a20
xor eax, eax
mov word [esp + 0x4a], si
mov word [esp + 0x4c], ax
lea eax, [esp + 0x48]
mov dword [esp], ebp
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], eax
call sym.unk_1418
sub esp, 0x20
mov esi, eax
mov dword [esp + 0x38], eax
movzx eax, dx
mov ebp, esi
or ebx, eax
cmp dx, 0xffff
mov dword [esp + 0x3c], edx
sete dl
test esi, esi
setne al
and al, dl
mov edi, eax
jne 0x431a40
cmp word [esp + 0x30], 0xffff
mov esi, dword [esp + 0x2c]
sete al
mov ecx, eax
test esi, esi
je 0x4319db
test al, al
jne 0x431a00
cmp dl, cl
jne 0x4319e9
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
mov edi, dword [esp + 0x2c]
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x431a64
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x4319db
movsx di, al
mov word [esp + 0x4c], si
mov word [esp + 0x4a], di
xor edi, edi
mov word [esp + 0x4e], di
jmp 0x431952
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jae 0x431a80
movzx eax, word [eax]
cmp ax, 0xffff
mov edx, 0
mov ebp, 0
cmove edx, edi
cmovne ebp, esi
jmp 0x4319c4
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x30], dl
mov eax, dword [ecx]
call dword [eax + 0x24]
movzx edx, byte [esp + 0x30]
jmp 0x431a0f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
jmp 0x431a4b
Function at 0x46f550
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
jmp 0x46f56e
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x46f58c
mov ecx, edi
call fcn.0046f290
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x46f563
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8