joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4080c0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x14
test edx, edx
je 0x4080d7
mov dword [esp], edx
call sym._strlen
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
call sym._fwrite
mov dword [esp], esi
call sym._fflush
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40d120
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x10
mov eax, dword [0x5190ac]
test eax, eax
je 0x40d1a0
test ecx, ecx
je 0x40d180
mov dword [esp], ecx
call sym._strlen
mov ecx, ebx
mov edx, eax
call sym._toNimStr_8
mov dword [esp], eax
mov ebx, edx
mov dword [esp + 4], edx
call dword [0x5190ac]
sub esp, 8
test ebx, ebx
je 0x40d164
test dword [ebx], 0x40000000
je 0x40d1e0
mov dword [esp], 0x4db1c8
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x40d200
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0
mov dword [esp + 4], 0
call eax
sub esp, 8
jmp 0x40d164
mov esi, edx
mov dword [esp], 2
call dword [0x4db598]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov edi, eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
call sym._fwrite
mov dword [esp], edi
call sym._fflush
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], 0x4db1d8
call sym.___emutls_get_address
mov edx, ebx
mov ecx, eax
call sym._rawDealloc__system_u6963_8
jmp 0x40d164
mov byte [eax], 0
mov dword [esp], 0x4db168
call sym.___emutls_get_address
mov ecx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
mov dword [esp], 0
call sym._eqcopy___stdZtypedthreads_u169_12
sub esp, 4
jmp 0x40d179

Function at 0x40e030
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
test eax, eax
jle 0x40e080
lea ebx, [eax + edx + 4]
lea ecx, [edx + 4]
xor eax, eax
lea esi, [esi]
lea esi, [esi]
movzx edx, byte [ecx]
add ecx, 1
add edx, eax
mov eax, edx
shl eax, 0xa
add eax, edx
mov edx, eax
shr edx, 6
xor eax, edx
cmp ebx, ecx
jne 0x40e050
lea eax, [eax + eax*8]
pop ebx
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 0xf
add eax, edx
ret 8
xor eax, eax
pop ebx
ret 8
Function at 0x410310
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [0x5190ac]
test eax, eax
je 0x410360
mov ecx, 0x4dcb44
mov edx, 0x1d
call sym._toNimStr_8
mov dword [esp], eax
mov ebx, edx
mov dword [esp + 4], edx
call dword [0x5190ac]
sub esp, 8
test ebx, ebx
je 0x41034a
test dword [ebx], 0x40000000
je 0x4103a0
mov dword [esp], 0x4db1c8
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x4103c0
add esp, 0x18
pop ebx
ret
mov dword [esp], 2
call dword [0x4db598]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov ebx, eax
mov dword [esp + 4], 1
mov dword [esp], 0x4dcb44
call sym._fwrite
mov dword [esp], ebx
call sym._fflush
add esp, 0x18
pop ebx
ret
mov dword [esp], 0x4db1d8
call sym.___emutls_get_address
mov edx, ebx
mov ecx, eax
call sym._rawDealloc__system_u6963_8
jmp 0x41034a
mov byte [eax], 0
mov dword [esp], 0x4db168
call sym.___emutls_get_address
mov ecx, eax
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
mov dword [esp], 0
call sym._eqcopy___stdZtypedthreads_u169_12
sub esp, 4
jmp 0x41035b

Function at 0x411fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov dword [esp + 0x1c], edx
mov dword [esp], 0x519090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
test edi, edi
jle 0x412040
mov dword [esp], 0x4db1c8
xor esi, esi
call sym.___emutls_get_address
mov ebp, dword [sym.___acrt_iob_func]
mov edi, eax
jmp 0x41200c
add esi, 1
add ebx, 8
cmp dword [esp + 0x1c], esi
je 0x412046
mov dword [esp], 1
call ebp
mov dword [esp + 8], 0
mov edx, dword [ebx + 4]
mov ecx, eax
mov eax, dword [ebx]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._writeWindows__system_u8932_16
sub esp, 0xc
cmp byte [edi], 0
je 0x412000
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.___acrt_iob_func]
mov dword [esp], 1
call ebp
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4dc4fd
call sym._fwrite
mov dword [esp], 1
call ebp
mov dword [esp], eax
call sym._fflush
mov dword [esp], 0x519090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4274a0
Capabilities:
Execute command

Disassembly:
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
add eax, 4
test edx, edx
mov edx, 0x4ded00
cmove eax, edx
mov dword [esp], eax
call sym._system
add esp, 0x1c
ret 8

Function at 0x428a90
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
lea ebp, [edx + 3]
push edi
mov edi, ecx
push esi
push ebx
mov ebx, edx
sub esp, 0x2c
test edx, edx
cmovns ebp, edx
and ebp, 0xfffffffc
jle 0x428c38
test edx, edx
jle 0x428aff
mov edx, dword [ecx]
mov dword [esp], 0x4db1c8
mov dword [esp + 0x18], edx
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x428b20
xor esi, esi
mov eax, 4
mov ecx, esi
mov esi, dword [esp + 0x18]
imul esi, esi, 0xcc9e2d51
rol esi, 0xf
imul esi, esi, 0x1b873593
xor esi, ecx
rol esi, 0xd
lea ecx, [esi + esi*4 - 0x19ab949c]
cmp ebp, eax
jle 0x428b28
cmp ebx, eax
jle 0x428b01
mov esi, dword [edi + eax]
add eax, 4
jmp 0x428ad4
xor eax, eax
sub ebx, 1
mov dword [esp], eax
mov dword [esp + 4], ebx
call sym._raiseIndexError2
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x428b12
mov esi, ecx
mov ecx, ebx
and ecx, 3
je 0x428c5a
sub ecx, 1
mov edx, eax
xor ebp, ebp
add edx, ecx
js 0x428c76
cmp edx, ecx
jb 0x428c76
test ebp, ebp
jne 0x428c2c
cmp ebx, edx
jle 0x428c16
test edx, edx
js 0x428c16
movzx ebp, byte [edi + edx]
test ecx, ecx
je 0x428bc4
lea edx, [ecx - 1]
mov dword [esp + 0x18], 0
mov ecx, edx
mov dword [esp + 0x1c], edx
add ecx, eax
js 0x428c80
cmp ecx, edx
jb 0x428c80
cmp dword [esp + 0x18], 0
mov edx, ecx
jne 0x428c2c
cmp ecx, ebx
jge 0x428c16
test ecx, ecx
js 0x428c16
movzx edx, byte [edi + ecx]
shl ebp, 8
or ebp, edx
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x428bc4
test eax, eax
js 0x428c14
cmp ebx, eax
jle 0x428c14
movzx eax, byte [edi + eax]
shl ebp, 8
or ebp, eax
mov dword [esp], 0x4db1c8
imul ebp, ebp, 0xcc9e2d51
call sym.___emutls_get_address
rol ebp, 0xf
movzx eax, byte [eax]
test al, al
jne 0x428b20
imul ebp, ebp, 0x1b873593
xor esi, ebx
xor esi, ebp
mov eax, esi
shr eax, 0x10
xor eax, esi
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
jmp 0x428b12
mov edx, eax
sub ebx, 1
mov dword [esp], edx
mov dword [esp + 4], ebx
call sym._raiseIndexError2
xor eax, eax
jmp 0x428b12
call sym._raiseOverflow
xor eax, eax
jmp 0x428b12
mov eax, edx
sar eax, 0x1f
shr eax, 0x1e
lea ecx, [edx + eax]
and ecx, 3
sub ecx, eax
test ecx, ecx
jle 0x428c5e
sub ecx, 1
xor eax, eax
xor esi, esi
mov edx, ecx
jmp 0x428b54
xor ebp, ebp
jmp 0x428be4
mov dword [esp], 0x4db1c8
xor ebp, ebp
xor esi, esi
call sym.___emutls_get_address
movzx eax, byte [eax]
jmp 0x428bdc
mov ebp, 1
jmp 0x428b4c
mov dword [esp + 0x18], 1
jmp 0x428b8d
Function at 0x429c60
Capabilities:
Read file on windows

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x30]
test ecx, ecx
je 0x429c81
mov ebx, dword [ecx]
cmp word [ebx + 0xa], 1
jle 0x429cd0
mov ebx, dword [ebx + 0xc]
cmp dword [ebx + 8], 0x73aa4c00
jne 0x429cd0
test eax, eax
js 0x429c98
mov ecx, dword [ecx + 0x2c]
mov dword [esp + 0x30], eax
add esp, 0x28
pop ebx
jmp sym._readBuffer__stdZsyncio_u165_12
mov dword [esp], eax
sar eax, 0x1f
mov dword [esp + 4], eax
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call sym._raiseRangeErrorI
add esp, 0x28
xor eax, eax
pop ebx
ret 4
call sym._raiseObjectConversionError
add esp, 0x28
xor eax, eax
pop ebx
ret 4
Function at 0x441410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, edx
xor edx, edx
mov ecx, ebx
sub esp, 0x3c
movzx eax, word [esp + 0x50]
mov word [esp + 0x1e], ax
call sym._eqeq___pureZjson_u2463_8
mov dword [esp], 0x4db1c8
mov esi, eax
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x4414dc
mov ebp, eax
mov eax, esi
test al, al
jne 0x441470
movzx eax, word [esp + 0x1e]
mov edx, ebx
mov ecx, edi
mov word [esp + 0x50], ax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp sym._fromJsonHook__lockfiles_u2482_12
mov dword [esp + 0x24], 0x34
mov dword [esp + 0x28], 0x4e0540
mov dword [esp + 0x2c], ebx
mov dword [esp], 0x34
mov dword [esp + 4], 0x4e0540
mov dword [esp + 8], ebx
call sym._dollar___stdZjsonutils_u449_12
sub esp, 0xc
cmp byte [ebp], 0
mov esi, edx
jne 0x441500
mov dword [esp + 8], eax
mov eax, dword [0x4e05ac]
mov dword [esp + 0xc], edx
mov edx, dword [0x4e05b0]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._raiseJsonException__stdZjsonutils_u201
test esi, esi
je 0x4414d2
test dword [esi], 0x40000000
je 0x4414f0
cmp byte [ebp], 0
je 0x44144d
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp], esi
call sym._deallocShared
jmp 0x4414d2
test edx, edx
jne 0x4414ca
jmp 0x4414dc
Function at 0x456930
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
movzx eax, byte [ecx + 4]
mov ebp, dword [esp + 0x40]
cmp al, 2
je 0x456a08
ja 0x4569b0
xor esi, esi
test al, al
je 0x4569a3
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
mov ecx, eax
sub ecx, edx
jo 0x456a9b
cmp ecx, ebp
mov esi, ebp
cmovle esi, ecx
test esi, esi
jle 0x4569a3
cmp eax, edx
jle 0x456a70
test edx, edx
js 0x456a70
mov eax, dword [ebx + 0x10]
mov dword [esp + 8], esi
mov dword [esp], edi
lea eax, [eax + edx + 4]
mov dword [esp + 4], eax
call sym._memcpy
mov eax, esi
add eax, dword [ebx + 0x14]
jo 0x456a9b
mov dword [ebx + 0x14], eax
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [ecx + 0x28]
mov ecx, dword [ecx + 0x2c]
test eax, eax
je 0x456a20
test ecx, ecx
je 0x456a30
call eax
mov dword [esp], 0x4db1c8
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x456aa8
mov eax, dword [ebx + 0x24]
mov esi, dword [ebx + 0x20]
test eax, eax
je 0x456a88
mov dword [esp], ebp
mov edx, edi
mov ecx, ebx
mov dword [esp + 4], eax
call esi
sub esp, 8
mov esi, eax
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
test ebp, ebp
js 0x456a38
mov ecx, dword [ecx + 8]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp sym._readBuffer__stdZsyncio_u165_12
test ecx, ecx
jne 0x4569be
jmp 0x4569d5
call eax
jmp 0x4569c0
mov dword [esp], ebp
sar ebp, 0x1f
xor esi, esi
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], ebp
call sym._raiseRangeErrorI
jmp 0x4569a3
sub eax, 1
mov dword [esp], edx
mov dword [esp + 4], eax
call sym._raiseIndexError2
jmp 0x4569a3
mov dword [esp + 0x40], ebp
add esp, 0x2c
mov edx, edi
mov ecx, ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
jmp eax
call sym._raiseOverflow
jmp 0x4569a3
xor esi, esi
jmp 0x4569a3
Function at 0x457c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
sub eax, dword [ecx + 0x24]
jo 0x457d3e
mov ebx, ecx
mov ebp, edx
mov edx, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x2c]
mov dword [esp], eax
call sym._newLineInfo__OOZOOZOOZcompilerZmsgs_u397_12
sub esp, 4
mov esi, eax
mov edi, edx
mov dword [esp], 0x4db1c8
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x457c94
mov eax, ebp
mov ecx, dword [ebx + 0x48]
movzx ebp, al
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x4c], ecx
test eax, eax
je 0x457ca0
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x457d10
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 8], ebp
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], edx
mov dword [esp], esi
mov dword [esp + 4], edi
call eax
sub esp, 0x18
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [0x4e7db0]
mov edx, dword [esp + 0x78]
mov dword [esp + 0xc], ebp
mov dword [esp + 4], esi
mov dword [esp + 0x1c], eax
mov eax, dword [0x4e7db4]
mov dword [esp + 8], edi
mov dword [esp + 0x20], eax
mov eax, dword [0x4e7db8]
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], eax
mov eax, dword [0x4e7dbc]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sym._liMessage__OOZOOZOOZcompilerZmsgs_u1201
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov ecx, dword [esp + 0x74]
mov ebx, dword [esp + 0x78]
mov dword [esp + 8], ebp
mov dword [esp], esi
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 4], edi
call eax
sub esp, 0x14
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
call sym._raiseOverflow
jmp 0x457c94
Function at 0x45d570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, edx
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x5c
mov ecx, dword [ecx + 0x2c]
mov eax, dword [esp + 0x70]
mov edx, dword [eax + 0x28]
mov eax, dword [eax + 0x2c]
mov dword [esp], eax
call sym._newLineInfo__OOZOOZOOZcompilerZmsgs_u397_12
sub esp, 4
mov esi, eax
mov edi, edx
mov dword [esp], 0x4db1c8
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x45d5ea
mov eax, ebp
mov ecx, dword [ebx + 0x48]
movzx ebp, al
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x4c], ecx
test eax, eax
je 0x45d630
mov edx, dword [ebx + 0x40]
test edx, edx
je 0x45d5f8
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 8], ebp
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0xc], edx
mov dword [esp], esi
mov dword [esp + 4], edi
call eax
sub esp, 0x18
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov ecx, dword [esp + 0x74]
mov ebx, dword [esp + 0x78]
mov dword [esp + 8], ebp
mov dword [esp], esi
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 4], edi
call eax
sub esp, 0x14
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [0x4e7db0]
mov edx, dword [esp + 0x78]
mov dword [esp + 0xc], ebp
mov dword [esp + 4], esi
mov dword [esp + 0x1c], eax
mov eax, dword [0x4e7db4]
mov dword [esp + 8], edi
mov dword [esp + 0x20], eax
mov eax, dword [0x4e7db8]
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], eax
mov eax, dword [0x4e7dbc]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call sym._liMessage__OOZOOZOOZcompilerZmsgs_u1201
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x48d110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x44], 0
mov ebp, dword [esp + 0x78]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
call sym._eqcopy___stdZassertions_u30_12
sub esp, 8
mov eax, dword [esp + 0x7c]
test eax, eax
jle 0x48d260
xor edi, edi
jmp 0x48d182
cmp edi, dword [esp + 0x7c]
jge 0x48d260
mov edx, 1
lea ecx, [esp + 0x3c]
call sym._prepareAdd_8
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov byte [edx + eax + 4], 0x20
add eax, 1
jo 0x48d33a
mov edx, dword [esp + 0x40]
mov dword [esp + 0x3c], eax
mov byte [edx + eax + 4], 0
mov eax, dword [ebp + edi*8]
mov edx, dword [ebp + edi*8 + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._nospquoteShell_8
sub esp, 8
mov ebx, eax
mov esi, edx
mov dword [esp], 0x4db1c8
call sym.___emutls_get_address
cmp byte [eax], 0
jne 0x48d2b1
mov edx, ebx
lea ecx, [esp + 0x3c]
call sym._prepareAdd_8
test ebx, ebx
jle 0x48d232
mov eax, ebx
add eax, 1
jo 0x48d2e5
test eax, eax
js 0x48d2f0
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], eax
lea edx, [ecx + edx + 4]
lea ecx, [esi + 4]
mov dword [esp + 4], ecx
mov dword [esp], edx
call sym._memcpy
add ebx, dword [esp + 0x3c]
jo 0x48d2e5
mov dword [esp + 0x3c], ebx
add edi, 1
test esi, esi
je 0x48d178
test dword [esi], 0x40000000
jne 0x48d178
mov dword [esp], esi
call sym._deallocShared
cmp edi, dword [esp + 0x7c]
jl 0x48d182
lea esi, [esi]
nop
mov eax, dword [0x4ebd04]
mov edx, dword [0x4ebd08]
lea ecx, [esp + 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xa
mov dword [esp + 0x18], eax
mov eax, dword [0x4ebd04]
mov dword [esp + 0x1c], edx
mov edx, dword [0x4ebd08]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._execCmdEx__pureZosproc_u1746_32
sub esp, 0x20
mov eax, dword [esp + 0x40]
test eax, eax
je 0x48d2c1
test dword [eax], 0x40000000
je 0x48d330
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov dword [esi], eax
mov eax, dword [esp + 0x48]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x4c]
mov dword [esi + 8], eax
add esp, 0x5c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call sym._raiseOverflow
jmp 0x48d232
mov dword [esp + 0x10], 0x7fffffff
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp], 0x80000000
mov dword [esp + 4], 0xffffffff
call sym._raiseRangeErrorI
jmp 0x48d232
mov dword [esp], eax
call sym._deallocShared
jmp 0x48d2c1
call sym._raiseOverflow
jmp 0x48d1b3
Function at 0x490050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [edx]
mov edx, dword [edx + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
lea ecx, [ebx + 8]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
lea ecx, [ebx + 0x10]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
lea ecx, [ebx + 0x18]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
lea ecx, [ebx + 0x20]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
mov eax, dword [esi + 0x28]
mov edx, dword [esi + 0x2c]
lea ecx, [ebx + 0x28]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
lea ecx, [ebx + 0x30]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
lea ecx, [ebx + 0x38]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
mov eax, dword [esi + 0x40]
mov edx, dword [esi + 0x44]
lea ecx, [ebx + 0x40]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
movzx eax, byte [esi + 0x48]
lea ecx, [ebx + 0x4c]
sub esp, 8
mov byte [ebx + 0x48], al
movzx eax, byte [esi + 0x49]
mov byte [ebx + 0x49], al
mov eax, dword [esi + 0x4c]
mov edx, dword [esi + 0x50]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
movzx eax, byte [esi + 0x54]
lea ecx, [ebx + 0x58]
sub esp, 8
mov byte [ebx + 0x54], al
mov eax, dword [esi + 0x58]
mov edx, dword [esi + 0x5c]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
movzx eax, byte [esi + 0x60]
lea ecx, [ebx + 0x64]
sub esp, 8
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x64]
mov edx, dword [esi + 0x68]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___stdZassertions_u30_12
movzx eax, byte [esi + 0x6c]
lea ecx, [ebx + 0x74]
sub esp, 8
mov byte [ebx + 0x6c], al
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x78]
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._eqcopy___pureZosproc_u466_12
movzx eax, byte [esi + 0x7c]
sub esp, 8
mov byte [ebx + 0x7c], al
movzx eax, byte [esi + 0x7d]
mov byte [ebx + 0x7d], al
movzx eax, byte [esi + 0x7e]
mov byte [ebx + 0x7e], al
movzx eax, byte [esi + 0x7f]
mov byte [ebx + 0x7f], al
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x4923b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x70]
mov dword [esp + 0x2c], 0
mov ecx, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov esi, dword [esp + 0x80]
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + eax + 0x30], edx
add eax, 4
cmp eax, 0x20
jb 0x4923e5
mov dword [esp], 0x4db1c8
mov eax, ebp
movzx edx, al
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
call sym.___emutls_get_address
cmp byte [eax], 0
mov dword [esp + 0x1c], eax
jne 0x4925a0
mov eax, esi
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, al
mov dword [esp + 0x38], eax
lea eax, [ebx - 6]
cmp al, 0x10
mov dword [esp + 0x34], edx
ja case.0x492436.1
movzx eax, al
jmp dword [eax*4 + 0x4ec5ac]
movzx ebx, bl
lea esi, [esi]
nop
mov eax, ebp
mov dword [esp + 0x3c], ebx
cmp al, 0x17
jne 0x49245a
mov dword [esp + 0x30], 8
mov eax, esi
cmp al, 3
jne 0x492550
mov esi, dword [0x5190e8]
mov ebx, 0x4ec5f8
mov edx, 0x4ec5a8
mov eax, dword [esp + 0x10]
mov ecx, 0x4ec5a8
mov dword [esp + 4], edx
add eax, 4
test edi, edi
lea edi, [esp + 0x30]
cmove eax, ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 8], edi
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call esi
sub esp, 0x10
test eax, eax
je 0x4924cf
call sym._osLastError__stdZoserrors_u125_0
mov edi, dword [esp + 0x1c]
cmp byte [edi], 0
jne 0x4924cf
mov esi, dword [0x4ec5f0]
mov edi, dword [0x4ec5f4]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], edi
call sym._raiseOSError__stdZoserrors_u122
test ebx, ebx
je 0x4924df
test dword [ebx], 0x40000000
je 0x492590
mov eax, dword [esp + 0x2c]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov ebx, 0x3a
jmp 0x492448
mov ebx, 0x29
jmp 0x492448
mov ebx, 0x11
jmp 0x492448
mov ebx, 6
jmp 0x492448
mov ebx, 1
jmp 0x492448
xor ebx, ebx
jmp 0x492448
movzx eax, cx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._dollar___systemZdollars_u14_8
sub esp, 8
mov ebx, edx
mov esi, dword [esp + 0x1c]
cmp byte [esi], 0
jne 0x4924cf
test eax, eax
lea edx, [edx + 4]
mov eax, 0x4ec5a8
mov esi, dword [0x5190e8]
cmove edx, eax
jmp 0x492474
mov dword [esp], ebx
call sym._deallocShared
jmp 0x4924df
add esp, 0x5c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x18