joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428f16
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
lea eax, [edx + edx*2]
shr eax, 2
xor edi, edi
cmp dword [ebp + 8], eax
jb 0x4290af
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 3
mov esi, dword [ebp - 0x2c]
cmp eax, esi
jae 0x4290af
xor eax, eax
xor edx, edx
mov esi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x20]
add esi, ecx
mov dword [ebp - 0x24], esi
mov esi, dword [ebp - 0x20]
lea ecx, [eax + esi]
mov esi, dword [ebp - 0x2c]
cmp ecx, esi
jae 0x428fa0
mov esi, dword [ebp - 0x24]
mov cl, byte [esi + eax]
mov ebx, ecx
and ebx, 0xffffffdf
sub ebx, 0x41
cmp bl, 0x19
jbe 0x428f93
lea ebx, [ecx - 0x2b]
cmp bl, 0x12
ja 0x428f90
mov esi, 0xfffb800e
bt esi, ebx
jae 0x428f93
inc eax
jmp 0x428f5e
mov byte [ebp + edx - 0x10], cl
inc edx
inc eax
cmp edx, 4
jne 0x428f5e
jmp 0x428fad
cmp edx, 4
je 0x428fad
mov byte [ebp + edx - 0x10], 0xff
inc edx
jmp 0x428fa0
add dword [ebp - 0x20], eax
movzx eax, byte [ebp - 0x10]
mov byte [ebp - 0x25], 0xff
test al, al
js 0x428fc5
mov al, byte [eax + 0x5cd495]
mov byte [ebp - 0x25], al
xor edx, edx
cmp byte [ebp - 0x25], 0xff
sete dl
movzx eax, byte [ebp - 0xf]
mov bl, 0xff
test al, al
js 0x428fde
mov bl, byte [eax + 0x5cd495]
xor ecx, ecx
cmp bl, 0xff
sete cl
add ecx, edx
movzx eax, byte [ebp - 0xe]
mov byte [ebp - 0x24], 0xff
test al, al
js 0x428ffd
mov al, byte [eax + 0x5cd495]
mov byte [ebp - 0x24], al
xor edx, edx
cmp byte [ebp - 0x24], 0xff
sete dl
add edx, ecx
movzx eax, byte [ebp - 0xd]
mov byte [ebp - 0x26], 0xff
test al, al
js 0x42901d
mov al, byte [eax + 0x5cd495]
mov byte [ebp - 0x26], al
xor eax, eax
cmp byte [ebp - 0x26], 0xff
sete al
add eax, edx
mov dword [ebp - 0x34], eax
lea ecx, [edi + 1]
mov eax, dword [ebp - 0x30]
lea esi, [eax + edi]
mov eax, ebx
shr ax, 4
and eax, 3
mov dl, byte [ebp - 0x25]
shl edx, 2
or eax, edx
shl ebx, 4
mov byte [ebp - 0x25], bl
mov ebx, dword [ebp - 0x30]
add ebx, ecx
cmp dword [ebp - 0x34], 2
jne 0x42905f
mov byte [esi], al
mov al, byte [ebp - 0x25]
mov byte [ebx], al
jmp 0x4290a8
lea ecx, [edi + 2]
mov edx, dword [ebp - 0x24]
shr dx, 2
and edx, 0xf
or dl, byte [ebp - 0x25]
mov byte [ebp - 0x25], dl
mov dl, byte [ebp - 0x24]
shl edx, 6
mov byte [ebp - 0x24], dl
mov edx, dword [ebp - 0x30]
add edx, ecx
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x34], 1
mov byte [esi], al
mov al, byte [ebp - 0x25]
mov byte [ebx], al
jne 0x429097
mov edi, edx
mov al, byte [ebp - 0x24]
jmp 0x4290a6
lea ecx, [edi + 3]
mov al, byte [ebp - 0x26]
and eax, 0x3f
or eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x38]
mov byte [edi], al
mov edi, ecx
jmp 0x428f3e
mov eax, edi
add esp, 0x30
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4290b9
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov ebx, edx
mov dword [ebp - 0x10], ecx
mov edx, eax
mov eax, 3
sub eax, ebx
mov esi, eax
mov eax, ecx
lea edi, [ebx - 3]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x14]
lea ecx, [edi + esi]
cmp ecx, ebx
jae 0x429189
mov cl, byte [edx]
shr cl, 2
movzx ecx, cl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
cmp esi, 2
jne 0x429117
movzx ecx, byte [edx]
shl ecx, 4
and ecx, 0x30
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov byte [eax + 2], 0x3d
mov cl, 0x3d
jmp 0x429178
movzx edi, byte [edx]
shl edi, 4
and edi, 0x30
mov cl, byte [edx + 1]
shr cl, 4
movzx ecx, cl
or edi, ecx
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x42914e
movzx ecx, byte [edx + 1]
shl ecx, 2
and ecx, 0x3c
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
jmp 0x429113
movzx edi, byte [edx + 1]
shl edi, 2
and edi, 0x3c
mov cl, byte [edx + 2]
shr cl, 6
movzx ecx, cl
or edi, ecx
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov cl, byte [edx + 2]
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
add eax, 4
add edx, 3
add esi, 3
jmp 0x4290da
mov ebx, dword [ebp - 0x10]
sub eax, ebx
pop edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x429195
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, eax
mov ebx, edx
lea eax, [edx*4]
mov edi, 3
xor edx, edx
div edi
cmp dword [ebp + 8], eax
jb 0x4291c1
mov edx, ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004290b9
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4293bd
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x1a0
mov ebx, eax
cmp dword [0x611714], 0
je 0x4293e7
mov dword [esp], 0x1c
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov edx, eax
test eax, eax
jne 0x429408
jmp 0x429404
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push edx
push edx
test eax, eax
je 0x4293d3
xor edx, edx
jmp 0x429437
mov ecx, 7
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
dec ebx
jne 0x42941c
mov dword [edx], 0x200
lea ebx, [edx + 8]
mov ecx, 4
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [edx + 0x18], 0x10
inc dword [0x611714]
mov eax, edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x429440
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, eax
mov eax, dword [eax + 4]
test eax, eax
je 0x42948a
bt dword [ebx], 0xc
jae 0x42948a
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [esp + 0x10], 8
lea edx, [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0xd
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
mov eax, dword [ebx + 4]
test eax, eax
je 0x42949b
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
push edx
xor eax, eax
mov dword [ebx + 4], eax
mov eax, dword [ebx]
bt eax, 0xf
jae 0x4294ad
and ah, 0x7f
mov dword [ebx], eax
dec dword [0x611714]
jne 0x4294bb
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x42a38c
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [ebp - 0x134], edx
test eax, eax
je 0x42a50a
mov ebx, eax
mov edx, dword [eax + 4]
or eax, 0xffffffff
test edx, edx
je 0x42a50d
mov edi, ecx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x11c], 1
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], 0x1f4
lea eax, [ebp - 0x124]
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x11c]
mov dword [esp + 8], esi
xor eax, eax
mov dword [esp + 4], eax
inc edx
mov dword [esp], edx
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x42a42a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xb
mov eax, 0xffffffd3
je 0x42a50d
mov eax, 0xffffffd6
jmp 0x42a50d
mov dword [ebp - 0x12c], 1
test eax, eax
je 0x42a457
mov dword [esp + 4], esi
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.WS2_32.dll___WSAFDIsSet
push edx
push edx
test eax, eax
sete al
movzx eax, al
mov dword [ebp - 0x12c], eax
xor esi, esi
cmp esi, edi
jae 0x42a506
mov ecx, edi
sub ecx, esi
mov eax, dword [ebp - 0x134]
lea edx, [eax + esi]
mov eax, dword [ebx + 4]
mov dword [ebp - 0x130], eax
bt dword [ebx], 0xe
jae 0x42a4ad
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x14], eax
lea eax, [ebx + 8]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_sendto]
sub esp, 0x18
jmp 0x42a4cd
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x42a4ff
mov eax, 0xffffffd4
cmp dword [ebp - 0x12c], 0
jne 0x42a50d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov eax, 0xffffffd5
cmp edx, 0x6c
je 0x42a50d
cmp edx, 0x7e
je 0x42a50d
cmp edx, 0xb
jmp 0x42a415
add esi, eax
jmp 0x42a459
xor eax, eax
jmp 0x42a50d
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42e5d3
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, eax
mov dword [ebp - 0x2c], edx
mov eax, dword [eax + 0x44]
test eax, eax
je 0x42e792
cmp dword [eax + 4], 0
je 0x42e792
cmp dword [ebx + 0x4c], 0
je 0x42e6ea
mov dword [esp + 4], 0x3b
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
mov esi, eax
test eax, eax
jne 0x42e621
mov edx, dword [ebp - 0x2c]
jmp 0x42e759
mov dword [esp + 4], 0x26
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strrchr
mov edi, eax
mov byte [esi], 0
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov edx, dword [ebp - 0x30]
lea eax, [edx + eax + 1]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
lea eax, [edi + 1]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.005ae188
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov eax, ebx
call fcn.00425ca0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x42e6c8
cmp dword [ebp - 0x1c], 0
jne 0x42e6c8
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.004255c6
mov edx, 1
mov eax, ebx
call fcn.0042db8f
mov byte [esi], 0x3b
jmp 0x42e78a
mov dword [ebp - 0x2c], ecx
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
sub dword [ebx + 0xc], eax
mov byte [edi], 0
xor eax, eax
mov dword [ebx + 0x4c], eax
mov byte [esi], 0x3b
inc esi
mov ecx, dword [ebp - 0x2c]
jmp 0x42e76e
mov dword [esp + 4], 0x26
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
mov edi, eax
test eax, eax
je 0x42e792
lea esi, [eax + 1]
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, ebx
call fcn.00425ca0
mov dword [ebp - 0x30], eax
mov byte [edi], 0
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.004255c6
mov edx, 1
mov eax, ebx
call fcn.0042db8f
mov byte [edi], 0x26
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x42e767
cmp dword [ebp - 0x1c], 0
jne 0x42e750
mov edx, 0x5cd3c6
mov eax, ebx
call fcn.004255c6
jmp 0x42e78a
mov dword [ebx + 0x4c], 1
mov edx, edi
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004255c6
mov eax, dword [ecx + 8]
lea esi, [edi + eax + 2]
mov edi, dword [ebx + 0x1c]
mov edx, dword [ecx + 4]
mov eax, ebx
call fcn.004255c6
mov edx, 1
mov eax, ebx
call fcn.0042db8f
mov dword [ebx + 0x1c], edi
mov dword [ebp - 0x2c], esi
jmp 0x42e5f6
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.004255c6
xor edx, edx
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0042db8f
Function at 0x42e8bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
mov dword [eax + 0x38], ecx
mov dword [esp + 8], 7
mov dword [esp + 4], 0x5cd3c8
mov dword [esp], edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
jne 0x42e9b8
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5ccfc4
mov dword [esp], esi
call fcn.005ae14c
mov edx, eax
mov eax, 0xfffffff4
cmp edx, 2
jne 0x42ea7f
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x1e], eax
mov word [ebp - 0x1a], 0
xor eax, eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x10], eax
lea edx, [ebp - 0x1e]
mov eax, ebx
call fcn.0042e833
test eax, eax
jne 0x42ea7f
mov eax, dword [ebp - 0x28]
lea edx, [eax + 3]
mov eax, ebx
call fcn.0042e7ac
mov edx, dword [ebx + 0x38]
test edx, edx
je 0x42e987
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
xor edi, edi
mov dword [esp + 0x10], edi
mov eax, dword [ebx + 0x24]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov ecx, dword [ebx + 0x34]
mov dword [esp], ecx
call edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebx + 0x5c], ecx
mov dword [ebx + 0x58], ecx
mov dword [ebx + 0x450], ecx
mov dword [ebx + 0x44c], ecx
mov dword [ebx + 0x448], ecx
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0xc], ecx
mov byte [ebx + 0x48], 0
xor esi, esi
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x20], esi
jmp 0x42ea7f
mov edx, 0x5cbff9
mov eax, esi
call fcn.00427968
mov edi, eax
mov eax, 0xfffffff4
test edi, edi
je 0x42ea7f
mov dword [esp], 2
xor edx, edx
xor ecx, ecx
mov eax, edi
call fcn.00425b5e
mov dword [esp], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov dword [ebx + 0x20], eax
mov eax, edi
call fcn.00425b84
xor edx, edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x58], edx
mov dword [ebx + 0x10], edx
mov edx, 0x5cc5e1
mov eax, esi
call fcn.00427968
mov dword [ebx + 0x18], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
lea esi, [ebp - 0x1e]
mov dword [esp], esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp eax, 4
je 0x42ea5c
cmp dword [0x5af030], 1
jbe 0x42ea5c
mov dword [0x611418], 2
xor eax, eax
mov dword [0x611414], eax
mov dword [esp], str._XML__Error_loading_BOM_n
call fcn.004268ea
mov word [ebp - 0x1a], 0
mov edx, esi
mov eax, ebx
call fcn.0042e833
test eax, eax
jne 0x42ea7f
or eax, 0xffffffff
cmp dword [ebx + 0x18], 0
je 0x42ea7f
mov eax, ebx
call fcn.0042fe34
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42eb9e
Capabilities:
Read file on windows

Disassembly:
mov dword [eax + 0x50], edx
test edx, edx
jne 0x42ebb7
cmp dword [eax + 0x18], 0
je 0x42ebb0
jmp fcn.0042fe34
xor edx, edx
jmp fcn.0042db8f
xor eax, eax
ret
Function at 0x42fe34
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1038
call fcn.005a812c
sub esp, eax
mov eax, dword [esp + eax]
mov ebx, eax
mov esi, 1
mov eax, dword [ebx + 0x18]
cmp dword [ebx + 0x50], 0
jne 0x42fed8
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
lea edi, [ebp - 0x101a]
mov dword [esp], edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test eax, eax
jle 0x42fed8
mov byte [ebp + eax - 0x101a], 0
mov byte [ebp + eax - 0x1019], 0
mov edx, edi
mov eax, ebx
call fcn.0042e7ac
mov esi, eax
test eax, eax
jne 0x42fed8
mov eax, dword [ebx + 0x24]
cmp dword [ebx + 0x20], eax
jae 0x42fead
lea edx, [eax + 1]
mov dword [ebx + 0x20], edx
mov edx, dword [ebx + 0x38]
test edx, edx
je 0x42fe51
mov ecx, dword [ebx + 0x20]
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 4], eax
xor edi, edi
mov dword [esp + 8], edi
mov eax, dword [ebx + 0x34]
mov dword [esp], eax
call edx
jmp 0x42fe51
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
test eax, eax
je 0x42ff4b
test esi, esi
jne 0x42fef0
mov esi, 1
mov ecx, dword [ebx + 0x38]
test ecx, ecx
je 0x42ff14
mov eax, dword [ebx + 0x20]
xor edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x34]
mov dword [esp], eax
call ecx
mov eax, dword [ebx + 0x18]
call fcn.00425b84
xor eax, eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x450], eax
mov dword [ebx + 0x44c], eax
mov dword [ebx + 0x448], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], eax
mov byte [ebx + 0x48], 0
xor edx, edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x20], edx
mov eax, esi
add esp, 0x103c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43189d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax]
mov eax, dword [ecx]
test ax, ax
je 0x431993
cmp ax, 1
jne 0x431908
mov eax, dword [esi + 4]
test eax, eax
je 0x431993
mov edi, dword [eax + 8]
xor ebx, ebx
test edi, edi
je 0x431993
cmp ebx, dword [edi + 4]
jae 0x431993
mov edx, ebx
mov eax, edi
call fcn.00425c8e
mov eax, dword [eax + 4]
test eax, eax
je 0x431905
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x431980
inc ebx
jmp 0x4318d9
cmp ax, 0x51
jne 0x431922
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov eax, esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0043169b
cmp ax, 0x268
je 0x43190e
cmp ax, 0x202
ja 0x43193a
mov edx, dword [ebp - 0x1c]
mov eax, ecx
call fcn.0059e010
jmp 0x43194a
cmp ax, 0x403
ja 0x431953
mov edx, dword [ebp - 0x1c]
mov eax, ecx
call fcn.0059b5a5
mov ebx, eax
cmp eax, 0xffffffff
jne 0x431980
jmp 0x431996
or ebx, 0xffffffff
cmp ax, 0x407
jbe 0x431996
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], 1
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00477028
mov ebx, eax
jmp 0x431996
mov ecx, dword [ebp - 0x20]
mov edx, ebx
mov eax, esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004315e4
or ebx, 0xffffffff
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45698d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp edx, 0x35
ja case.default.0x45699b
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, eax
jmp dword [edx*4 + 0x5d6bc4]
mov eax, dword [eax]
jmp 0x4569df
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp case.0x45699b.0
mov eax, dword [eax]
test eax, eax
je case.0x45699b.11
add esp, 0x14
pop ebx
pop ebp
jmp fcn.0043711b
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
call fcn.0059dd9d
jmp case.0x45699b.0
mov eax, dword [eax]
mov edx, dword [ebx + 4]
call fcn.00456922
jmp case.0x45699b.0
mov eax, dword [eax + 4]
test eax, eax
jne 0x4569a9
jmp case.0x45699b.0
mov eax, dword [eax]
mov edx, dword [ebx + 4]
call fcn.00456957
jmp case.0x45699b.0
mov eax, dword [eax + 4]
jmp 0x4569a9
mov eax, dword [eax]
mov edx, dword [ebx + 4]
call fcn.00458420
mov dword [esp], ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x14
pop ebx
pop ebp
ret
ret
Function at 0x483ab5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, eax
mov dword [ebp - 0x1c], edx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
cmp eax, 0x38
je 0x483b5c
mov esi, ecx
cmp eax, 0x1f
ja 0x483ae7
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004823c8
mov eax, dword [ebx + 8]
cmp dword [eax + 0x1c], 0
je 0x483b46
mov ecx, 1
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.004262ac
cmp dword [0x5af03c], 3
jbe 0x483b46
mov dword [0x611418], 4
mov dword [0x611414], 1
mov dword [esp + 0x10], 0x5e2e2f
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], str.usePredictive
mov dword [esp], str._BIFS___s_t_t_d_t_t_d_t_t_s_n
call fcn.004268ea
mov dword [ebp + 8], edi
mov ecx, esi
mov edx, dword [ebp - 0x1c]
mov eax, ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004835e9
mov eax, 0xfffffff6
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x49b412
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov ebx, eax
mov dword [esp + 8], 7
mov dword [esp + 4], 0x5ea636
mov dword [esp], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
jne 0x49b46b
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5ea63e
mov dword [esp], ebx
call fcn.005ae14c
cmp eax, 2
jne 0x49b47d
cmp dword [ebp - 0xc], 8
jbe 0x49b47d
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 4]
bswap ebx
jmp 0x49b4d9
mov edx, 0x5ea64b
mov eax, ebx
call fcn.00427968
mov esi, eax
test eax, eax
jne 0x49b484
xor eax, eax
jmp 0x49b577
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
lea ebx, [ebp - 0xc]
mov dword [esp], ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp eax, 4
je 0x49b4ac
xor ebx, ebx
jmp 0x49b4d2
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp eax, 4
jne 0x49b4a8
mov ebx, dword [ebp - 0xc]
bswap ebx
mov eax, esi
call fcn.00425b84
mov eax, 3
cmp ebx, 0x6d6f6f66
je 0x49b577
ja 0x49b53a
mov eax, 2
cmp ebx, 0x66747970
je 0x49b577
mov eax, 1
ja 0x49b522
cmp ebx, 0x61667261
je 0x49b577
ja 0x49b51a
cmp ebx, 0x564f4944
je 0x49b577
cmp ebx, 0x61627374
jmp 0x49b571
cmp ebx, 0x66726565
jmp 0x49b571
cmp ebx, 0x6d646174
je 0x49b577
cmp ebx, 0x6d657461
je 0x49b577
cmp ebx, 0x6a502020
jmp 0x49b571
mov eax, 3
cmp ebx, 0x73747970
je 0x49b577
ja 0x49b55e
mov eax, 2
cmp ebx, 0x6d6f6f76
je 0x49b577
cmp ebx, 0x736b6970
jmp 0x49b571
mov eax, 1
cmp ebx, 0x75647461
je 0x49b577
cmp ebx, 0x77696465
sete al
movzx eax, al
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
Function at 0x4a96b3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
mov edi, ecx
mov edx, 2
call fcn.004a01a8
mov ebx, eax
test eax, eax
jne 0x4a97dd
mov ecx, edi
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.004a7b16
mov esi, eax
test eax, eax
je 0x4a97c3
mov ecx, edi
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.004a9654
mov ebx, eax
test eax, eax
jne 0x4a97c3
mov eax, 0x786d6c20
call fcn.00497474
mov edi, eax
test eax, eax
je 0x4a97d1
mov eax, dword [esi + 0x14]
mov edx, edi
call fcn.00425c52
cmp dword [ebp + 0xc], 0
je 0x4a9730
mov dword [edi], 0x62786d6c
mov edx, 0x5eb125
mov eax, dword [ebp + 8]
call fcn.00427968
mov esi, eax
test eax, eax
je 0x4a97d8
mov dword [esp], 2
xor edx, edx
xor ecx, ecx
call fcn.00425b5e
mov dword [esp], esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov dword [ebp - 0x1c], eax
xor edx, edx
mov dword [esp], edx
xor edx, edx
xor ecx, ecx
mov eax, esi
call fcn.00425b5e
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [edi + 0x20], eax
mov dword [esp + 0xc], esi
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov dword [ebp - 0x20], eax
mov dword [esp], esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
mov edx, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], edx
jne 0x4a97b3
test eax, eax
je 0x4a97c8
mov eax, dword [edi + 0x20]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor eax, eax
mov dword [edi + 0x20], eax
or ebx, 0xffffffff
jmp 0x4a97dd
mov eax, esi
call fcn.00425b84
jmp 0x4a97dd
mov ebx, 0xfffffffe
jmp 0x4a97dd
mov ebx, 0xfffffff4
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret