joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489a50
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x547792
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x30]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x489b3d
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [eax]
cmp ebx, ecx
jne 0x489ab3
lea eax, [ebx + 0x10]
mov ecx, edi
push eax
call fcn.004751e0
test al, al
je 0x489b3d
mov ecx, dword [esi + 4]
push edi
push ebx
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
call fcn.0048a790
jmp 0x489b4a
cmp ebx, eax
jne 0x489b66
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
mov edx, dword [esi + 4]
push edi
mov dword [esp + 0x24], 0
mov ecx, dword [edx + 8]
add ecx, 0x10
call fcn.004751e0
test al, al
je 0x489b2b
mov eax, dword [esi + 4]
mov edx, dword [0x67a974]
push edi
mov ecx, dword [eax + 8]
lea eax, [esp + 0x30]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0048a790
mov esi, dword [esp + 0x28]
mov ecx, dword [eax]
mov dword [esp + 0x20], 0xffffffff
mov dword [esi], ecx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
lea edx, [esp + 0x10]
push edi
push edx
mov ecx, esi
call fcn.0048a4a0
mov ecx, dword [eax]
mov eax, dword [esp + 0x28]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], ebx
call fcn.0048a280
mov edx, dword [esp + 0x30]
push edi
lea ecx, [edx + 0x10]
call fcn.004751e0
test al, al
je 0x489b3d
lea eax, [ebx + 0x10]
mov ecx, edi
push eax
call fcn.004751e0
test al, al
je 0x489b3d
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
mov ecx, dword [esp + 0x30]
mov eax, dword [0x67a974]
mov dword [esp + 0x20], 1
push edi
cmp dword [ecx + 8], eax
jne 0x489bbc
push ecx
push eax
lea eax, [esp + 0x18]
jmp 0x489bc5
mov edx, dword [esi + 4]
push ebx
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0048a790
mov esi, dword [esp + 0x28]
mov ecx, dword [eax]
mov dword [esp + 0x20], 0xffffffff
mov dword [esi], ecx
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc

Function at 0x48b290
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0xffffffff
shl eax, 0xa
add eax, esi
mov esi, dword [esp + 0xc]
shl eax, 2
push eax
push esi
call fcn.0048b180
add esp, 8
test eax, eax
jl 0x48b2cd
lea ecx, [esp + 4]
push 4
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
mov eax, dword [esp + 4]
pop esi
pop ecx
ret
Function at 0x48b360
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
mov eax, 1
mov dword [esp + 0x20], ecx
jle 0x48b3d9
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
push ebp
push ebx
call fcn.0048b2e0
add esp, 8
test eax, eax
jl 0x48b3d7
mov edx, ebp
mov esi, 0x1000
and edx, 0xfff
sub esi, edx
cmp esi, edi
jl 0x48b3a4
mov esi, edi
push eax
push ebx
call fcn.0048b180
mov eax, dword [esp + 0x28]
push esi
push eax
push ebx
call dword [sym.imp.MSVCRT.dll__read]
mov edx, dword [esp + 0x34]
sub edi, esi
add esp, 0x14
add ebp, esi
add edx, esi
test edi, edi
mov dword [esp + 0x20], edx
jg 0x48b381
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x48b3e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push 0
push eax
push ecx
call fcn.0048b1b0
mov esi, eax
add esp, 0xc
xor eax, eax
test esi, esi
jle 0x48b43b
push 0xfffffffffffffffc
push esi
mov dword [esp + 0x14], eax
call fcn.0048b180
lea edx, [esp + 0x14]
push 4
push edx
push esi
call dword [sym.imp.MSVCRT.dll__read]
mov eax, dword [esp + 0x20]
add esp, 0x14
cmp eax, 1
jne 0x48b43b
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
push esi
call fcn.0048b360
add esp, 0x10
pop esi
ret
Function at 0x48b810
Capabilities:
Create tcp socket
Create udp socket
Get hostname
Initialize winsock library
Set socket configuration

Disassembly:
mov eax, 0x11b4
call fcn.005322e0
push ebx
push esi
lea eax, [esp + 0x2c]
push edi
push eax
mov edi, ecx
push 0x101
mov dword [esp + 0x14], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x48b84a
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x11b4
ret 0xc
mov eax, dword [0x67b4ec]
mov ebx, dword [esp + 0x11c4]
cmp eax, 0x20
jne 0x48b874
movzx cx, byte [edi]
cmp cx, word [0x67a87e]
jne 0x48b874
push 0x80
push ebx
call dword [sym.imp.WS2_32.dll_gethostname]
lea edx, [esp + 0x1c0]
push 0x1000
lea eax, [esp + 0x24]
push edx
push eax
push ebx
call fcn.004d9a60
add esp, 0x10
test eax, eax
jne 0x48b8a2
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x11b4
ret 0xc
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov word [esp + 0x10], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov dx, word [edi + 2]
push edx
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48b8f7
pop edi
pop esi
or eax, eax
pop ebx
add esp, 0x11b4
ret 0xc
mov eax, dword [0x67a8e4]
lea ecx, [esp + 0x10]
push eax
push ecx
push esi
call fcn.0048c380
add esp, 0xc
test eax, eax
push esi
jne 0x48b944
xor edx, edx
mov dx, word [edi + 2]
push edx
push ebx
call dword [sym.imp.MSVCRT.dll__errno]
mov eax, dword [eax]
push eax
push str.Error:_d__IP:_s_PORT:_x_Descrip:_d
call fcn.00458ab0
push esi
call fcn.004d65e0
mov eax, dword [esp + 0x24]
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x11b4
ret 0xc
xor ecx, ecx
mov cx, word [edi + 2]
push ecx
push ebx
push str.Connect_OK__IP:_s_PORT:_x_Descrip:_d
call fcn.00458ab0
mov eax, dword [esp + 0x11d8]
add esp, 0x10
mov dword [edi + 0x158], 0
mov dword [edi + 0x164], 0
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jle 0x48b995
lea edx, [esp + 0x11c8]
push 4
push edx
push 0x1001
push 0xffff
push esi
call edi
mov eax, dword [esp + 0x11cc]
test eax, eax
jle 0x48b9b7
lea eax, [esp + 0x11cc]
push 4
push eax
push 0x1002
push 0xffff
push esi
call edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x11b4
ret 0xc

Function at 0x48c380
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push 0x10
push eax
push ecx
xor esi, esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov eax, 1
je 0x48c3a0
mov eax, esi
pop esi
ret

Function at 0x48e700
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
xor esi, esi
push edi
test ebx, ebx
jle 0x48e73e
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, ebx
sub eax, esi
cmp eax, 0x1000
jl 0x48e726
mov eax, 0x1000
push eax
push edi
push ebp
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
test eax, eax
jle 0x48e73e
add esi, eax
add edi, eax
cmp esi, ebx
jl 0x48e716
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x48ebd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
xor esi, esi
push esi
mov dword [esp + 0xc], esi
call fcn.0048e6a0
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x48ed9a
mov esi, dword [esp + 0x14]
push ebx
push edi
mov edi, dword [esp + 0x20]
movsx ebx, word [esi + 0xc]
mov al, byte [esi + 4]
mov dword [esp + 0x20], edi
test al, al
mov dword [esp + 0x14], ebx
jne 0x48ed03
mov eax, dword [esi + 8]
mov ecx, 0x67a8d0
mov esi, eax
and eax, 7
shr esi, 3
add esi, 0x400
mov edi, eax
mov dword [esp + 0x1c], 0
call fcn.0047df60
cmp esi, eax
jae 0x48ed7a
mov ecx, 0x67a8d0
shr ebx, 3
call fcn.0047df60
lea ecx, [ebx + 1]
cmp ecx, eax
jae 0x48ed7a
mov ecx, 0x67a8d0
call fcn.0047df60
lea edx, [ebx + esi + 1]
cmp edx, eax
ja 0x48ed7a
push 0
push esi
push ebp
call dword [sym.imp.MSVCRT.dll__lseek]
mov esi, dword [sym.imp.MSVCRT.dll__read]
lea eax, [esp + 0x28]
push 4
push eax
push ebp
call esi
mov eax, dword [esp + 0x2c]
add esp, 0x18
xor ebx, ebx
test eax, eax
jbe 0x48ed70
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi*4 + 0x67a8e4]
test ecx, eax
mov edx, ebx
je 0x48ecbb
mov eax, dword [esp + 0x20]
and edx, 7
mov cl, byte [edx*4 + 0x67a8e4]
mov dl, byte [eax]
or dl, cl
jmp 0x48eccf
mov eax, dword [esp + 0x20]
and edx, 7
mov cl, byte [edx*4 + 0x67a8e4]
mov dl, byte [eax]
not cl
and dl, cl
inc ebx
inc edi
test bl, 7
mov byte [eax], dl
jne 0x48ecdc
inc dword [esp + 0x20]
cmp edi, 0x20
jne 0x48ecf0
lea edx, [esp + 0x1c]
push 4
push edx
push ebp
call esi
add esp, 0xc
xor edi, edi
cmp ebx, dword [esp + 0x14]
jb 0x48ec96
mov dword [esp + 0x10], 1
jmp 0x48ed84
cmp al, 2
jne 0x48ed84
mov eax, dword [esi + 8]
lea ecx, [eax + eax + 0x400]
mov dword [esp + 0x20], ecx
mov ecx, 0x67a8d0
call fcn.0047df60
cmp dword [esp + 0x20], eax
jae 0x48ed7a
mov ecx, 0x67a8d0
add ebx, ebx
call fcn.0047df60
cmp ebx, eax
jae 0x48ed7a
mov ecx, 0x67a8d0
call fcn.0047df60
mov ecx, dword [esp + 0x20]
lea edx, [ebx + ecx]
cmp edx, eax
ja 0x48ed7a
push 0
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll__lseek]
push ebx
push edi
push ebp
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x18
mov ecx, esi
push edi
call fcn.004c9fe0
push edi
mov ecx, esi
call fcn.004ca060
mov dword [esp + 0x10], 1
jmp 0x48ed84
push 0xe
call fcn.004ab020
add esp, 4
push ebp
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
mov eax, esi
pop esi
pop ebp
add esp, 8
ret
Function at 0x494380
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
mov ebx, ecx
push 0x8002
push eax
mov dword [esp + 0x10], ebx
xor esi, esi
call dword [sym.imp.MSVCRT.dll__open]
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
jle 0x49449b
push ebp
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
mov esi, dword [edi + 8]
shl esi, 1
call fcn.004c9d30
mov cl, byte [edi + 4]
lea eax, [eax + esi - 1]
test cl, cl
jne 0x4943de
mov esi, dword [edi + 8]
mov ecx, edi
shr esi, 3
call fcn.004c9d50
mov ecx, dword [edi + 8]
lea eax, [eax + ecx - 1]
shr eax, 3
mov ecx, dword [ebx + 4]
mov ebp, eax
sub ebp, esi
inc ebp
inc eax
cmp ecx, eax
jge 0x4943ed
mov eax, ecx
sub eax, esi
xor edx, edx
test eax, eax
setle dl
dec edx
and edx, eax
test esi, esi
mov edi, edx
jge 0x494401
xor edi, edi
mov ebx, ebp
sub ebx, edi
test edi, edi
jle 0x49442b
mov eax, dword [esp + 0x18]
push 0
push esi
push eax
call dword [sym.imp.MSVCRT.dll__lseek]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
push edi
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x18
test ebx, ebx
jle 0x494460
mov eax, dword [esp + 0x18]
push 2
push 0
push eax
call dword [sym.imp.MSVCRT.dll__lseek]
mov ecx, dword [esp + 0x1c]
add esp, 0xc
cmp eax, dword [ecx + 4]
jle 0x494460
mov eax, dword [esp + 0x20]
lea edx, [edi + esi]
push ebx
push edx
mov edx, dword [esp + 0x20]
add edi, eax
push edi
push edx
call fcn.00494a10
mov eax, dword [esp + 0x1c]
mov cl, byte [eax + 4]
test cl, cl
jne 0x494480
mov eax, dword [eax + 8]
mov ecx, dword [esp + 0x20]
and eax, 7
push eax
push ebp
push ecx
call fcn.004bc440
add esp, 0xc
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov eax, 1
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret 0xc
mov eax, esi
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x494860
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x3004
call fcn.005322e0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3014]
mov ebx, ecx
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov ecx, ebx
push eax
push esi
call fcn.004947f0
mov ebp, dword [sym.imp.MSVCRT.dll__lseek]
mov edi, dword [ebx + 4]
push 2
push 0
push esi
call ebp
add esp, 0xc
cmp eax, edi
jne 0x4948c5
lea ecx, [esp + 0x14]
push 0x1000
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__write]
add esp, 0xc
jmp 0x4948df
push 0
push edi
push esi
call ebp
lea edx, [esp + 0x20]
push 0x1000
push edx
push esi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x18
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x1018]
mov dword [esp + 0x1014], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x301c]
sar eax, 0x16
and eax, 0x3ff
lea edi, [esp + eax*4 + 0x14]
mov dword [esp + 0x10], edi
mov eax, dword [edi]
test eax, eax
jne 0x494950
push 2
push eax
push esi
call ebp
mov dword [edi], eax
mov edi, dword [sym.imp.MSVCRT.dll__write]
lea eax, [esp + 0x1020]
push 0x1000
push eax
push esi
call edi
mov ecx, dword [ebx + 4]
push 0
push ecx
push esi
call ebp
lea edx, [esp + 0x38]
push 0x1000
push edx
push esi
call edi
add esp, 0x30
jmp 0x49496d
push 0
push eax
push esi
call ebp
lea eax, [esp + 0x1020]
push 0x1000
push eax
push esi
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0x18
mov eax, dword [esp + 0x301c]
sar eax, 0xc
and eax, 0x3ff
lea ebx, [esp + eax*4 + 0x1014]
mov eax, dword [esp + eax*4 + 0x1014]
test eax, eax
jne 0x4949e7
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x2015]
mov byte [esp + 0x2014], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 2
push 0
push esi
stosb byte es:[edi], al
call ebp
mov edi, dword [sym.imp.MSVCRT.dll__write]
lea ecx, [esp + 0x2020]
push 0x1000
push ecx
push esi
mov dword [ebx], eax
call edi
mov edx, dword [esp + 0x28]
push 0
mov eax, dword [edx]
push eax
push esi
call ebp
lea ecx, [esp + 0x1038]
push 0x1000
push ecx
push esi
call edi
add esp, 0x30
mov eax, dword [esp + 0x301c]
mov ecx, dword [ebx]
pop edi
and eax, 0xfff
pop esi
pop ebp
add eax, ecx
pop ebx
add esp, 0x3004
ret 8

Function at 0x494a10
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 4], ecx
test edi, edi
mov dword [esp + 0x10], eax
jle 0x494a8a
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov ecx, dword [esp + 0x10]
push ebp
push ebx
call fcn.00494860
mov ecx, ebp
mov esi, 0x1000
and ecx, 0xfff
sub esi, ecx
cmp esi, edi
jl 0x494a51
mov esi, edi
push 0
push eax
push ebx
call dword [sym.imp.MSVCRT.dll__lseek]
mov edx, dword [esp + 0x28]
push esi
push edx
push ebx
call dword [sym.imp.MSVCRT.dll__read]
mov edx, dword [esp + 0x34]
sub edi, esi
add esp, 0x18
add ebp, esi
add edx, esi
test edi, edi
mov dword [esp + 0x1c], edx
jg 0x494a31
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
pop ecx
ret 0x10
mov eax, 1
pop edi
pop ecx
ret 0x10
Function at 0x495d60
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], eax
mov edx, dword [0x67a8cc]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [0x67a8cc]
push eax
push 1
push 0x10
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
mov ecx, esi
call fcn.00495df0
mov eax, esi
pop esi
ret 8

Function at 0x496110
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x110
push ebx
push ebp
push esi
push 0x180
push 0
push eax
call dword [sym.imp.MSVCRT.dll__open]
mov ebp, eax
add esp, 0xc
test ebp, ebp
jge 0x49613e
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov esi, dword [sym.imp.MSVCRT.dll__lseek]
push 0
push 0
push ebp
mov dword [esp + 0x18], 0
call esi
mov ebx, dword [sym.imp.MSVCRT.dll__read]
lea ecx, [esp + 0x18]
push 4
push ecx
push ebp
call ebx
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x24]
add esp, 0x18
cmp eax, ecx
jl 0x49618e
push ebp
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov eax, 0xfffffffd
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
lea edx, [eax + eax*2]
push edi
push 0
lea eax, [edx*4 + 4]
push eax
push ebp
call esi
lea ecx, [esp + 0x20]
push 0xc
push ecx
push ebp
call ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
add esp, 0x18
test eax, eax
jbe 0x4961e3
mov edx, dword [esp + 0x18]
push 0
push edx
push ebp
call esi
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push eax
push ecx
push ebp
call ebx
add esp, 0x18
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x130]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret

Function at 0x496230
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0x180
push 0
push eax
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x49624e
pop esi
ret
push 0
push 0
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.MSVCRT.dll__lseek]
lea ecx, [esp + 0x14]
push 4
push ecx
push esi
call dword [sym.imp.MSVCRT.dll__read]
mov eax, dword [esp + 0x20]
add esp, 0x18
cmp eax, 0x3e8
jbe 0x496285
mov dword [esp + 8], 0
push esi
call dword [sym.imp.MSVCRT.dll__close]
mov eax, dword [esp + 0xc]
add esp, 4
pop esi
ret
Function at 0x496bb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__lseek]
push ebp
push esi
mov esi, dword [esp + 0x21c]
xor ebp, ebp
push edi
push ebp
mov edi, ecx
push ebp
push esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], ebp
call ebx
lea eax, [esp + 0x24]
push 2
mov dword [esp + 0x28], ebp
mov ebp, dword [sym.imp.MSVCRT.dll__read]
push eax
push esi
call ebp
mov eax, dword [esp + 0x30]
add esp, 0x18
cmp eax, 0xfeff
jne 0x496c8f
mov ecx, dword [edi]
xor eax, eax
or ecx, 1
mov word [esp + 0x1c], 0
mov dword [edi], ecx
mov ecx, 0x7f
lea edi, [esp + 0x1e]
push 0x200
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
push esi
stosw word es:[edi], ax
call ebp
mov edx, dword [esp + 0x20]
add esp, 0xc
xor eax, eax
test byte [edx], 2
je 0x496c4e
lea edx, [esp + 0x1c]
mov cx, word [edx]
inc eax
add edx, 2
cmp cx, 0xa
je 0x496c4e
cmp eax, 0x100
jl 0x496c3a
cmp eax, 0x100
mov esi, eax
jge 0x496c89
lea edx, [esp + eax*2 + 0x1c]
mov ecx, edx
mov di, word [ecx]
inc eax
add ecx, 2
cmp di, 0xa
je 0x496c71
cmp eax, 0x100
jl 0x496c5d
cmp esi, eax
jge 0x496c89
mov ecx, eax
sub ecx, esi
cmp word [edx], 9
jne 0x496c83
inc dword [esp + 0x10]
add edx, 2
dec ecx
jne 0x496c79
lea esi, [eax + eax + 2]
jmp 0x496d08
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
push 0
push esi
stosb byte es:[edi], al
call ebx
lea eax, [esp + 0x28]
push 0x100
push eax
push esi
call ebp
mov ecx, dword [esp + 0x2c]
add esp, 0x18
xor eax, eax
test byte [ecx], 2
je 0x496cd7
mov cl, byte [esp + eax + 0x1c]
inc eax
cmp cl, 0xa
je 0x496cd7
cmp eax, 0x100
jl 0x496cc6
cmp eax, 0x100
mov ecx, eax
jge 0x496d06
mov dl, byte [esp + eax + 0x1c]
inc eax
cmp dl, 0xa
je 0x496cf1
cmp eax, 0x100
jl 0x496ce0
cmp ecx, eax
jge 0x496d06
mov dl, 0x2c
cmp byte [esp + ecx + 0x1c], dl
jne 0x496d01
inc dword [esp + 0x10]
inc ecx
cmp ecx, eax
jl 0x496cf7
mov esi, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
call fcn.00496650
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 4
Function at 0x497b10
Capabilities:
Get number of processors
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x54792b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 0x64]
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
call fcn.004c4950
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x68], ebx
mov dword [esi], 0x555800
mov edx, dword [0x67a8cc]
push ebx
push ecx
push edx
mov dword [esp + 0x38], ebx
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
lea eax, [esi + 4]
push 1
push 4
push eax
call edi
mov edx, dword [0x67a8cc]
lea eax, [esi + 8]
push edx
push 1
push 0x20
push eax
call edi
mov ecx, dword [0x67a8cc]
lea edx, [esi + 0x28]
push ecx
push 1
push 4
push edx
call edi
mov ecx, dword [0x67a8cc]
lea eax, [esi + 0x2c]
push ecx
push 1
push 4
push eax
call edi
mov edx, dword [0x67a8cc]
add esp, 0x4c
lea eax, [esp + 0x14]
push edx
push 1
push 0x10
push eax
call edi
mov ecx, dword [0x67a8cc]
lea eax, [esi + 0x30]
push ecx
push 1
push 0x10
push eax
call edi
mov edx, dword [0x67a8cc]
lea ebp, [esi + 0x40]
push edx
push 1
push 4
push ebp
call edi
mov eax, dword [0x67a904]
add esp, 0x30
test dword [esi + 4], eax
jne 0x497c09
mov dword [ebp], ebx
mov eax, dword [ebp]
cmp eax, ebx
jle 0x497c39
push eax
call fcn.00478e60
mov ecx, dword [ebp]
add esp, 4
mov dword [esi + 0x44], eax
mov edx, dword [0x67a8cc]
push ecx
push eax
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
push eax
call fcn.0047a710
jmp 0x497c49
mov eax, dword [0x67a8cc]
push 1
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a900]
mov eax, dword [esi + 4]
add esp, 0xc
test eax, ecx
jne 0x497c67
xor edx, edx
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], edx
test byte [esi + 4], 8
je 0x497c90
push 0x24
call fcn.004784b0
add esp, 4
cmp eax, ebx
je 0x497c8b
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
jmp 0x497c8d
xor eax, eax
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x2c]
cmp eax, ebx
jbe 0x497ca3
push eax
call fcn.00478e60
add esp, 4
mov dword [esi + 0x4c], eax
mov ecx, 8
xor eax, eax
lea edi, [esi + 0x74]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8