joyce8/EMBER2024-capa huggingface dataset:
Function at 0x641660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
push ebx
push esi
push edi
mov esi, eax
lea edi, [esp + 0x20]
call fcn.004ad1c0
mov eax, edi
push 0x6cc098
push eax
call fcn.006b227b
add esp, 8
test eax, eax
jne 0x641724
push 3
push 3
push SysReAllocStringLen
push esi
mov eax, 0x3e8
call fcn.004abf70
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0xc
lea edx, [esp + 0x20]
mov esi, eax
push edx
push esi
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x641718
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea ecx, [ecx]
cmp eax, 0xc
jne 0x641718
cmp dword [esp + 0x14], 0x46464952
jne 0x641718
cmp dword [esp + 0x1c], 0x58495641
je 0x64172d
mov eax, dword [esp + 0x18]
cmp eax, 4
jbe 0x641718
push 1
add eax, 0xfffffffc
cdq
push 0
push edx
push eax
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 0xc
lea ecx, [esp + 0x20]
push ecx
push esi
call edi
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x6416d0
cmp esi, 0xffffffff
je 0x641724
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x641739
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x641750
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3c
cmp word [eax], 0
push ebx
push ebp
push esi
push edi
je 0x64188d
push 3
push 3
push SysReAllocStringLen
push eax
mov eax, 0x3e8
call fcn.004abf70
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
je 0x64188d
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x18]
push eax
mov ebp, 0xc
push ebp
lea ecx, [esp + 0x3c]
push ecx
push esi
call edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x641886
cmp eax, ebp
jne 0x641886
cmp dword [esp + 0x30], 0x46464952
jne 0x641886
cmp dword [esp + 0x38], 0x20495641
jne 0x641886
push 0
lea edx, [esp + 0x18]
push edx
push ebp
lea eax, [esp + 0x48]
push eax
push esi
call edi
cmp dword [esp + 0x14], ebp
jne 0x641886
cmp dword [esp + 0x3c], 0x5453494c
jne 0x641886
cmp dword [esp + 0x44], 0x6c726468
jne 0x641886
push 0
lea ecx, [esp + 0x18]
push ecx
push 8
lea edx, [esp + 0x28]
push edx
push esi
call edi
cmp dword [esp + 0x14], 8
jne 0x641886
cmp dword [esp + 0x1c], 0x68697661
jne 0x641886
push 0
push 0x38
lea edx, [esp + 0x20]
call fcn.00496fd0
xor ebx, ebx
push ebx
lea eax, [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x30]
push ecx
push esi
call edi
cmp dword [esp + 0x14], ebp
jne 0x641886
jmp 0x641850
cmp dword [esp + 0x2c], 0x6c727473
jne 0x641897
mov edx, dword [esp + 0x28]
add edx, 0xfffffffc
push 0
push edx
lea edx, [esp + 0x20]
add ebx, 1
call fcn.00496fd0
push 0
lea eax, [esp + 0x18]
push eax
push ebp
lea ecx, [esp + 0x30]
push ecx
push esi
call edi
cmp dword [esp + 0x14], ebp
je 0x641850
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x3c
ret
Function at 0x659770
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x418
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push edi
jbe 0x65991c
lea esp, [esp]
mov eax, dword [esi + 0x1128]
cmp eax, 0x3ffff800
jae 0x6597e6
mov edi, 0x3ffff800
sub edi, eax
cmp edi, ebx
jbe 0x6597aa
mov edi, ebx
cmp word [esi + 0xdf4], 0
je 0x6597d6
mov eax, dword [esi + 0x134f]
cmp eax, 0xffffffff
je 0x65991c
mov edx, dword [ebp + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [ebp + 8], edi
sub ebx, edi
add dword [esi + 0x1128], edi
jmp 0x659914
mov eax, dword [esi + 0x134f]
cmp eax, 0xffffffff
je 0x659802
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x134f], 0xffffffff
cmp word [esi + 0xdf4], 0
je 0x659900
cmp byte [esi + 0x1584], 0
mov word [esp + 0x10], 0
je 0x65983d
movzx eax, byte [esi + 0x137b]
push eax
lea ecx, [esi + 0x137c]
push ecx
lea eax, [esp + 0x18]
call fcn.00483050
add esp, 8
jmp 0x659886
lea edi, [esi + 0x137c]
push 0x6c7c70
push edi
call fcn.0069c886
add esp, 8
test eax, eax
je 0x65987b
add byte [esi + 0x134e], 1
movzx edx, byte [esi + 0x134e]
movzx eax, byte [esi + 0x137b]
push edx
push eax
push edi
lea eax, [esp + 0x1c]
call fcn.00483050
add esp, 0xc
jmp 0x659886
mov ecx, edi
lea eax, [esp + 0x10]
call fcn.00638030
push 0x6bc0cc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x220]
lea eax, [esi + 0x1146]
push edx
mov word [esp + 0x224], 0
call fcn.004ad3a0
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x134f]
cmp eax, 0xffffffff
je 0x6598cd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
push 1
push 0xc0000000
lea ecx, [esp + 0x224]
push ecx
mov eax, 0x3e8
call fcn.004abf70
push 2
xor ecx, ecx
push ecx
mov edi, eax
push ecx
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov dword [esi + 0x134f], edi
xor eax, eax
mov dword [esi + 0x1128], eax
mov dword [esi + 0x1120], ebx
mov dword [esi + 0x1124], eax
test ebx, ebx
ja 0x659790
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x65a0f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x224
push esi
push edi
mov esi, eax
lea edi, [esp + 0x20]
call fcn.004ad1c0
mov eax, edi
push eax
call fcn.0069cab9
add esp, 4
mov ecx, str..wpp
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x65a13b
test dx, dx
je 0x65a137
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x65a13b
add eax, 4
add ecx, 4
test dx, dx
jne 0x65a115
xor eax, eax
jmp 0x65a140
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x65a20c
mov ecx, str..jp2
lea eax, [esp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x65a177
test dx, dx
je 0x65a173
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x65a177
add eax, 4
add ecx, 4
test dx, dx
jne 0x65a151
xor eax, eax
jmp 0x65a17c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x65a20c
mov ecx, str..tif
lea eax, [esp + 0x20]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x65a1b6
test dx, dx
je 0x65a1b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x65a1b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x65a190
xor eax, eax
jmp 0x65a1bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x65a20c
mov ecx, 0x6cc098
lea eax, [esp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x65a1ee
test dx, dx
je 0x65a1ea
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x65a1ee
add eax, 4
add ecx, 4
test dx, dx
jne 0x65a1c8
xor eax, eax
jmp 0x65a1f3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x65a217
push esi
lea ecx, [esp + 0x14]
push ecx
call fcn.006413b0
cmp dword [esp + 0x1c], 0x43435354
jne 0x65a284
xor al, al
pop edi
pop esi
add esp, 0x224
ret
mov ecx, str..ram
lea eax, [esp + 0x20]
call fcn.00401160
test eax, eax
jne 0x65a284
mov eax, esi
lea esi, [esp + 8]
call fcn.00497160
mov esi, dword [esp + 8]
cmp esi, 0xffffffff
je 0x65a20c
push 0
lea edx, [esp + 0xc]
push edx
push 4
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 8], 4
je 0x65a26b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
add esp, 0x224
ret
mov eax, dword [esp + 0xc]
cmp al, 0x2e
jne 0x65a259
cmp ah, 0x72
je 0x65a27d
cmp ah, 0x52
jne 0x65a259
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
add esp, 0x224
ret
Function at 0x65e5f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10c
mov eax, str..264
push esi
mov dword [esp + 4], eax
mov dword [esp + 8], str..3g2
mov dword [esp + 0xc], str..3gp
mov dword [esp + 0x10], str..3gpp
mov dword [esp + 0x14], str..amv
mov dword [esp + 0x18], 0x6c9680
mov dword [esp + 0x1c], str..asx
mov dword [esp + 0x20], 0x6cc098
mov dword [esp + 0x24], str..bik
mov dword [esp + 0x28], 0x6e9fa0
mov dword [esp + 0x2c], str..dav
mov dword [esp + 0x30], str..div
mov dword [esp + 0x34], str..divx
mov dword [esp + 0x38], 0x6d15d8
mov dword [esp + 0x3c], str..dvr_ms
mov dword [esp + 0x40], str..evo
mov dword [esp + 0x44], str..f4v
mov dword [esp + 0x48], str..flc
mov dword [esp + 0x4c], 0x6ccf0c
mov dword [esp + 0x50], 0x6ccf00
mov dword [esp + 0x54], str..h264
mov dword [esp + 0x58], str..hevc
mov dword [esp + 0x5c], str..hdmov
mov dword [esp + 0x60], str..k3g
mov dword [esp + 0x64], str..kmv
mov dword [esp + 0x68], str..m1v
mov dword [esp + 0x6c], str..m2p
mov dword [esp + 0x70], str..m2t
mov dword [esp + 0x74], str..m2ts
mov dword [esp + 0x78], str..m2v
mov dword [esp + 0x7c], str..m4v
mov dword [esp + 0x80], str..mjpeg
mov dword [esp + 0x84], str..mkv
mov dword [esp + 0x88], str..mod
mov dword [esp + 0x8c], str..moov
mov dword [esp + 0x90], 0x6cc0b0
mov dword [esp + 0x94], 0x6cc0a4
mov dword [esp + 0x98], str..mp4v
mov dword [esp + 0x9c], str..mpe
mov dword [esp + 0xa0], str..mpeg
mov dword [esp + 0xa4], 0x6ccf18
mov dword [esp + 0xa8], str..mqv
mov dword [esp + 0xac], str..mts
mov dword [esp + 0xb0], str..mtv
mov dword [esp + 0xb4], str..mxf
mov dword [esp + 0xb8], str..nsv
mov dword [esp + 0xbc], str..nut
mov dword [esp + 0xc0], str..ogg
mov dword [esp + 0xc4], str..ogm
mov dword [esp + 0xc8], str..ogv
mov dword [esp + 0xcc], 0x6d631c
mov dword [esp + 0xd0], str..rmvb
mov dword [esp + 0xd4], 0x71ec48
mov dword [esp + 0xd8], str..swf
mov dword [esp + 0xdc], str..thp
mov dword [esp + 0xe0], str..tod
mov dword [esp + 0xe4], 0x71ec68
mov dword [esp + 0xe8], str..ts4
mov dword [esp + 0xec], str..vob
mov dword [esp + 0xf0], str..vro
mov dword [esp + 0xf4], 0x6cc0bc
mov dword [esp + 0xf8], 0x6c9674
mov dword [esp + 0xfc], str..wtv
mov dword [esp + 0x100], str..xmv
mov dword [esp + 0x104], str..xvid
mov dword [esp + 0x108], str..y4m
mov dword [esp + 0x10c], 0
xor esi, esi
mov edi, edi
push eax
push edi
call fcn.006b227b
add esp, 8
test eax, eax
je 0x65e8a3
mov eax, dword [esp + esi*4 + 8]
add esi, 1
test eax, eax
jne 0x65e880
xor al, al
pop esi
add esp, 0x10c
ret
mov al, 1
pop esi
add esp, 0x10c
ret
Function at 0x664290
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x10
cmp byte [edi + 4], 0
push esi
mov dword [edi], 0x721408
jne 0x664304
cmp dword [edi + 0xd], 0xffffffff
je 0x664304
mov edx, dword [edi + 9]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 0x12345
call esi
mov edx, dword [edi + 9]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push edx
call esi
mov edx, dword [edi + 0xd]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], 0x12345
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edi + 0x25b]
push eax
call fcn.0069c8fa
mov eax, dword [edi + 0x246]
add esp, 4
test eax, eax
je 0x664326
push eax
call fcn.0069c8fa
add esp, 4
lea esi, [edi + 0x11]
call fcn.004cabe0
mov ecx, dword [edi + 9]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [edi + 0xd]
push edx
call esi
mov eax, dword [edi + 5]
cmp eax, 0xffffffff
je 0x66435a
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 5]
push eax
call esi
mov dword [edi], 0x7213f8
pop esi
add esp, 0x10
ret
Function at 0x664690
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x30
cmp byte [esi + 4], 0
je 0x66469f
xor al, al
add esp, 0x30
ret
cmp dword [esi + 0xd], 0xffffffff
je 0x664699
xor eax, eax
cmp dword [esi + 0x242], eax
ja 0x664699
mov ecx, dword [esi + 0x1d]
push ebx
mov ebx, dword [esi + 0x19]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 9]
push eax
push ecx
mov dword [esp + 0x1c], 3
mov dword [esp + 0x2c], 0x12345
call edi
mov ecx, dword [esi + 9]
push 0
lea edx, [esp + 0x10]
push edx
push 0xc
lea eax, [esp + 0x1c]
push eax
push ecx
call edi
mov ecx, dword [esi + 0xd]
xor eax, eax
push eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
push 0x19
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x45], 0x12345
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0xc], 0x19
jne 0x664754
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x66475c
pop edi
xor al, al
pop ebx
add esp, 0x30
ret
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x242], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x23e], ebx
mov dword [esi + 0x226], eax
xor eax, eax
cmp byte [esp + 0x30], al
mov dword [esi + 0x222], edx
mov edx, dword [esp + 0x2c]
setne al
pop edi
mov dword [esi + 0x22a], ecx
mov dword [esi + 0x22e], edx
pop ebx
mov dword [esi + 0x23a], eax
mov al, 1
add esp, 0x30
ret

Function at 0x664c60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x10
cmp byte [edi + 4], 0
push esi
mov dword [edi], 0x722e68
jne 0x664cd4
cmp dword [edi + 0xd], 0xffffffff
je 0x664cd4
mov edx, dword [edi + 9]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 0x12345
call esi
mov edx, dword [edi + 9]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push edx
call esi
mov edx, dword [edi + 0xd]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], 0x12345
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edi + 0x25f]
push eax
call fcn.0069c8fa
mov eax, dword [edi + 0x24a]
add esp, 4
test eax, eax
je 0x664cf6
push eax
call fcn.0069c8fa
add esp, 4
lea esi, [edi + 0x11]
call fcn.004cabe0
mov ecx, dword [edi + 9]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [edi + 0xd]
push edx
call esi
mov eax, dword [edi + 5]
cmp eax, 0xffffffff
je 0x664d2a
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 5]
push eax
call esi
mov dword [edi], 0x7213f8
pop esi
add esp, 0x10
ret
Function at 0x665040
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x30
cmp byte [esi + 4], 0
je 0x66504f
xor al, al
add esp, 0x30
ret
cmp dword [esi + 0xd], 0xffffffff
je 0x665049
xor eax, eax
cmp dword [esi + 0x246], eax
ja 0x665049
mov ecx, dword [esi + 0x1d]
push ebx
mov ebx, dword [esi + 0x19]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 9]
push eax
push ecx
mov dword [esp + 0x1c], 3
mov dword [esp + 0x2c], 0x12345
call edi
mov ecx, dword [esi + 9]
push 0
lea edx, [esp + 0x10]
push edx
push 0xc
lea eax, [esp + 0x1c]
push eax
push ecx
call edi
mov ecx, dword [esi + 0xd]
xor eax, eax
push eax
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
push 0x19
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x45], 0x12345
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0xc], 0x19
jne 0x665104
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x66510c
pop edi
xor al, al
pop ebx
add esp, 0x30
ret
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x246], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x242], ebx
mov dword [esi + 0x22a], eax
xor eax, eax
cmp byte [esp + 0x30], al
mov dword [esi + 0x226], edx
mov edx, dword [esp + 0x2c]
setne al
pop edi
mov dword [esi + 0x22e], ecx
mov dword [esi + 0x232], edx
pop ebx
mov dword [esi + 0x23e], eax
mov al, 1
add esp, 0x30
ret

Function at 0x6683d0
Capabilities:
Get file size

Disassembly:
sub esp, 0x14
test eax, eax
push ebx
push esi
je 0x66842a
cmp word [eax], 0
je 0x66842a
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], esi
je 0x66842a
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x668423
cmp dword [esp + 0x14], 0
ja 0x668432
jb 0x668423
cmp dword [esp + 0x10], 8
jae 0x668432
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
pop ebx
add esp, 0x14
ret
lea edx, [esp + 0xc]
call fcn.00402110
lea edx, [esp + 0xc]
call fcn.00402110
bswap eax
cmp eax, 0x66747970
push esi
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
add esp, 0x14
ret
Function at 0x66f970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
sub esp, 0x1c
test eax, eax
push ebx
push esi
push edi
je 0x66f98a
mov bl, byte [eax + 8]
jmp 0x66f98c
mov bl, 1
test eax, eax
je 0x66f995
mov esi, dword [eax + 4]
jmp 0x66f99a
mov esi, 0xac44
push 0x24
call fcn.0069e704
add esp, 4
test eax, eax
jne 0x66fa61
call fcn.004b05b0
xor esi, esi
mov ecx, dword [ebp + 0x10]
mov edi, 1
add word [esi + 0x12], di
mov eax, dword [ecx]
test eax, eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], str.Extracting_audio_track
jne 0x66f9df
mov eax, dword [0x73658c]
test eax, eax
jne 0x66f9df
call fcn.005ebef0
mov edx, dword [eax + 0xe]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push edx
mov dword [esp + 0x20], eax
call ebx
mov ecx, dword [ebp + 0xc]
add word [esi + 0x12], di
lea eax, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0
call fcn.005e9fd0
lea esi, [esp + 0x10]
call fcn.005ebb80
mov esi, dword [esp + 0x14]
test esi, esi
je 0x66fa74
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x18]
mov dword [ebx], esi
call fcn.0066fb20
mov ecx, dword [esp + 0x10]
add word [ecx + 0x12], 0xffff
movzx eax, word [ecx + 0x12]
test ax, ax
jne 0x66fa56
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
push esi
push eax
mov al, bl
call fcn.005f9340
mov esi, eax
jmp 0x66f9b3
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.005f3440
mov edi, dword [ebp + 0x10]
push eax
call fcn.005ebe20
mov esi, dword [esp + 0x14]
test esi, esi
je 0x66fac3
mov dword [esp + 0x14], 0
mov eax, dword [esi + 0xe]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x66fac3
cmp esi, dword [0x73658c]
je 0x66fabd
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
jmp 0x66fac3
mov ecx, dword [esi + 0xe]
push ecx
call ebx
mov edx, edi
mov eax, dword [edx]
test eax, eax
je 0x66fae1
cmp byte [eax + 0xd], 0
setne al
test al, al
jne 0x66fae1
mov esi, dword [ebp + 8]
mov dword [esi], 0
jmp 0x66faea
mov esi, dword [ebp + 8]
mov dword [esi], 2
lea edi, [esp + 0x18]
call fcn.0066fb20
mov ecx, dword [esp + 0x10]
add word [ecx + 0x12], 0xffff
movzx eax, word [ecx + 0x12]
test ax, ax
jne 0x66fb0e
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x673080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
push ebx
push esi
mov dword [edi], 0x7223b0
or esi, 0xffffffff
lea eax, [edi + 8]
mov dword [edi + 4], esi
call fcn.00676dc0
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [edi + 0x74], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x80], ebx
mov dword [edi + 0x84], ebx
mov dword [edi + 0x88], ebx
mov word [edi + 0x8c], bx
mov word [edi + 0x8e], bx
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], ebx
mov dword [edi + 0x98], ebx
mov dword [edi + 0x9c], eax
mov dword [edi + 0xa0], ebx
mov byte [edi + 0xa4], bl
mov byte [edi + 0xa5], bl
mov dword [edi + 0xa6], ebx
mov byte [edi + 0xaa], bl
mov dword [edi + 0xab], esi
mov dword [edi + 0xaf], ebx
mov dword [edi + 0xb3], ebx
mov eax, dword [edi + 4]
cmp eax, esi
je 0x673123
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, esi
mov dword [edi + 4], eax
je 0x673277
mov ecx, dword [edi + 4]
push ebx
lea edx, [esp + 0xc]
push edx
push 8
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 8], 8
jne 0x673277
lea ebx, [ebx]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
bswap edx
bswap eax
push ecx
lea esi, [esp + 0x1c]
mov ecx, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.00676aa0
test al, al
je 0x673277
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
or edx, eax
je 0x673255
mov edx, dword [esp + 0x14]
cmp edx, 0x75756964
jne 0x6731e8
mov edx, dword [edi + 4]
push ebx
lea eax, [esp + 0x10]
push eax
push 0x10
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0xc], 0x10
jne 0x673277
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp edx, 0x6d6f6f76
ja 0x673217
je 0x67320d
cmp edx, 0x66726565
je 0x673238
cmp edx, 0x6d6f6f66
jne 0x673227
push eax
push ecx
mov eax, edi
call fcn.006732b0
jmp 0x673251
push eax
push ecx
push edi
call fcn.00673510
jmp 0x673251
cmp edx, 0x73696478
je 0x673249
cmp edx, 0x736b6970
je 0x673238
push 1
push ebx
push eax
mov eax, dword [edi + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x673255
push 1
push ebx
push eax
push ecx
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x673255
push eax
push ecx
push edi
call fcn.006738d0
cmp al, bl
je 0x673277
mov ecx, dword [edi + 4]
push ebx
lea edx, [esp + 0xc]
push edx
push 8
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 8], 8
je 0x673170
pop esi
mov eax, edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6738d0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp byte [ebx + 0xa5], 0
push ebp
push esi
push edi
je 0x673902
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx + 4]
push 1
push 0
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
cmp dword [esp + 0x1c], 0
mov byte [ebx + 0xa5], 1
ja 0x673954
mov edi, dword [esp + 0x18]
cmp edi, 0xffffffff
ja 0x673954
lea esi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.00554970
mov ebp, dword [esp + 0x14]
test ebp, ebp
push 0
je 0x67394c
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], edi
je 0x67395d
push ebp
call fcn.0069c8fa
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
cmp edi, 0xc
jb 0x67394b
cmp byte [ebp + 8], 0
lea ecx, [ebp + 4]
jne 0x67397c
call fcn.00677010
lea esi, [ebx + 0x74]
mov eax, ecx
call fcn.00672f40
jmp 0x67398b
call fcn.00677080
lea esi, [ebx + 0x74]
mov eax, ecx
call fcn.00672fe0
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x67394b
xor ecx, ecx
xor edx, edx
cmp word [ebx + 0x8e], cx
jbe 0x6739bf
mov eax, dword [ebx + 0x90]
movzx esi, word [ebx + 0x8e]
add eax, 4
nop
mov edi, dword [eax]
add ecx, edi
adc edx, 0
add eax, 0xc
sub esi, 1
jne 0x6739b0
push 0
push 0x3e8
push edx
push ecx
call fcn.006abd10
mov ecx, dword [ebx + 0x78]
push 0
push ecx
push edx
push eax
call fcn.006a1e10
push ebp
mov dword [ebx + 0xab], eax
call fcn.0069c8fa
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc