joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040ea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x100de040]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x10040fa5
test eax, eax
jle 0x10040fa5
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov dword [esp + 0x1c], edx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x10]
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
test eax, eax
jle 0x10040f75
jmp 0x10040f00
lea edx, [esp + 0x28]
push edx
mov edx, esi
mov ecx, ebx
call fcn.10041280
mov edx, dword [esp + 0x20]
xor dword [esp + 0x30], edx
mov edx, dword [esp + 0x24]
xor dword [esp + 0x34], edx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x2c]
xor ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
xor eax, ebp
mov ebp, dword [esi]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0xc]
mov dword [edi], eax
mov eax, dword [esp + 0x30]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 4], ecx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
dec eax
mov dword [edi + 0xc], ecx
add esi, 0x10
add edi, 0x10
mov dword [esp + 0x24], edx
mov dword [esp + 0x10], eax
test eax, eax
jg 0x10040f00
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [ebx + 4], ebp
pop ebp
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x20]
pop edi
mov dword [ebx + 0xc], ecx
pop esi
mov dword [ebx + 0x10], edx
shl eax, 4
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.10062448
add esp, 0x2c
ret 8
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10062448
add esp, 0x2c
ret 8
Function at 0x10040fc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x100de040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov esi, ecx
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp edi, 0xa
jg 0x1004111d
cmp eax, 4
jge 0x10041036
mov edi, edi
cmp ecx, 4
jge 0x10041039
mov bl, byte [esp + eax*4 + 0x10]
lea edx, [ecx + edi*4]
mov byte [ebp + edx*4 + 0x14], bl
lea edx, [ecx + edi*4]
lea esi, [ebp + edx*4]
movzx edx, byte [esp + eax*4 + 0x11]
mov byte [esi + 0x15], dl
movzx edx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], dl
movzx edx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], dl
jl 0x10041000
cmp ecx, 4
jne 0x1004103e
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x10040ff0
cmp edi, 0xa
jg 0x1004111d
mov edx, 0x100e7798
movzx esi, byte [esp + 0x1d]
mov al, byte [esp + 0x10]
xor al, byte [esi + 0x100e78b8]
movzx esi, byte [esp + 0x1e]
movzx ebx, byte [esi + 0x100e78b8]
movzx esi, byte [esp + 0x1f]
xor byte [esp + 0x11], bl
movzx ebx, byte [esi + 0x100e78b8]
movzx esi, byte [esp + 0x1c]
xor byte [esp + 0x12], bl
movzx ebx, byte [esi + 0x100e78b8]
xor al, byte [edx]
xor byte [esp + 0x13], bl
mov byte [esp + 0x10], al
inc edx
lea eax, [esp + 0x11]
mov esi, 3
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x100410a0
xor eax, eax
cmp edi, 0xa
jg 0x1004111d
cmp eax, 4
jge 0x10041107
nop
cmp ecx, 4
jge 0x1004110a
movzx ebx, byte [esp + eax*4 + 0x10]
lea esi, [ecx + edi*4]
mov byte [ebp + esi*4 + 0x14], bl
movzx ebx, byte [esp + eax*4 + 0x11]
lea esi, [ecx + edi*4]
lea esi, [ebp + esi*4]
mov byte [esi + 0x15], bl
movzx ebx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], bl
movzx ebx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], bl
jl 0x100410d0
cmp ecx, 4
jne 0x1004110f
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x100410c5
cmp edi, 0xa
jle 0x10041051
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10062448
add esp, 0x24
ret 4
Function at 0x10041140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x100de040]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push ebx
push esi
push edi
lea esi, [eax + 0x24]
lea ecx, [eax + 0x28]
mov edi, 9
xor eax, eax
jmp 0x10041170
movzx edx, byte [ecx - 1]
movzx edx, byte [eax + edx*4 + 0x100e4798]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x100e4b98]
movzx ebx, byte [ecx - 3]
xor dl, byte [eax + ebx*4 + 0x100e4f98]
movzx ebx, byte [ecx - 4]
xor dl, byte [eax + ebx*4 + 0x100e5398]
movzx ebx, byte [ecx + 2]
mov byte [esp + eax + 0xc], dl
movzx edx, byte [ecx + 3]
movzx edx, byte [eax + edx*4 + 0x100e4798]
xor dl, byte [eax + ebx*4 + 0x100e4b98]
movzx ebx, byte [ecx + 1]
xor dl, byte [eax + ebx*4 + 0x100e4f98]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x100e5398]
movzx ebx, byte [ecx + 6]
mov byte [esp + eax + 0x10], dl
movzx edx, byte [ecx + 7]
movzx edx, byte [eax + edx*4 + 0x100e4798]
xor dl, byte [eax + ebx*4 + 0x100e4b98]
movzx ebx, byte [ecx + 5]
xor dl, byte [eax + ebx*4 + 0x100e4f98]
movzx ebx, byte [ecx + 4]
xor dl, byte [eax + ebx*4 + 0x100e5398]
movzx ebx, byte [ecx + 0xa]
mov byte [esp + eax + 0x14], dl
movzx edx, byte [ecx + 0xb]
movzx edx, byte [eax + edx*4 + 0x100e4798]
xor dl, byte [eax + ebx*4 + 0x100e4b98]
movzx ebx, byte [ecx + 9]
xor dl, byte [eax + ebx*4 + 0x100e4f98]
movzx ebx, byte [ecx + 8]
xor dl, byte [eax + ebx*4 + 0x100e5398]
inc eax
cmp eax, 4
mov byte [esp + eax + 0x17], dl
jl 0x10041170
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
add ecx, 0x10
add esi, 0x10
sub edi, 1
jne 0x10041160
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10062448
add esp, 0x14
ret 4
Function at 0x10041f50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x20
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
push eax
xor edi, edi
xor ebp, ebp
call fcn.10044f40
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x40], eax
cmp ecx, dword [esp + 0x34]
jb 0x10041fa0
ja 0x10041f7b
mov edx, dword [esi + 0x18]
cmp edx, dword [esp + 0x30]
jbe 0x10041fa0
cmp dword [esi + 0x30], 1
je 0x10041f8a
mov eax, dword [esi + 0x3c]
push edi
call fcn.10045100
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov eax, dword [esi + 0x3c]
push edi
call fcn.10045100
nop
mov eax, dword [esi + 0x30]
cmp eax, 2
jne 0x10041fcd
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
lea ebp, [esi + 0x2c]
push ebp
mov edx, ecx
mov dword [esi + 0x24], ecx
mov ecx, dword [esi + 4]
lea ebp, [esi + 0x28]
push ebp
mov dword [esi + 0x20], eax
mov ebx, dword [ecx]
push edx
mov edx, dword [ebx]
push eax
call edx
mov ebp, eax
jmp 0x10041f96
cmp eax, 3
jne 0x10041ff5
mov eax, dword [esi + 0x38]
cdq
add eax, dword [esi + 0x18]
adc edx, dword [esi + 0x1c]
cmp edx, dword [esp + 0x34]
ja 0x10041ff5
jb 0x10041fea
cmp eax, dword [esp + 0x30]
ja 0x10041ff5
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x38], edi
jmp 0x10041f96
xor ebx, ebx
test ebp, ebp
jne 0x1004201b
cmp dword [esi + 0x30], 1
jne 0x10042006
lea ebp, [ebx + 0xb]
jmp 0x1004201b
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 0x18]
mov edi, dword [esi + 0x38]
mov ebx, dword [esi + 0x34]
sub edi, ecx
sub ebx, eax
add edi, eax
add ebx, ecx
mov eax, dword [0x100e16e0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 4], 0xffffffff
jne 0x1004204d
mov ecx, dword [0x100e16e0]
push 0
push ecx
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x100e79ec]
test eax, eax
je 0x1004204d
call eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x40], 0
mov dword [edx], ebx
mov dword [eax], edi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x20
ret 0x10
Function at 0x10042b50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
inc ecx
mov edx, 4
push esi
jmp 0x10042b60
movzx esi, byte [ecx - 1]
mov esi, dword [esi*4 + 0x100e4398]
xor dword [eax + 0x204], esi
movzx esi, byte [ecx]
mov esi, dword [esi*4 + 0x100e4398]
xor dword [eax + 0x208], esi
movzx esi, byte [ecx + 1]
mov esi, dword [esi*4 + 0x100e4398]
xor dword [eax + 0x20c], esi
movzx esi, byte [ecx + 2]
mov esi, dword [esi*4 + 0x100e4398]
xor dword [eax + 0x210], esi
add ecx, 4
sub edx, 1
jne 0x10042b60
pop esi
ret
Function at 0x10043130
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10043136
sub eax, edx
push edi
or edx, 0xffffffff
call fcn.10040860
mov word [esi + 0x214], ax
shr eax, 0x10
xor ecx, ecx
mov word [esi + 0x216], ax
xor eax, eax
mov word [esi + 0x21a], ax
mov word [esi + 0x218], cx
mov byte [esi + 0x21e], cl
mov byte [esi + 0x21d], cl
mov byte [esi + 0x21c], cl
mov al, byte [edi]
add esp, 4
test al, al
je 0x100431e6
jmp 0x10043190
add byte [esi + 0x21c], al
xor byte [esi + 0x21d], al
mov dl, byte [esi + 0x21e]
add dl, al
rol dl, 1
movzx ecx, al
mov byte [esi + 0x21e], dl
mov dx, word [ecx*4 + 0x100e4398]
xor dx, word [esi + 0x218]
movzx ax, al
xor dx, ax
mov word [esi + 0x218], dx
mov cx, word [ecx*4 + 0x100e439a]
add cx, ax
add word [esi + 0x21a], cx
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10043190
pop edi
ret

Function at 0x10043270
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
test edi, edi
je 0x1004331a
push ebx
mov ecx, 0x1234
add word [eax + 0x214], cx
movzx ecx, word [eax + 0x214]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [edx*4 + 0x100e4398]
xor word [eax + 0x216], dx
mov bx, word [eax + 0x21a]
mov edx, ecx
shr edx, 1
and edx, 0xff
movzx edx, word [edx*4 + 0x100e439a]
sub word [eax + 0x218], dx
movzx edx, word [eax + 0x218]
xor edx, ecx
mov word [eax + 0x214], dx
mov edx, 1
mov ecx, edx
dec edi
ror bx, cl
inc esi
xor bx, word [eax + 0x216]
ror bx, cl
movzx ecx, bx
xor word [eax + 0x214], cx
mov word [eax + 0x21a], cx
movzx ecx, word [eax + 0x214]
shr ecx, 8
xor byte [esi - 1], cl
test edi, edi
jne 0x10043281
pop ebx
pop edi
pop esi
ret 4
Function at 0x10044f40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp byte [0x100e79dd], 0
jne 0x10044f4e
call fcn.10044ec0
mov eax, dword [0x100e16e0]
push edi
push eax
mov edi, 1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10044f6e
add dword [eax + 4], edi
mov eax, dword [eax + 8]
pop edi
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
lea ecx, [ecx]
mov eax, dword [0x100e79f0]
test eax, eax
je 0x10044f9f
push 1
push 0
call eax
mov esi, eax
test esi, esi
jne 0x10044fbe
push eax
push eax
call dword [0x100e79f0]
jmp 0x10044fa3
push 0
call ebx
mov esi, eax
test esi, esi
jne 0x10044fbe
inc edi
cmp edi, 0x12c
jbe 0x10044fb7
mov edi, 0x12c
push 0
push edi
call ebp
jmp 0x10044f80
mov eax, dword [esp + 0x14]
mov ecx, dword [0x100e16e0]
push eax
push ecx
mov dword [eax], 0x54626966
mov dword [eax + 4], 1
mov dword [eax + 8], esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
ret 4

Function at 0x10045030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x24
push esi
lea eax, [esp + 0x10]
push eax
call fcn.10044f40
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [0x100e79e8]
mov dword [esp + 8], 0x10041ee0
mov dword [esp + 0xc], ecx
test eax, eax
je 0x10045096
lea edx, [esp + 4]
push edx
push 0x10045000
push 1
push 0x4000
push 0x4000
call eax
mov esi, eax
test esi, esi
jne 0x100450b1
lea eax, [esp + 4]
push eax
push 0x10045000
push esi
push 0x4000
push 0x4000
call dword [0x100e79e8]
jmp 0x100450ab
lea ecx, [esp + 4]
push ecx
push 0x10045000
push 0x4000
call dword [sym.imp.KERNEL32.dll_CreateFiber]
mov esi, eax
test esi, esi
je 0x100450ba
push 0
mov eax, esi
call fcn.10045100
mov edx, dword [0x100e16e0]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 4], 0xffffffff
jne 0x100450ec
mov dword [eax], 0
mov eax, dword [0x100e16e0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x100e79ec]
test eax, eax
je 0x100450ec
call eax
mov eax, esi
pop esi
add esp, 0x24
ret 4

Function at 0x10045100
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov eax, dword [0x100e16e0]
push eax
call edi
test esi, esi
jne 0x10045119
mov esi, dword [eax + 8]
mov ecx, dword fs:[0x10]
mov edx, dword [esp + 0xc]
push esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov eax, dword [0x100e16e0]
push eax
call edi
mov ecx, dword [eax + 0x10]
pop edi
pop esi
test ecx, ecx
je 0x10045156
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
push edx
push eax
call ecx
add esp, 8
ret 4
Function at 0x10047f50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x10047f62
mov eax, 0x80070057
pop esi
ret 0x10
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10047f7b
call fcn.10002d30
pop esi
ret 0x10
test al, 0x10
je 0x10047f8b
mov dword [esi], 8
xor eax, eax
pop esi
ret 0x10
mov eax, 0xe00e1001
pop esi
ret 0x10

Function at 0x100482a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x100482e7
cmp word [esi], 0
je 0x100482e7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100482c4
call fcn.10002d30
pop esi
ret 0xc
test al, 0x10
je 0x100482e7
push edi
mov edi, dword [esp + 0xc]
lea eax, [edi + 0xc]
push eax
mov edx, esi
call fcn.1000a1d0
push 0
push esi
mov ecx, edi
call fcn.10048610
pop edi
pop esi
ret 0xc
mov eax, 0xe00e1001
pop esi
ret 0xc
Function at 0x1004d360
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
test edi, edi
je 0x1004d4d5
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x1004d37c
mov eax, 0x80070057
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1004d3a0
test eax, eax
je 0x1004d372
mov edx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ebx
push edx
push eax
mov edx, edi
call fcn.1000fd20
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esi + 0xc]
cmp ecx, 0xffffffff
jne 0x1004d3b2
mov eax, 0x80004005
pop ebx
pop ecx
ret 0xc
test eax, eax
je 0x1004d3d6
mov edx, dword [eax + 4]
mov eax, dword [eax]
push 0
push 0
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1004d3d6
call fcn.10002d30
pop ebx
pop ecx
ret 0xc
mov edx, dword [esi + 0xc]
push 0
lea ecx, [esp + 8]
push ecx
push edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edx
mov dword [esp + 0x18], 0
call ebx
test eax, eax
jne 0x1004d4c7
cmp dword [esp + 0x14], eax
jne 0x1004d3cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x1004d42c
cmp eax, 0x3e6
je 0x1004d42c
test eax, eax
jle 0x1004d4d7
and eax, 0xffff
or eax, 0x80070000
pop ebx
pop ecx
ret 0xc
cmp dword [esi + 0x3dc], edi
jae 0x1004d483
mov eax, dword [esi + 0x3d8]
test eax, eax
je 0x1004d45b
push eax
call fcn.100628c6
add esp, 4
mov dword [esi + 0x3d8], 0
mov dword [esi + 0x3dc], 0
push 0x100e33b4
push edi
call fcn.100628bb
add esp, 8
mov dword [esi + 0x3d8], eax
test eax, eax
jne 0x1004d47d
mov eax, 0x8007000e
pop ebx
pop ecx
ret 0xc
mov dword [esi + 0x3dc], edi
mov eax, dword [esi + 0x3d8]
push edi
push 0
push eax
call fcn.10064e10
mov edx, dword [esi + 0x3d8]
mov eax, dword [esi + 0xc]
add esp, 0xc
push 0
lea ecx, [esp + 8]
push ecx
push edi
push edx
push eax
call ebx
test eax, eax
je 0x1004d3cc
mov ecx, dword [esi + 0x3d8]
mov edx, dword [esp + 0xc]
push edi
push ecx
push edx
call fcn.10064ea0
add esp, 0xc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1004d4d5
mov ecx, dword [esp + 4]
mov dword [eax], ecx
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x1004e710
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100ac108
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100de040]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x20]
xor ecx, ecx
push ecx
lea edx, [esp + 0x18]
push edx
push ecx
push eax
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0xc]
push eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1004e771
call fcn.10002d30
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
push 0xa290
call fcn.1006387a
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 0x28], 0
test esi, esi
jne 0x1004e7a7
mov eax, 0x8007000e
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
push 0xa290
push 0
push esi
call fcn.10064e10
mov edx, dword [edi + 0xc]
add esp, 0xc
push 0
lea ecx, [esp + 0x14]
push ecx
push 0xa290
push esi
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1004e7fe
call fcn.10002d30
push esi
mov edi, eax
call fcn.100628c6
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
mov eax, 0x8001
mov ecx, esi
call fcn.10050280
test eax, eax
jne 0x1004e913
mov eax, 0x9311
mov ecx, esi
call fcn.10050280
test eax, eax
jne 0x1004e913
mov eax, 0x9319
mov ecx, esi
call fcn.10050280
test eax, eax
jne 0x1004e913
mov eax, 0x9911
mov ecx, esi
call fcn.10050280
test eax, eax
jne 0x1004e913
mov eax, 0x9919
mov ecx, esi
call fcn.10050280
test eax, eax
jne 0x1004e913
mov eax, 0x9209
mov ecx, esi
call fcn.10050280
test eax, eax
jne 0x1004e913
mov eax, 0x9201
mov ecx, esi
call fcn.10050280
test eax, eax
jne 0x1004e913
cmp dword [edi + 0x20], eax
je 0x1004e8b8
mov ecx, edi
mov dword [edi + 0x20], eax
call fcn.1004e710
lea esi, [esp + 0xc]
mov edi, eax
call fcn.10008990
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
mov edi, dword [edi + 0x24]
lea esi, [esp + 0xc]
call fcn.10008990
cmp edi, 1
jne 0x1004e8e0
mov eax, 0xe003200b
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
cmp edi, 2
jne 0x1004e8fc
mov eax, 0xe003200a
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
mov eax, 0xe00e1001
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
push esi
call fcn.100628c6
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x1004ef10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x10c
mov eax, dword [0x100de040]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x118]
push edi
mov dword [esp + 8], eax
mov edi, ecx
test esi, esi
je 0x1004f09b
test edi, edi
je 0x1004f09b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
push esi
call ebx
cmp dword [esp + 0x124], 0
je 0x1004efaa
mov eax, dword [edi + ebp]
push 0x100d4e38
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1004efbf
push 0x5c
push 0
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov ebx, eax
test ebx, ebx
je 0x1004f04c
add ebx, 2
cmp dword [esp + 0x124], 0
je 0x1004efea
mov edx, dword [edi + ebp]
add edx, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edx
push ebx
call edi
jmp 0x1004f05c
mov ecx, dword [edi + ebp]
push str..mdf
add ecx, edi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1004ef74
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0x100d4e2c
push eax
call ebx
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
xor ecx, esp
call fcn.10062448
add esp, 0x10c
ret 0xc
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.10064e10
mov ecx, dword [edi + ebp]
add esp, 0xc
add ecx, edi
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
lea edx, [eax + 1]
jmp 0x1004f020
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004f020
mov ecx, esi
sub ecx, ebx
add ecx, 0x208
sar ecx, 1
push ecx
sub eax, edx
push ebx
inc eax
push eax
lea edx, [esp + 0x1c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1004f056
mov eax, 0x80004005
jmp 0x1004efd0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
call ebx
cmp eax, 0xffffffff
jne 0x1004efce
mov eax, dword [esp + 0xc]
push eax
push esi
call edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0x100d4e2c
push eax
call edi
push esi
call ebx
cmp eax, 0xffffffff
jne 0x1004efce
mov eax, 0xe0032009
jmp 0x1004efd0
mov eax, 0x80070057
jmp 0x1004efd1
Function at 0x10051790
Capabilities:
Get file size

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, eax
push edi
mov edi, dword [esi + 0x3a0]
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], ebp
cmp edi, dword [esi + 0x3a4]
jbe 0x100517b6
call fcn.10062881
mov ebx, dword [esi + 0x394]
mov dword [esp + 0x1c], edi
mov edi, dword [esi + 0x3a4]
cmp dword [esi + 0x3a0], edi
jbe 0x100517d3
call fcn.10062881
mov eax, dword [esi + 0x394]
test ebx, ebx
je 0x100517e1
cmp ebx, eax
je 0x100517e6
call fcn.10062881
cmp dword [esp + 0x1c], edi
je 0x100518f0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
push eax
push ebp
push ecx
call fcn.1004f980
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
test ebx, ebx
jne 0x100518bc
call fcn.10062881
xor eax, eax
mov edi, dword [esp + 0x1c]
cmp edi, dword [eax + 0x10]
jb 0x1005182f
call fcn.10062881
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
jb 0x1005183a
mov eax, dword [eax]
push 0
push 0
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x30], eax
cmp eax, 0xffffffff
je 0x100518c7
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100518d4
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
add eax, 0xffffffd4
adc ecx, 0xffffffff
add ebp, eax
adc dword [esp + 0x24], ecx
inc dword [esp + 0x14]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
lea edi, [esi + 0x37c]
mov dword [esp + 0x30], ecx
call fcn.1005fe10
test ebx, ebx
jne 0x100518c3
call fcn.10062881
xor eax, eax
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [eax + 0x10]
jb 0x100518b2
call fcn.10062881
add dword [esp + 0x1c], 0x1c
jmp 0x100517c0
mov eax, dword [ebx]
jmp 0x10051821
mov eax, dword [ebx]
jmp 0x100518a4
call fcn.10002d30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
call fcn.10002d30
mov edx, dword [esp + 0x30]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x24]
push edi
push ebp
call fcn.1004f8c0
mov dword [esi + 0x35c], edi
pop edi
mov dword [esi + 0x358], ebp
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret