joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468b4e
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00468bcd
jae 0x468b5a
xor ecx, ecx
call fcn.00468bcd
jae 0x468b84
xor eax, eax
call fcn.00468bcd
jae 0x468b95
mov al, 0x10
call fcn.00468bcd
adc al, al
jae 0x468b76
jne 0x468bc2
stosb byte es:[edi], al
jmp 0x468b5b
call fcn.00468bd9
dec ecx
loop 0x468ba1
mov eax, ebp
call fcn.00468bd7
jmp 0x468bc3
lodsb al, byte [esi]
shr eax, 1
je 0x468be9
adc ecx, 2
mov ebp, eax
jmp 0x468bc3
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00468bd7
cmp eax, 0x7d00
jae 0x468bc1
cmp eax, 0x500
jae 0x468bc2
cmp eax, 0x7f
ja 0x468bc3
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x468b5b
pop ebp
ret 8
Function at 0xa99340
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x559000]
push edi
or ebp, 0xffffffff
jmp 0xa99362
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa99369
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa99358
mov eax, 1
add ebx, ebx
jne 0xa9937b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa9938c
jne 0xa993ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa993ab
dec eax
add ebx, ebx
jne 0xa99398
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa99370
add ebx, ebx
jne 0xa993a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa993fd
xor ecx, ecx
sub eax, 3
jb 0xa993c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa99432
sar eax, 1
mov ebp, eax
jmp 0xa993ce
add ebx, ebx
jne 0xa993ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9939c
inc ecx
add ebx, ebx
jne 0xa993dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa9939c
add ebx, ebx
jne 0xa993e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa993de
jne 0xa993fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa993de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa9941c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa9940e
jmp 0xa9935e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa9941c
add edi, ecx
jmp 0xa9935e
pop esi
mov edi, esi
mov ecx, 0x1303a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa9943a
cmp byte [edi], 0x24
jne 0xa9943a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa9943f
lea edi, [esi + 0x696000]
mov eax, dword [edi]
or eax, eax
je 0xa994b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x69ad1c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x69ae5c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa9946c
mov ecx, edi
jns 0xa9949b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x69ae60]
or eax, eax
je 0xa994b1
mov dword [ebx], eax
add ebx, 4
jmp 0xa99489
call dword [esi + 0x69ae70]
mov ebp, dword [esi + 0x69ae64]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa994eb
sub esp, 0xffffff80
jmp 0x638ad0
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x405559
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4983c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0044f999
xor eax, eax
push eax
lea ecx, [esi + 0x64]
mov dword [esp + 0x18], eax
mov dword [esi], 0x49f600
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
call fcn.004369e9
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x40aba9
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4988f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, ecx
call fcn.00406de9
mov eax, dword [ebp + 4]
mov ebx, dword [ebp]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], eax
call fcn.00406819
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x34], eax
mov ecx, dword [ebp + 0x18]
mov edi, dword [ecx]
lea esi, [ebp + 0x14]
mov dword [esp + 0x40], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
nop
test esi, esi
mov edx, dword [ebp + 0x18]
lea eax, [ebp + 0x14]
mov dword [esp + 0x28], edx
je 0x40ac1b
cmp esi, eax
je 0x40ac20
call fcn.00476807
cmp edi, dword [esp + 0x28]
je 0x40ac94
test esi, esi
jne 0x40ac2f
call fcn.00476807
cmp edi, dword [esi + 4]
jne 0x40ac39
call fcn.00476807
cmp dword [edi + 0x10], 0
lea eax, [edi + 0x10]
mov dword [esp + 0x18], eax
je 0x40ac7e
cmp edi, dword [esi + 4]
jne 0x40ac50
call fcn.00476807
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
push ecx
push edx
push eax
lea ecx, [esp + 0x38]
call fcn.00447819
push 1
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.00448b99
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
lea ecx, [esp + 0x1c]
call fcn.004065e9
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
jmp 0x40ac09
push 0x4303d0
lea ecx, [esp + 0x30]
call fcn.0040a929
mov ecx, dword [esp + 0x30]
mov edi, dword [ecx]
nop
cmp edi, ecx
je 0x40acfc
mov esi, dword [edi + 8]
test esi, esi
je 0x40aceb
mov eax, dword [esp + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
push 0
push 0x16
push 0x59
push eax
push ebx
mov ecx, esi
call edx
add ebx, 0x64
lea eax, [ebx + 0x59]
cmp eax, dword [ebp + 8]
jle 0x40acdc
mov ebx, dword [ebp]
add dword [esp + 0x14], 0x19
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
push 1
mov ecx, esi
call eax
mov ecx, dword [esp + 0x30]
cmp edi, ecx
jne 0x40acf8
call fcn.00476807
mov ecx, dword [esp + 0x30]
mov edi, dword [edi]
jmp 0x40aca9
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [esp + 0x30]
mov dword [ecx + 4], ecx
mov ecx, dword [esp + 0x30]
cmp eax, ecx
mov dword [esp + 0x34], 0
je 0x40ad2e
mov edi, edi
mov esi, dword [eax]
push eax
call fcn.00475c61
mov ecx, dword [esp + 0x34]
add esp, 4
cmp esi, ecx
mov eax, esi
jne 0x40ad19
push ecx
call fcn.00475c61
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x412c59
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4991d5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], eax
mov byte [esi + 0x20], al
mov dword [esi + 0x50], ecx
mov dword [esi + 0x4c], eax
mov byte [esi + 0x3c], al
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 2
call fcn.00449679
lea ecx, [esi + 0xb0]
mov byte [esp + 0x14], 3
call fcn.00449679
lea ecx, [esi + 0x10c]
mov byte [esp + 0x14], 4
call fcn.00449679
lea ecx, [esi + 0x168]
mov byte [esp + 0x14], 5
call fcn.00449679
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x41b4d9
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499e00
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4c54e8]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push 0x10
mov esi, ecx
xor ebx, ebx
push 0x4a04fc
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00404829
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x5c], ebx
call fcn.0044dd69
add esp, 0xc
cmp dword [esp + 0x24], 0x10
mov byte [esp + 0x50], 2
jb 0x41b560
mov eax, dword [esp + 0x10]
push eax
call fcn.00475c61
add esp, 4
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
jae 0x41b57f
lea eax, [esp + 0x2c]
push eax
lea ecx, [esi + 0x54]
call fcn.004475c9
cmp dword [esp + 0x40], 0x10
mov esi, eax
jb 0x41b59e
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00475c61
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.004761ea
add esp, 0x48
ret
Function at 0x4288f9
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x49ad11
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esi + 0x2c]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x1c], 2
je 0x428956
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x428944
push eax
call fcn.00475c61
add esp, 4
push edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call fcn.00475c61
add esp, 4
cmp dword [esi + 4], 1
mov dword [esi + 0x2c], ebx
jne 0x42896f
mov ecx, dword [esi + 0x14]
call fcn.0041b5c9
mov ecx, dword [esi + 0x14]
call fcn.0041b159
lea eax, [esi + 0x58]
push eax
call dword [fcn.0049f1fc]
mov ecx, dword [esi + 8]
push ecx
call fcn.004761f9
add esp, 4
lea ecx, [esi + 0x44]
mov dword [esi + 8], ebx
call fcn.00429819
lea ecx, [esi + 0x30]
call fcn.00429819
lea ecx, [esi + 0x18]
call fcn.00429819
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x42e409
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret
Function at 0x4367e9
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
push edi
mov esi, ecx
je 0x43684d
mov edi, dword [esp + 0x10]
test edi, edi
je 0x43684d
cmp dword [esi + 0x10], 0xffffffff
je 0x43680d
pop edi
mov eax, 0xfffffffe
pop esi
ret 8
push eax
call fcn.00436239
push edi
mov ecx, esi
call fcn.00436279
lea eax, [esi + 0x88]
push eax
push 0
push esi
push 0x4330c0
push 0
push 0
mov dword [eax], 0
mov byte [esi + 0x84], 1
call fcn.004787a9
add esp, 0x18
mov dword [esi + 0x10], eax
pop edi
xor eax, eax
pop esi
ret 8
pop edi
or eax, 0xffffffff
pop esi
ret 8

Function at 0x436859
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49b78c
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4c54e8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, ecx
lea edx, [eax + 4]
xor ecx, ecx
cmp edx, ecx
je 0x436891
lea esi, [edx - 4]
mov dword [0x4c82d4], esi
jmp 0x436897
mov dword [0x4c82d4], ecx
mov byte [edx], cl
mov dword [eax], 0x4a2654
mov dword [eax + 8], ecx
mov byte [eax + 0xc], cl
mov byte [eax + 0xd], cl
mov dword [eax + 0x10], 0xffffffff
mov dword [eax + 0x14], ecx
mov edx, 0xf
mov dword [eax + 0x30], edx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x1c], cl
mov dword [eax + 0x4c], edx
mov dword [eax + 0x48], ecx
mov byte [eax + 0x38], cl
mov dword [eax + 0x68], edx
mov dword [eax + 0x64], ecx
mov byte [eax + 0x54], cl
mov dword [eax + 0x6c], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
mov dword [eax + 0x78], ecx
mov dword [eax + 0x7c], ecx
mov dword [eax + 0x80], ecx
mov byte [eax + 0x84], cl
mov dword [eax + 0x8c], ecx
mov dword [eax + 0x90], ecx
mov dword [eax + 0x98], ecx
mov dword [eax + 0x9c], ecx
mov dword [eax + 0xa0], ecx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x447019
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x4c54e8]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push eax
push 1
lea eax, [esp + 8]
push 0x10
push eax
call fcn.00478118
add esp, 0x10
cmp eax, 1
je 0x447055
xor eax, eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004761ea
add esp, 0x14
ret 4
push esi
mov eax, 0x10
lea ecx, [esp + 4]
mov edx, 0x4a448c
push edi
lea esp, [esp]
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x447081
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x447069
test eax, eax
je 0x4470de
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4470d0
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4470de
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4470d0
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4470de
movzx esi, byte [edx]
movzx edi, byte [ecx]
sub esi, edi
jne 0x4470d0
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4470de
movzx esi, byte [edx]
movzx ecx, byte [ecx]
sub esi, ecx
je 0x4470de
test esi, esi
mov eax, 1
jg 0x4470e0
or eax, 0xffffffff
jmp 0x4470e0
xor eax, eax
mov ecx, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
pop edi
pop esi
xor ecx, esp
mov eax, edx
call fcn.004761ea
add esp, 0x14
ret 4

Function at 0x447109
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
test eax, eax
push edi
jne 0x44711b
mov dword [esp + 8], eax
jmp 0x447124
mov ecx, dword [esi + 0x38]
sub ecx, eax
mov dword [esp + 8], ecx
mov edi, dword [esp + 0x10]
push edi
push 1
lea edx, [esp + 0x10]
push 4
push edx
call fcn.004775cb
add esp, 0x10
cmp eax, 1
je 0x447147
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
cmp dword [esp + 8], 0
je 0x44717a
mov eax, dword [esi + 0x34]
test eax, eax
je 0x44715c
mov ecx, dword [esi + 0x38]
sub ecx, eax
jne 0x447161
call fcn.00476807
mov edx, dword [esp + 8]
mov esi, dword [esi + 0x34]
push edi
push 1
push edx
push esi
call fcn.004775cb
add esp, 0x10
cmp eax, 1
jne 0x44713f
pop edi
mov eax, 1
pop esi
pop ecx
ret 4
Function at 0x447369
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 0x20]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
jne 0x447383
mov dword [esp + 0x10], ebx
jmp 0x44738f
mov ecx, dword [ebp + 0x24]
sub ecx, eax
sar ecx, 2
mov dword [esp + 0x10], ecx
mov edi, dword [esp + 0x24]
push edi
push 1
lea edx, [esp + 0x18]
push 4
push edx
call fcn.004775cb
add esp, 0x10
cmp dword [esp + 0x10], ebx
jle 0x44748c
mov ecx, dword [ebp + 0x20]
test ecx, ecx
je 0x4473c2
mov eax, dword [ebp + 0x24]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x4473c7
call fcn.00476807
mov eax, dword [ebp + 0x20]
mov esi, dword [eax + ebx*4]
mov eax, dword [esi + 0x44]
test eax, eax
jne 0x4473da
mov dword [esp + 0x20], eax
jmp 0x4473e3
mov ecx, dword [esi + 0x48]
sub ecx, eax
mov dword [esp + 0x20], ecx
mov edx, dword [esi + 0x14]
push edi
push 1
lea eax, [esp + 0x20]
add edx, 1
push 4
push eax
mov dword [esp + 0x28], edx
call fcn.004775cb
add esp, 0x10
cmp eax, 1
jne 0x447423
cmp dword [esi + 0x18], 0x10
jb 0x44740f
mov eax, dword [esi + 4]
jmp 0x447412
lea eax, [esi + 4]
mov ecx, dword [esp + 0x18]
push edi
push 1
push ecx
push eax
call fcn.004775cb
add esp, 0x10
push edi
push 1
lea edx, [esi + 0x38]
push 4
push edx
call fcn.004775cb
push edi
push 1
lea eax, [esi + 0x3c]
push 4
push eax
call fcn.004775cb
push edi
push 1
lea ecx, [esp + 0x48]
push 4
push ecx
call fcn.004775cb
add esp, 0x30
cmp dword [esp + 0x20], 0
je 0x44747f
mov eax, dword [esi + 0x44]
test eax, eax
je 0x447466
mov edx, dword [esi + 0x48]
sub edx, eax
jne 0x44746b
call fcn.00476807
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0x44]
push edi
push 1
push eax
push ecx
call fcn.004775cb
add esp, 0x10
add ebx, 1
cmp ebx, dword [esp + 0x10]
jl 0x4473af
mov eax, dword [ebp + 0x30]
xor ebx, ebx
cmp eax, ebx
jne 0x44749b
mov dword [esp + 0x14], ebx
jmp 0x4474a7
mov edx, dword [ebp + 0x34]
sub edx, eax
sar edx, 2
mov dword [esp + 0x14], edx
push edi
push 1
lea eax, [esp + 0x1c]
push 4
push eax
call fcn.004775cb
add esp, 0x10
cmp dword [esp + 0x14], ebx
jle 0x447530
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x4474d2
mov eax, dword [ebp + 0x34]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x4474d7
call fcn.00476807
mov ecx, dword [ebp + 0x30]
mov esi, dword [ecx + ebx*4]
mov edx, dword [esi + 0x14]
push edi
push 1
lea eax, [esp + 0x20]
add edx, 1
push 4
push eax
mov dword [esp + 0x28], edx
call fcn.004775cb
add esp, 0x10
cmp eax, 1
jne 0x44751d
cmp dword [esi + 0x18], 0x10
jb 0x447509
mov eax, dword [esi + 4]
jmp 0x44750c
lea eax, [esi + 4]
mov ecx, dword [esp + 0x18]
push edi
push 1
push ecx
push eax
call fcn.004775cb
add esp, 0x10
push edi
push esi
call fcn.00447369
add ebx, 1
add esp, 8
cmp ebx, dword [esp + 0x14]
jl 0x4474bf
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4475c9
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
mov eax, dword [0x4c54e8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x1c], 0
push edi
mov edi, dword [esp + 0x30]
jne 0x4475fa
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004761ea
add esp, 0x24
ret 4
push esi
push 0x4a222c
push edi
call fcn.00477def
mov esi, eax
add esp, 8
test esi, esi
je 0x44767c
xor eax, eax
push esi
push 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push 0x20
push eax
call fcn.004775cb
add esp, 0x10
cmp eax, 1
jne 0x447673
push esi
push eax
push 0x10
push 0x4a448c
call fcn.004775cb
add esp, 0x10
cmp eax, 1
jne 0x447673
mov ecx, dword [ebx + 0x1c]
push esi
push ecx
call fcn.00447369
add esp, 8
push esi
mov ecx, ebx
call fcn.00447109
push esi
call fcn.004777cb
add esp, 4
push 0x4a2394
push edi
call fcn.00477def
mov esi, eax
add esp, 8
test esi, esi
je 0x4476c7
push 0
push 0x20
push esi
call fcn.004776d4
lea edx, [esp + 0x18]
push esi
push edx
call fcn.00461139
push 0
push 0
push esi
call fcn.004776d4
push esi
push 1
lea eax, [esp + 0x34]
push 0x20
push eax
call fcn.004775cb
push esi
call fcn.004777cb
add esp, 0x34
mov ecx, dword [esp + 0x2c]
pop esi
pop edi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004761ea
add esp, 0x24
ret 4

Function at 0x447c79
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x4c54e8]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
mov ebp, dword [esp + 0x110]
push edi
mov edi, dword [esp + 0x118]
push edi
push 1
lea eax, [esp + 0x10]
push 4
push eax
call fcn.00478118
add esp, 0x10
cmp eax, 1
je 0x447ccd
pop edi
xor al, al
pop ebp
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004761ea
add esp, 0x108
ret
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jle 0x447d89
cmp esi, 0x100
push ebx
jg 0x447d4c
push 0x100
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.00476209
push edi
push 1
lea edx, [esp + 0x28]
push esi
push edx
call fcn.00478118
add esp, 0x1c
cmp eax, 1
lea eax, [esp + 0x14]
sete bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x447d19
sub eax, edx
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call fcn.00404829
mov al, bl
pop ebx
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004761ea
add esp, 0x108
ret
push esi
call fcn.0046f927
mov esi, eax
add esp, 4
test esi, esi
jne 0x447d5f
xor al, al
jmp 0x447d33
mov ecx, dword [esp + 0x10]
push edi
push 1
push ecx
push esi
call fcn.00478118
add esp, 0x10
cmp eax, 1
push esi
mov ecx, ebp
sete bl
call fcn.00448b19
push esi
call fcn.004761f9
add esp, 4
jmp 0x447d31
push 0
mov ecx, ebp
push 0x49f6da
jne 0x447db3
call fcn.00404829
pop esi
pop edi
mov al, 1
pop ebp
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004761ea
add esp, 0x108
ret
call fcn.00404829
mov ecx, dword [esp + 0x110]
pop esi
pop edi
pop ebp
xor ecx, esp
xor al, al
call fcn.004761ea
add esp, 0x108
ret
Function at 0x4496e9
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
push 1
lea eax, [esp + 0x18]
push 4
push eax
mov esi, ecx
call fcn.00478118
add esp, 0x10
cmp eax, 1
je 0x449711
pop edi
xor eax, eax
pop esi
pop ecx
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x449764
cmp eax, 0x100000
ja 0x449709
push 0
add esi, 0x30
push eax
mov ecx, esi
call fcn.00466a69
mov eax, dword [esi + 4]
test eax, eax
je 0x44973b
mov ecx, dword [esi + 8]
sub ecx, eax
jne 0x449740
call fcn.00476807
mov edx, dword [esp + 0x10]
mov esi, dword [esi + 4]
push edi
push 1
push edx
push esi
call fcn.00478118
add esp, 0x10
sub eax, 1
neg eax
sbb eax, eax
pop edi
add eax, 1
pop esi
pop ecx
ret 4
pop edi
mov eax, 1
pop esi
pop ecx
ret 4