joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025c73
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10025c82
pop dword [ebp - 0x20]
mov eax, 0x10025c82
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x29e6cd47
add dword [ebp - 0x30], 0x246b7804
mov dword [ebp - 0x2c], 0x1712a1d3
add dword [ebp - 0x2c], 0x1b20aa72
mov dword [ebp - 0x28], 0xb1805cbf
add dword [ebp - 0x28], 0x9acbe76f
mov dword [ebp - 0x24], 0x76a1267a
sub dword [ebp - 0x24], 0x76a1267a
lea eax, [ebp - 0x30]
push eax
mov eax, 0xd1da96b0
sub eax, 0xc1d74598
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xda9172d0
add dword [ebp - 0x30], 0x99e0f686
mov dword [ebp - 0x2c], 0x544cda63
sub dword [ebp - 0x2c], 0x12e078ee
mov dword [ebp - 0x28], 0x159d9ba6
sub dword [ebp - 0x28], 0xb22e2f3a
mov dword [ebp - 0x24], 0x2bf042c
add dword [ebp - 0x24], 0xfd40fbd4
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x398f6
push 0
call eax
mov ecx, 0x6940ef42
add ecx, 0x96bf528a
xor esi, esi
add esi, eax
mov edx, 0x10088400
add edx, dword [ebp - 0x20]
mov ebx, 0xcecb930e
sub ebx, 0xac279e9c
sub dword [ebp - 8], edi
mov edi, dword [edx]
xor edi, ebx
xor dword [ebp - 0x14], ebx
mov dword [esi], edi
sub dword [ebp - 0xc], 0x9f2e64c2
add esi, 4
add edx, 0x175cc6ba
add edx, 0xe8a3394a
loop 0x10025d96
add eax, 0x97ab7319
add eax, 0x685586ea
mov ebx, eax
add eax, 0x48a1a6cd
sub eax, 0x48a1a6c8
mov ecx, 0xbc0f55a3
sub ecx, 0xac0f55a3
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x423290
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x24
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
mov al, byte [esp + 0x40]
mov ebx, 0xc6ef3720
mov dword [esp], 0x9f4fbbd
test al, al
mov dword [esp + 4], 0x9681884a
mov dword [esp + 8], 0x352027e9
mov dword [esp + 0xc], 0xf3dee5a7
mov dword [esp + 0x10], 0x7aa9648f
mov dword [esp + 0x14], 0x7fae6994
mov dword [esp + 0x18], 0xc0efaad5
mov dword [esp + 0x1c], 0x42712c57
je 0x4232f1
lea ecx, [esp + 0x10]
jmp 0x4232f4
lea ecx, [esp]
mov edx, 0x20
mov eax, dword [edi]
nop
lea esi, [esi]
mov esi, dword [esp + 0x3c]
mov ebp, dword [esi]
mov esi, eax
shl esi, 4
lea edi, [ebx + eax]
shr eax, 5
add esi, dword [ecx + 8]
xor esi, edi
dec edx
add eax, dword [ecx + 0xc]
xor esi, eax
sub ebp, esi
mov eax, dword [esp + 0x3c]
mov edi, ebp
shl edi, 4
mov dword [eax], ebp
mov eax, dword [esp + 0x38]
mov eax, dword [eax]
add edi, dword [ecx]
lea esi, [ebx + ebp]
xor edi, esi
shr ebp, 5
add ebx, 0x61c88647
add ebp, dword [ecx + 4]
xor edi, ebp
sub eax, edi
mov ebp, dword [esp + 0x38]
test edx, edx
mov dword [ebp], eax
jg 0x423300
add esp, 0x24
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x425320
Capabilities:
Write file on windows

Disassembly:
push esi
sub esp, 0x18
mov edx, dword [esp + 0x20]
mov eax, dword [0x573814]
test eax, eax
jne 0x425336
add esp, 0x18
pop esi
ret
mov dword [esp], edx
mov dword [esp + 4], 0x76d7e0
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
test esi, esi
je 0x4253eb
mov ecx, 1
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 4
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp + 0x14], 0
lea edx, [esp + 0x14]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], 0x573814
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], 0x7673a0
mov dword [esp + 4], 1
mov dword [esp + 8], 0x1f40
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x18
pop esi
ret
Function at 0x4275c0
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x14
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov eax, dword [esi + 4]
lea edx, [eax - 1]
cmp edx, 0x15
ja case.0x4275e5.2
mov edx, dword [edx*4 + 0x76db20]
jmp edx
mov dword [esp], ebp
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00427440
add ebp, dword [esp + 0x10]
jmp 0x4275d2
mov dword [esp], ebp
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00427440
mov ebx, eax
mov dword [esp], ebp
call fcn.00427540
mov ecx, dword [0x573954]
mov edx, dword [ecx + 0xc]
mov edi, dword [0x573940]
mov edi, dword [edi + 4]
sub edx, edi
sub edx, dword [ecx + 0xc]
add edx, ebx
add edx, dword [eax + 4]
mov dword [esi + 8], edx
add ebp, dword [esp + 0x10]
jmp 0x4277e8
mov dword [esp], ebp
call fcn.00427350
mov dword [esi + 8], eax
add ebp, 4
jmp 0x4277e8
mov dword [esp], ebp
call fcn.00427350
mov ebx, eax
mov dword [esp], ebp
call fcn.00427540
mov edx, dword [0x573954]
mov ecx, dword [edx + 0xc]
add ecx, ebx
sub ecx, dword [eax + 4]
add ebp, 4
mov dword [esi + 8], ecx
jmp 0x4277e8
mov dword [esp], ebp
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00427440
mov dword [esi + 8], eax
add ebp, dword [esp + 0x10]
jmp 0x4277e8
mov dword [esp], ebp
call fcn.00427350
mov edx, dword [0x573950]
add edx, eax
add ebp, 4
mov dword [esi + 8], edx
jmp 0x4277e8
mov dword [esp], ebp
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
call fcn.004273e0
mov dword [esi + 8], eax
add ebp, dword [esp + 0x10]
jmp 0x4277e8
mov edi, ebp
inc ebp
mov al, byte [edi]
test al, al
je 0x4276f0
mov al, 1
jmp 0x4276f2
xor al, al
mov byte [esi + 8], al
jmp 0x4277e8
mov eax, ebp
inc ebp
movzx edx, byte [eax]
mov dword [esi + 8], edx
jmp 0x4277e8
mov dword [esp], 8
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [esi + 8], eax
movzx edx, byte [ebp]
mov dword [eax], edx
lea eax, [ebp + 1]
mov ecx, dword [esi + 8]
mov dword [ecx + 4], eax
mov ebx, dword [esi + 8]
mov esi, dword [ebx]
lea ebp, [esi + ebp + 1]
jmp 0x4277e8
mov dword [esp], 8
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.00427440
mov edx, dword [esi + 8]
mov dword [edx], eax
add ebp, dword [esp + 0x10]
mov eax, dword [esi + 8]
mov dword [eax + 4], ebp
mov ecx, dword [esi + 8]
mov ebx, dword [ecx]
add ebp, ebx
jmp 0x4277e8
mov dword [esi + 8], ebp
mov edi, ebp
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x427784
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x42777c
lea ebp, [ebp + eax + 1]
jmp 0x4277e8
mov dword [esp], ebp
call fcn.00427350
mov dword [esi + 8], eax
add ebp, 4
jmp 0x4277e8
mov dword [esp], ebp
call fcn.00427380
movzx eax, ax
add ebp, 2
mov dword [esi + 8], eax
jmp 0x4277e8
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x40
mov dword [esp], edx
mov dword [esp + 4], 0x76e5c0
mov dword [esp + 8], eax
call dword [sym.imp.MSVCRT.dll_fprintf]
mov dword [esp], 0xffffffff
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x4277e8
mov dword [esp], ebp
call fcn.00427350
mov dword [esi + 8], eax
add ebp, 4
mov eax, ebp
add esp, 0x14
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x428350
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x44
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x60]
mov esi, dword [esp + 0x68]
mov edx, dword [ebp + 4]
lea ecx, [edx - 1]
cmp ecx, 0x34
ja 0x429533
mov ecx, dword [edx*4 + 0x76df9c]
jmp ecx
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x40
mov dword [esp], eax
mov dword [esp + 4], 0x76ebc0
mov dword [esp + 8], edx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov dword [esp], 0xffffffff
call dword [sym.imp.MSVCRT.dll_exit]
add esp, 0x44
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x42b110
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x14
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 4], 0
mov dword [esp + 8], 2
call dword [sym.imp.MSVCRT.dll_fseek]
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_ftell]
mov ebx, eax
mov dword [esp], ebx
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [0x57395c], eax
xor edx, edx
mov dword [esp], ebp
mov dword [esp + 4], edx
mov dword [esp + 8], edx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x57395c]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fread]
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fclose]
mov edx, dword [0x57395c]
cmp dword [edx], 0x464c457f
jne 0x42b1a7
movzx eax, word [edx + 0x12]
cmp eax, 0x28
je 0x42b1e1
mov dword [esp], 0
mov dword [esp + 4], 0x76ee60
mov dword [esp + 8], edi
call fcn.005041f0
mov eax, dword [0x57395c]
mov dword [esp], eax
call dword [sym.imp.MSVCRT.dll_free]
mov dword [0x57395c], 0
xor eax, eax
add esp, 0x14
pop ebx
pop ebp
pop esi
pop edi
ret
mov al, byte [edx + 4]
cmp al, 1
jne 0x42b1a7
mov dword [esp], edx
mov al, byte [0x562558]
mov dword [esp + 4], edx
mov dword [esp + 8], esi
mov byte [esp + 0xc], al
call fcn.0042acb0
movzx eax, al
test eax, eax
jne 0x42b22a
mov eax, dword [0x57395c]
mov dword [esp], eax
call dword [sym.imp.MSVCRT.dll_free]
mov dword [0x57395c], 0
xor eax, eax
add esp, 0x14
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, 1
add esp, 0x14
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x4ab590
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
sub esp, 0x14
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, 1
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fread]
cmp eax, 1
je 0x4ab5da
mov eax, dword [ebp + 0xc]
test al, 0x20
je 0x4ab5d2
mov eax, 0xffffffff
add esp, 0x14
pop ebx
pop ebp
ret
xor eax, eax
add esp, 0x14
pop ebx
pop ebp
ret
movzx edx, byte [esp + 0x10]
xor eax, eax
mov dword [ebx], edx
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x4ab700
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x24
mov edi, dword [esp + 0x38]
mov esi, 0xffff
xor ebp, ebp
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 2
call dword [sym.imp.MSVCRT.dll_fseek]
test eax, eax
je 0x4ab739
xor eax, eax
add esp, 0x24
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_ftell]
mov ebx, eax
cmp ebx, 0xffff
jae 0x4ab74e
mov esi, ebx
mov dword [esp], 0x404
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
je 0x4ab72f
mov edx, 4
cmp esi, 4
jbe 0x4ab826
mov dword [esp + 0x14], ebp
mov ebp, edx
mov dword [esp + 0x18], ebx
mov ebx, eax
mov dword [esp + 0x1c], esi
add ebp, 0x400
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
jae 0x4ab78d
mov ebp, ecx
mov esi, dword [esp + 0x18]
mov edi, esi
sub edi, ebp
sub esi, edi
cmp esi, 0x404
jbe 0x4ab7a4
mov esi, 0x404
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], 0
call dword [sym.imp.MSVCRT.dll_fseek]
test eax, eax
jne 0x4ab820
mov dword [esp], ebx
mov ecx, dword [esp + 0x38]
mov dword [esp + 4], esi
mov dword [esp + 8], 1
mov dword [esp + 0xc], ecx
call dword [sym.imp.MSVCRT.dll_fread]
cmp eax, 1
jne 0x4ab83d
lea ecx, [esi - 3]
add esi, 0xfffffffc
test ecx, ecx
jle 0x4ab7fd
lea esi, [esi]
cmp byte [ebx + esi], 0x50
je 0x4ab845
mov ecx, esi
dec esi
test ecx, ecx
jg 0x4ab7f0
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x4ab878
mov ecx, dword [esp + 0x1c]
cmp ebp, ecx
jb 0x4ab77d
jmp 0x4ab870
mov eax, ebx
mov ebp, dword [esp + 0x14]
test eax, eax
je 0x4ab833
mov dword [esp], eax
call dword [sym.imp.MSVCRT.dll_free]
mov eax, ebp
add esp, 0x24
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, ebx
mov ebp, dword [esp + 0x14]
jmp 0x4ab826
mov dl, byte [ebx + esi + 1]
cmp dl, 0x4b
jne 0x4ab7f6
mov dl, byte [ebx + esi + 2]
cmp dl, 5
jne 0x4ab7f6
mov dl, byte [ebx + esi + 3]
cmp dl, 6
jne 0x4ab7f6
lea ecx, [esi + edi]
mov dword [esp + 0x14], ecx
jmp 0x4ab7fd
mov eax, ebx
mov ebp, dword [esp + 0x14]
jmp 0x4ab826
mov eax, ebx
mov ebp, ecx
jmp 0x4ab826
Function at 0x4ad770
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x24
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0x76d6c0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
test ebp, ebp
je 0x4ad7b5
mov esi, dword [edi]
mov edx, dword [esp + 0x40]
mov ebx, dword [edx]
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fgetc]
cmp eax, 0x50
je 0x4ad7bd
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fgetc]
cmp eax, 0x41
jne 0x4ad7ac
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fgetc]
cmp eax, 0x54
jne 0x4ad7ac
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fgetc]
cmp eax, 0x43
jne 0x4ad7ac
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fgetc]
cmp eax, 0x48
jne 0x4ad7ac
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp], ebp
call fcn.004ad710
mov ebx, eax
cmp ebx, 0x454f46
je 0x4ad7ac
mov dword [esp], ebp
call fcn.004ad6d0
mov esi, eax
test esi, esi
je 0x4ad8c0
mov edx, 0xffffffff
mov dword [esp + 0x14], edx
lea ecx, [ebx + esi]
mov edx, dword [esp + 0x18]
cmp edx, ecx
jg 0x4ad864
mov ecx, edx
add ecx, ecx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp], edx
mov dword [esp + 4], ecx
call dword [sym.imp.MSVCRT.dll_realloc]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x3c]
mov edx, eax
mov edi, dword [esp + 0x18]
mov dword [ecx], edx
mov edx, dword [esp + 0x40]
mov dword [edx], edi
mov edx, dword [esp + 0x14]
cmp edx, 0xffffffff
je 0x4ad890
lea edx, [esi - 1]
test esi, esi
je 0x4ad7fd
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x14], cl
mov byte [ebx + esi], cl
inc ebx
dec edx
cmp edx, 0xffffffff
jne 0x4ad880
jmp 0x4ad7fd
add ebx, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], 1
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fread]
cmp eax, esi
jne 0x4ad7ac
jmp 0x4ad7fd
mov dword [esp], ebp
call fcn.004ad6d0
mov esi, eax
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fgetc]
mov dword [esp + 0x14], eax
mov edx, eax
cmp edx, 0xffffffff
je 0x4ad7ac
movzx ecx, dl
mov dword [esp + 0x14], ecx
jmp 0x4ad82a
Function at 0x4ae2d0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov dword [esp], eax
call fcn.004adaa0
movzx eax, al
test eax, eax
je 0x4ae316
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.004ade10
add esp, 0x1c
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.004adb00
movzx eax, al
test eax, eax
je 0x4ae351
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.004ae0f0
add esp, 0x1c
pop ebx
pop ebp
pop esi
pop edi
ret
mov edi, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
mov dword [esp], edx
mov dword [esp + 4], 0x76d6c0
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
test esi, esi
je 0x4ae493
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 2
call dword [sym.imp.MSVCRT.dll_fseek]
mov dword [esp], esi
call dword [sym.imp.MSVCRT.dll_ftell]
mov ebp, eax
mov dword [esp], esi
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [esp + 0x3c]
mov ebx, dword [edx]
test ebx, ebx
jne 0x4ae3bd
mov ebx, ebp
mov edx, dword [esp + 0x3c]
mov dword [edx], ebp
mov edx, dword [esp + 0x38]
test edx, edx
je 0x4ae440
cmp ebp, ebx
jg 0x4ae3cb
mov ebx, ebp
mov dword [esp], edi
mov dword [esp + 4], 1
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCRT.dll_fread]
mov dword [esp + 0x14], eax
mov dword [esp], esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov edx, dword [esp + 0x14]
cmp edx, ebx
je 0x4ae430
mov dword [esp], 0xa
mov edx, dword [esp + 0x30]
mov dword [esp + 4], 0x777200
mov dword [esp + 8], edx
call fcn.005041f0
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x4ae426
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_free]
xor eax, eax
add esp, 0x1c
pop ebx
pop ebp
pop esi
pop edi
ret
mov edx, dword [esp + 0x3c]
mov eax, edi
mov dword [edx], ebp
add esp, 0x1c
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [esp], ebx
call fcn.004addf0
mov dword [esp], eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
test edi, edi
je 0x4ae464
mov ebx, ebp
mov edx, dword [esp + 0x3c]
mov dword [edx], ebp
jmp 0x4ae3c5
mov dword [esp], 0x29
mov dword [esp + 4], 0x774b40
mov dword [esp + 8], 0x7771e0
call fcn.005041f0
mov dword [esp], esi
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x1c
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [esp], 9
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 0x774bc0
mov dword [esp + 8], eax
call fcn.005041f0
xor eax, eax
add esp, 0x1c
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x4b0aa0
Capabilities:
Write file on windows

Disassembly:
push edi
push ebp
push ebx
sub esp, 0x10
mov edi, dword [esp + 0x20]
mov bl, byte [esp + 0x24]
mov dword [esp], edi
mov dword [esp + 4], 0x76d7e0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
test ebp, ebp
je 0x4b0b1f
mov edx, dword [0x573f8c]
mov ecx, dword [0x573f9c]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
test bl, bl
je 0x4b0b0f
mov dword [esp], 0x564b18
mov dword [esp + 4], 1
mov dword [esp + 8], 0x2c
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x10
pop ebx
pop ebp
pop edi
ret
mov dword [esp], 0x10
mov dword [esp + 4], 0x774860
mov dword [esp + 8], edi
call fcn.005041f0
add esp, 0x10
pop ebx
pop ebp
pop edi
ret

Function at 0x4b0b40
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
sub esp, 0x14
mov ebp, dword [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], 0x76d7e0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
test ebx, ebx
je 0x4b0b94
mov edx, dword [0x573f8c]
mov ecx, dword [0x573f9c]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop ebx
pop ebp
ret
mov dword [esp], 0x10
mov dword [esp + 4], 0x774860
mov dword [esp + 8], ebp
call fcn.005041f0
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x4b0bc0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebp
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 4], 0x76d7e0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
test ebp, ebp
je 0x4b0c18
mov edx, dword [0x573f98]
add edx, 0xa000
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 0x100
mov dword [esp + 0xc], ebp
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop ebp
pop esi
ret
mov dword [esp], 0x10
mov dword [esp + 4], 0x774860
mov dword [esp + 8], esi
call fcn.005041f0
add esp, 0x14
pop ebp
pop esi
ret

Function at 0x4b0cd0
Capabilities:
Read file on windows

Disassembly:
push edi
push ebx
sub esp, 0x14
mov edi, dword [esp + 0x20]
mov dword [esp], edi
mov dword [esp + 4], 0x76d6c0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
test ebx, ebx
je 0x4b0d45
mov edx, dword [0x573f98]
add edx, 0xa000
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 0x100
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fread]
cmp eax, 0x100
je 0x4b0d4d
mov dword [esp], 0x11
mov dword [esp + 4], 0x777f60
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call fcn.005041f0
mov dword [esp], ebx
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x14
pop ebx
pop edi
ret
mov dword [esp], ebx
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, 1
add esp, 0x14
pop ebx
pop edi
ret
Function at 0x4b1050
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x34
mov ebp, dword [esp + 0x48]
mov dword [esp], ebp
mov dword [esp + 4], 0x76d6c0
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
test ebx, ebx
je 0x4b1236
mov dword [esp], ebx
mov dword [esp + 4], 4
mov dword [esp + 8], 0
call dword [sym.imp.MSVCRT.dll_fseek]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 0xf
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fread]
mov byte [esp + 0x1f], 0
lea edi, [esp + 0x20]
mov esi, dword [0x573f90]
add esi, 0x134
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov dword [edi], edx
mov edx, dword [esi + 8]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dx, word [esi + 0xc]
mov word [edi + 0xc], dx
mov dl, byte [esi + 0xe]
mov byte [edi + 0xe], dl
mov byte [esp + 0x2f], 0
lea esi, [esp + 0x10]
lea edi, [esp + 0x20]
mov ecx, 0xf
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4b1103
jae 0x4b1102
mov eax, 0xfffffffe
inc eax
test eax, eax
je 0x4b113e
mov dword [esp], 0x22
lea edx, [esp + 0x10]
lea ecx, [esp + 0x20]
mov dword [esp + 4], 0x7749e0
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
call fcn.005041f0
mov dword [esp], ebx
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x34
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [esp], ebx
mov dword [esp + 4], 0x13
mov dword [esp + 8], 0
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x573f90]
movzx edx, byte [edx + 0x147]
cmp edx, 3
je 0x4b11f6
cmp edx, 0xf
je 0x4b11f6
cmp edx, 0x10
je 0x4b11f6
cmp edx, 0x13
je 0x4b11f6
cmp edx, 0x1b
je 0x4b11f6
cmp edx, 0x1e
je 0x4b11f6
cmp edx, 0xff
je 0x4b11f6
cmp edx, 6
je 0x4b11a0
cmp edx, 0x22
jne 0x4b11cb
mov edx, dword [0x573f98]
add edx, 0xa000
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 0x100
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fread]
jmp 0x4b121b
mov dword [esp], 0x23
mov dword [esp + 4], 0x774a20
mov dword [esp + 8], ebp
call fcn.005041f0
mov dword [esp], ebx
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x34
pop ebx
pop ebp
pop esi
pop edi
ret
mov edx, dword [0x573f8c]
mov ecx, dword [0x573f9c]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fread]
mov dword [esp], ebx
call dword [sym.imp.MSVCRT.dll_fclose]
call fcn.004b03e0
mov eax, 1
add esp, 0x34
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [esp], 6
mov dword [esp + 4], 0x7749c0
mov dword [esp + 8], ebp
call fcn.005041f0
xor eax, eax
add esp, 0x34
pop ebx
pop ebp
pop esi
pop edi
ret