joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d510
Capabilities:
Create thread
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x54bea1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x30]
lea eax, [ebx + 0x30]
push eax
call fcn.0041da00
lea ecx, [ebx + 0x4c]
xor ebp, ebp
push ecx
mov dword [esp + 0x2c], ebp
call fcn.0041db30
lea esi, [ebx + 0x68]
push esi
mov byte [esp + 0x2c], 1
call fcn.00409850
mov byte [esp + 0x28], 2
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ebx
call edi
lea edx, [ebx + 0x18]
push edx
call edi
push ebx
push ebp
push 0x41cdb0
call fcn.005238d5
add esp, 0xc
push ebx
push ebp
push 0x41d770
call fcn.005238d5
mov eax, dword [esp + 0x40]
add esp, 0xc
mov dword [esp + 0x14], ebp
cmp dword [eax], ebp
je 0x41d5ff
mov ebp, eax
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x41d5ac
xor eax, eax
jmp 0x41d5b4
mov eax, dword [esi + 0x14]
sub eax, ecx
sar eax, 2
mov edi, dword [esi + 0x10]
mov edx, edi
sub edx, ecx
sar edx, 2
cmp edx, eax
jae 0x41d5cf
mov eax, dword [ebp]
mov dword [edi], eax
add edi, 4
mov dword [esi + 0x10], edi
jmp 0x41d5e9
cmp ecx, edi
jbe 0x41d5d8
call fcn.005234a2
mov eax, dword [esi]
push edi
push eax
push ebp
lea ecx, [esp + 0x24]
push ecx
mov eax, esi
call fcn.0041dca0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x34]
inc eax
cmp dword [edx + eax*4], 0
lea ebp, [edx + eax*4]
mov dword [esp + 0x14], eax
jne 0x41d5a1
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x41fea0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call fcn.00527d41
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
test bl, bl
je 0x420019
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push eax
push 0x18
push ecx
mov ecx, esp
jb 0x41fef3
mov eax, dword [esi + 0x40]
jmp 0x41fef6
lea eax, [esi + 0x40]
mov dword [ecx], eax
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x2c], eax
call fcn.0041e4c0
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
add esp, 0x18
xor ebp, ebp
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
test ebx, ebx
je 0x41ffb4
xor edx, edx
dec ebx
cmp byte [esp + 0x13], dl
je 0x41ff38
cmp byte [edi], dl
jmp 0x41ff3c
cmp word [edi], 0
sete dl
test edx, edx
je 0x41ff66
test eax, eax
je 0x41ff5f
cmp edi, eax
je 0x41ff5f
imul ecx, ebp
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.00529300
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
inc ebp
add edi, ecx
test ebx, ebx
jne 0x41ff2b
test eax, eax
je 0x41ff89
cmp edi, eax
je 0x41ff89
mov ecx, dword [esi + 0x18]
imul ecx, ebp
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.00529300
add esp, 0xc
test ebp, ebp
je 0x41ffb4
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebp
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.0041e4c0
add esp, 0x18
sub dword [esi + 0x1c], ebp
cmp dword [esi + 0x18], 1
jle 0x42000b
test byte [esi + 4], 0x80
je 0x42000b
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x41ffe6
jmp 0x41ffd0
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx + esi*2 - 2]
dec esi
rol ax, 8
mov word [ecx + esi*2], ax
test esi, esi
jne 0x41ffd0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
mov eax, dword [esp + 0x28]
push eax
call fcn.0041e4c0
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push esi
call fcn.0041f8e0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 4
Function at 0x420520
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
imul ecx, eax
push edi
mov dword [esi + 8], ecx
test ebp, ebp
jne 0x42053c
mov ebp, edx
mov ecx, dword [esi + 4]
xor edi, edi
test cl, cl
jns 0x4205b6
test edx, edx
jne 0x420575
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004508c5
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebp
push edi
call fcn.00523990
add esp, 0x10
mov edx, edi
mov ebp, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x420592
lea esp, [esp]
movzx ecx, word [edx + eax*2 - 2]
dec eax
rol cx, 8
mov word [edx + eax*2], cx
test eax, eax
jne 0x420580
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
lea ecx, [esi + 0x20]
push ecx
mov dword [eax], str.endian_swap
call fcn.0041e4c0
add esp, 0x18
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push 1
push eax
push ebp
call fcn.005286c4
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x4205db
push edi
call fcn.004508d0
add esp, 4
test bl, bl
je 0x42061e
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 8]
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push edx
push 0x18
push ecx
mov ecx, esp
jb 0x4205fb
mov eax, dword [esi + 0x40]
jmp 0x4205fe
lea eax, [esi + 0x40]
push ecx
mov dword [ecx], eax
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.0041e4c0
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 4
push esi
call fcn.0041f8e0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 4
Function at 0x4218d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x549839
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x18], esi
lea edi, [ebp + 4]
xor eax, eax
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], esi
mov dword [esp + 0x1c], ebp
mov word [edi], ax
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], 1
mov ebx, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x421930
sub eax, edx
mov esi, dword [ebp + 0x14]
sar eax, 1
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [ecx + eax + 7]
cmp esi, eax
ja 0x421981
cmp dword [ebp + 0x18], eax
je 0x421981
push 1
push eax
mov ecx, ebp
call fcn.0040cdf0
test al, al
je 0x421981
cmp dword [ebp + 0x18], 8
mov dword [ebp + 0x14], esi
jb 0x42197b
mov edi, dword [edi]
xor ecx, ecx
mov word [edi + esi*2], cx
movzx eax, word [ebx]
test ax, ax
je 0x421a9b
mov esi, dword [esp + 0x38]
and esi, 0x100
mov dword [esp + 0x14], esi
test esi, esi
je 0x4219b8
lea edx, [eax - 0x22]
cmp dx, 0x1c
ja 0x421a81
movzx ecx, ax
movsx edi, byte [ecx + 0x58defe]
jmp 0x4219cf
lea edx, [eax - 0x26]
cmp dx, 0x18
ja 0x421a81
movzx ecx, ax
movsx edi, byte [ecx + 0x58df1a]
test edi, edi
je 0x421a81
test byte [esp + 0x38], 8
je 0x421a57
cmp ax, 0x26
jne 0x421a57
movzx eax, word [ebx + 2]
lea esi, [ebx + 2]
lea edx, [eax - 0x23]
cmp dx, 0x57
ja 0x421a02
movzx ecx, ax
movsx ecx, byte [ecx + 0x58df3d]
test ecx, ecx
jne 0x421a08
cmp ax, 0x7f
jbe 0x421a57
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
je 0x421a3f
lea edx, [eax - 0x2d]
cmp dx, 0x4d
ja 0x421a2c
movzx ecx, ax
movsx ecx, byte [ecx + 0x58df93]
test ecx, ecx
jne 0x421a32
cmp ax, 0x7f
jbe 0x421a57
movzx eax, word [esi + 2]
add esi, 2
cmp ax, 0x3b
jne 0x421a15
mov eax, esi
sub eax, ebx
sar eax, 1
inc eax
push eax
push ebx
mov ecx, ebp
call fcn.0040cb10
mov ebx, esi
mov esi, dword [esp + 0x14]
jmp 0x421a8b
mov edx, dword [edi*4 + 0x5b1b24]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421a63
sub eax, esi
sar eax, 1
push eax
push edx
mov ecx, ebp
call fcn.0040cb10
mov esi, dword [esp + 0x14]
jmp 0x421a8b
push 1
push ebx
mov ecx, ebp
call fcn.0040cb10
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x42199b
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x424540
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 0xc]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x424576
mov eax, dword [esp + 0x10]
test eax, eax
je 0x424571
mov edx, dword [esp + 0xc]
mov dword [eax], edx
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42458a
and eax, 0xffff
or eax, 0x80070000
ret 0x10

Function at 0x4245f0
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 8]
sub esp, 8
lea eax, [esp]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x424621
mov eax, dword [esp + 0x10]
mov ecx, dword [esp]
mov edx, dword [esp + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
add esp, 8
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x424635
and eax, 0xffff
or eax, 0x80070000
add esp, 8
ret 8

Function at 0x424d10
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424da8
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x424da1
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ecx, esi
add ecx, ebp
mov eax, edi
adc eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x14]
ja 0x424da1
jb 0x424d6b
cmp ecx, dword [esp + 0x10]
ja 0x424da1
push 0
push 0
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x424da1
push 0x28
call fcn.00450896
add esp, 4
test eax, eax
je 0x424da8
mov edx, dword [esp + 0x2c]
push edx
push ebp
push edi
push esi
mov edx, ebx
call fcn.00424cc0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x424dc0
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0x24]
mov ebp, dword [esi + 0x20]
mov eax, dword [esi + 0x10]
push edi
mov edi, dword [esi + 0x14]
cmp edx, edi
jb 0x424df3
ja 0x424ddd
cmp ebp, eax
jb 0x424df3
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x424deb
mov dword [eax], 0
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
push ebx
mov ebx, dword [esp + 0x1c]
xor eax, eax
mov ecx, ebx
add ecx, ebp
adc eax, edx
cmp eax, edi
jb 0x424e10
ja 0x424e0b
cmp ecx, dword [esi + 0x10]
jbe 0x424e10
mov ebx, dword [esi + 0x10]
sub ebx, ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0xc]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop ebx
test eax, eax
je 0x424e49
mov eax, dword [esp + 0x10]
add dword [esi + 0x20], eax
mov ecx, dword [esp + 0x1c]
adc dword [esi + 0x24], 0
test ecx, ecx
je 0x424e41
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x424e5d
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x4251f0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ecx], eax
xor edx, edx
lea ebx, [edi + 0x21c]
mov word [ebx], dx
mov dword [edi + 0x430], 0xffffffff
mov dword [edi + 0x428], eax
mov dword [edi + 0x424], eax
mov byte [edi + 0x42c], al
cmp dword [ebp + 0x14], eax
jne 0x4252f4
mov esi, dword [ebp + 0xc]
push esi
mov eax, edi
call fcn.00425480
test eax, eax
jne 0x4253b5
cmp word [ebx], ax
je 0x4252f4
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425255
mov ecx, dword [edi + 0x218]
sub eax, edx
sar eax, 1
inc eax
lea edx, [ecx + eax]
cmp edx, 0x104
jg 0x4253b0
push eax
lea eax, [edi + ecx*2 + 0x10]
push ebx
push eax
call fcn.005234b2
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea ebx, [edi + 0x434]
push ebx
push 0x104
lea edx, [edi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x4253b0
cmp eax, 0x104
ja 0x4253b0
push esi
call fcn.004255f0
test eax, eax
jne 0x4253b5
push esi
call fcn.00425550
test eax, eax
jne 0x4253b5
push esi
mov esi, edi
call fcn.00425690
test eax, eax
jne 0x4253b5
cmp byte [edi + 0x42c], al
je 0x4252ff
push eax
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0xc], 0
je 0x4253b0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x425332
test al, 0x10
jne 0x42534e
test al, 1
je 0x425329
and eax, 0xfffffffe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42534e
mov eax, dword [esp + 0xc]
movzx esi, word [eax]
xor ecx, ecx
push ecx
push ebx
push ecx
mov word [eax], cx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, dword [esp + 0xc]
mov word [edx], si
mov eax, ebx
call fcn.004257d0
mov esi, eax
test esi, esi
jne 0x425378
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4253b5
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [edi + 0x63c]
test eax, eax
je 0x42539a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x63c], esi
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4253d0
Capabilities:
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp word [esi + 0x21c], 0
je 0x425472
cmp dword [esp + 0xc], 0
je 0x42540c
mov eax, dword [esi + 0x63c]
test eax, eax
je 0x425472
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x63c], 0
xor eax, eax
pop esi
ret 8
cmp dword [esi + 0x424], 0
lea ecx, [esi + 0x424]
jne 0x425424
cmp dword [esi + 0x428], 0
je 0x42543d
mov eax, dword [esi + 0x63c]
test eax, eax
je 0x42543d
mov eax, dword [eax + 8]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [esi + 0x63c]
test eax, eax
je 0x425459
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x63c], 0
mov eax, dword [esi + 0x430]
cmp eax, 0xffffffff
je 0x425472
push eax
add esi, 0x434
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop esi
ret 8

Function at 0x425820
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x425856
mov eax, dword [esp + 0x10]
test eax, eax
je 0x425851
mov edx, dword [esp + 0xc]
mov dword [eax], edx
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42586a
and eax, 0xffff
or eax, 0x80070000
ret 0x10

Function at 0x42f730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54d313
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], edi
call fcn.00450896
add esp, 4
cmp eax, edi
je 0x42f793
mov dword [eax], edi
jmp 0x42f795
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.00450896
add esp, 4
cmp eax, edi
je 0x42f7b0
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x42f7b2
xor eax, eax
push edi
mov ecx, esi
mov dword [esi + 0x64], eax
mov dword [esi + 0x58], edi
call fcn.00443be0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x440e30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54d313
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5af640]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, 7
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov word [esi + 4], cx
mov dword [esp + 0x14], edi
xor edx, edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov word [esi + 0x20], dx
mov byte [esp + 0x14], 1
push 4
mov dword [esi + 0x5c], edi
call fcn.00450896
add esp, 4
cmp eax, edi
je 0x440e93
mov dword [eax], edi
jmp 0x440e95
xor eax, eax
push 0xc
mov dword [esi + 0x60], eax
call fcn.00450896
add esp, 4
cmp eax, edi
je 0x440eb0
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax], edi
jmp 0x440eb2
xor eax, eax
mov dword [esi + 0x64], eax
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
mov dword [esi + 0x58], edi
call fcn.00443be0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x4424f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
push edi
call fcn.00527d41
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
mov byte [esp + 0x12], bl
mov dword [esi + 0x1c], eax
test bl, bl
je 0x442669
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push eax
push 0x18
push ecx
mov ecx, esp
jb 0x442543
mov eax, dword [esi + 0x40]
jmp 0x442546
lea eax, [esi + 0x40]
mov dword [ecx], eax
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x2c], eax
call fcn.00440f30
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
add esp, 0x18
xor ebp, ebp
xor eax, eax
cmp ecx, 1
sete byte [esp + 0x13]
test ebx, ebx
je 0x442604
xor edx, edx
dec ebx
cmp byte [esp + 0x13], dl
je 0x442588
cmp byte [edi], dl
jmp 0x44258c
cmp word [edi], 0
sete dl
test edx, edx
je 0x4425b6
test eax, eax
je 0x4425af
cmp edi, eax
je 0x4425af
imul ecx, ebp
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.00529300
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
inc ebp
add edi, ecx
test ebx, ebx
jne 0x44257b
test eax, eax
je 0x4425d9
cmp edi, eax
je 0x4425d9
mov ecx, dword [esi + 0x18]
imul ecx, ebp
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.00529300
add esp, 0xc
test ebp, ebp
je 0x442604
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebp
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.00440f30
add esp, 0x18
sub dword [esi + 0x1c], ebp
cmp dword [esi + 0x18], 1
jle 0x44265b
test byte [esi + 4], 0x80
je 0x44265b
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x442636
jmp 0x442620
mov ecx, dword [esp + 0x1c]
movzx eax, word [ecx + esi*2 - 2]
dec esi
rol ax, 8
mov word [ecx + esi*2], ax
test esi, esi
jne 0x442620
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
mov eax, dword [esp + 0x28]
push eax
call fcn.00440f30
add esp, 0x18
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push esi
call fcn.00441ee0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 4
Function at 0x442b70
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
imul ecx, eax
push edi
mov dword [esi + 8], ecx
test ebp, ebp
jne 0x442b8c
mov ebp, edx
mov ecx, dword [esi + 4]
xor edi, edi
test cl, cl
jns 0x442c06
test edx, edx
jne 0x442bc5
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004508c5
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebp
push edi
call fcn.00523990
add esp, 0x10
mov edx, edi
mov ebp, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x442be2
lea esp, [esp]
movzx ecx, word [edx + eax*2 - 2]
dec eax
rol cx, 8
mov word [edx + eax*2], cx
test eax, eax
jne 0x442bd0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
lea ecx, [esi + 0x20]
push ecx
mov dword [eax], str.endian_swap
call fcn.00440f30
add esp, 0x18
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push 1
push eax
push ebp
call fcn.005286c4
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x442c2b
push edi
call fcn.004508d0
add esp, 4
test bl, bl
je 0x442c6e
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 8]
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push edx
push 0x18
push ecx
mov ecx, esp
jb 0x442c4b
mov eax, dword [esi + 0x40]
jmp 0x442c4e
lea eax, [esi + 0x40]
push ecx
mov dword [ecx], eax
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.00440f30
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 4
push esi
call fcn.00441ee0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 4