joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b600
Capabilities:
Terminate process

Disassembly:
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0044c110
call fcn.00439dc0
push str.ERRGPF
call fcn.004371f0
add esp, 0x14
test eax, eax
je 0x44b63f
mov dword [0], 0
mov dword [0xfffffffc], 0
push 1
call fcn.004a759c
int3

Function at 0x44ea70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
mov ebp, 0x108
mov eax, edi
xor ebx, ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
cmp esi, ebp
jbe 0x44eabd
lea eax, [esi + esi]
mov ebp, esi
push eax
call fcn.004340b0
add esp, 4
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
xor ecx, ecx
test esi, esi
push 0
setne cl
push ecx
call fcn.00450740
add esp, 8
cmp esi, 2
jb 0x44eafc
cmp esi, ebp
jae 0x44eafc
cmp word [edi + 2], 0x3a
jne 0x44eafc
movzx eax, word [edi]
mov edx, eax
add eax, 0xffffff9f
cmp ax, 0x19
lea ecx, [edx - 0x20]
cmova ecx, edx
xor ebx, ebx
lea eax, [ecx - 0x41]
cmp eax, 0x19
cmovbe ebx, eax
lea eax, [esp + 0x10]
cmp edi, eax
je 0x44eb0d
push edi
call fcn.00434080
add esp, 4
mov ecx, dword [esp + 0x220]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a209e
add esp, 0x214
ret

Function at 0x44eb30
Capabilities:
Set current directory

Disassembly:
sub esp, 0xc
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
test eax, eax
js 0x44eb8c
cmp eax, 0x19
jg 0x44eb8c
push esi
push edi
add eax, 0x41
mov dword [esp + 0xa], 0x3a
push 1
mov word [esp + 0xc], ax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
push edi
sbb esi, esi
neg esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
push esi
call fcn.00450740
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004a209e
add esp, 0xc
ret

Function at 0x44eba0
Capabilities:
Set current directory

Disassembly:
sub esp, 0x10
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
call fcn.00433dc0
call fcn.0044ea70
mov ebp, dword [esp + 0x20]
mov ebx, eax
mov dword [esp + 0xc], ebx
test ebp, ebp
js 0x44ec0f
cmp ebp, 0x19
jg 0x44ec0f
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [ebp + 0x41]
push edi
push 1
mov word [esp + 0x18], cx
mov dword [esp + 0x1a], 0x3a
call ebx
mov edi, eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
push edi
sbb esi, esi
neg esi
call ebx
push 0
push esi
call fcn.00450740
mov ebx, dword [esp + 0x18]
add esp, 8
pop edi
call fcn.0044ea70
cmp ebp, eax
jne 0x44ec1c
xor esi, esi
jmp 0x44ec28
push ebx
call fcn.0044eb30
add esp, 4
or esi, 0xffffffff
push esi
call fcn.00450720
add esp, 4
call fcn.00432080
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a209e
add esp, 0x10
ret
Function at 0x44ed50
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
mov dword [esp + 0xc], ebp
mov byte [ebx], 0
push esi
push edi
test ebp, ebp
jle 0x44ed99
call fcn.00433dc0
call fcn.0044ea70
push 0
mov esi, eax
call fcn.00450720
add esp, 4
call fcn.00432080
lea eax, [esi + 1]
mov dword [esp + 0x14], eax
cmp ebp, eax
je 0x44ed99
lea eax, [ebp - 1]
push eax
call fcn.0044eba0
add esp, 4
call fcn.00433dc0
mov esi, dword [esp + 0x1c]
add esi, esi
push esi
call fcn.004340b0
add esp, 4
mov edi, eax
xor eax, eax
push eax
push edi
push dword [esp + 0x24]
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
xor eax, eax
mov word [esi + edi - 2], ax
mov eax, dword [esp + 0x24]
dec eax
push eax
push ebx
push edi
call fcn.0042a4f0
push edi
call fcn.00434080
add esp, 0x18
call fcn.00432080
call fcn.00450710
mov esi, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
cmp ebp, eax
je 0x44ee13
lea ecx, [eax - 1]
push ecx
call fcn.0044eba0
push esi
call fcn.00450720
add esp, 8
mov eax, dword [esp + 0x1c]
mov byte [ebx + eax - 1], 0
test esi, esi
jne 0x44ee9d
mov cl, byte [ebx]
test cl, cl
je 0x44ee9d
mov esi, ebx
lea edx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x44ee30
sub esi, edx
mov edi, ebx
cmp byte [ebx + 1], 0x3a
jne 0x44ee4a
mov cl, byte [ebx + 2]
lea edi, [ebx + 2]
sub esi, 2
movzx eax, cl
push eax
push 0x4bbce4
call fcn.004a3300
add esp, 8
test eax, eax
je 0x44ee61
inc edi
dec esi
test esi, esi
je 0x44ee90
movzx eax, byte [edi + esi - 1]
push eax
push 0x4bbce4
call fcn.004a3300
add esp, 8
test eax, eax
je 0x44ee7d
dec esi
test esi, esi
je 0x44ee90
cmp ebx, edi
je 0x44ee90
push esi
push edi
push ebx
call fcn.004a3a60
add esp, 0xc
mov eax, dword [esp + 0x18]
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x44eeb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x4d36a4]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
lea edi, [esp + 0x10]
mov ebp, 0x108
mov eax, edi
xor ebx, ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
cmp esi, ebp
jbe 0x44ef02
lea eax, [esi + esi]
mov ebp, esi
push eax
call fcn.004340b0
add esp, 4
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
xor ecx, ecx
test esi, esi
push 0
setne cl
push ecx
call fcn.00450740
add esp, 8
cmp esi, 2
jb 0x44ef41
cmp esi, ebp
jae 0x44ef41
cmp word [edi + 2], 0x3a
jne 0x44ef41
movzx eax, word [edi]
mov edx, eax
add eax, 0xffffff9f
cmp ax, 0x19
lea ecx, [edx - 0x20]
cmova ecx, edx
xor ebx, ebx
lea eax, [ecx - 0x41]
cmp eax, 0x19
cmovbe ebx, eax
lea eax, [esp + 0x10]
cmp edi, eax
je 0x44ef52
push edi
call fcn.00434080
add esp, 4
push 0
call fcn.00450720
add esp, 4
call fcn.00432080
mov ecx, dword [esp + 0x220]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a209e
add esp, 0x214
ret
Function at 0x44ef80
Capabilities:
Delete file

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0044fa00
add esp, 4
mov edi, eax
call fcn.00433dc0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00450740
add esp, 8
call fcn.00432080
test edi, edi
je 0x44efbf
push edi
call fcn.00434080
add esp, 4
pop edi
mov eax, esi
pop esi
ret

Function at 0x44f3e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call fcn.00433dc0
mov ebx, dword [esp + 0x14]
xor esi, esi
push dword [esp + 0x10]
mov dword [ebx], 0
call fcn.0044fa00
add esp, 4
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44f41e
push eax
call fcn.00465290
add esp, 4
mov dword [ebx], eax
mov esi, 1
push 0
push esi
call fcn.00450740
add esp, 8
test edi, edi
je 0x44f436
push edi
call fcn.00434080
add esp, 4
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x44f710
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x44f726
jmp dword [ecx*4 + 0x44f7a0]
xor eax, eax
jmp case.default.0x44f726
push 0xfffffffffffffff6
jmp 0x44f73b
push 0xfffffffffffffff5
jmp 0x44f73b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push edi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44f764
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44f764
xor esi, esi
jmp 0x44f769
mov esi, 1
push 0
push esi
call fcn.00450740
add esp, 8
test esi, esi
je 0x44f786
mov edx, dword [esp + 8]
xor eax, eax
or eax, edi
pop edi
pop esi
add esp, 8
ret
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret

Function at 0x44f9b0
Capabilities:
Create directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0044fa00
add esp, 4
mov edi, eax
call fcn.00433dc0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00450740
add esp, 8
call fcn.00432080
test edi, edi
je 0x44f9f1
push edi
call fcn.00434080
add esp, 4
pop edi
mov eax, esi
pop esi
ret
Function at 0x44fdf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x44fe71
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44fe3a
jmp dword [edi*4 + 0x44ff2c]
xor esi, esi
jmp case.default.0x44fe3a
push 0xfffffffffffffff6
jmp 0x44fe4f
push 0xfffffffffffffff5
jmp 0x44fe4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x44ff03
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44fe7a
jmp dword [edi*4 + 0x44ff3c]
xor eax, eax
jmp 0x44fea5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44fee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44fee0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x44fe41
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x44fe71
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44fe3a
jmp dword [edi*4 + 0x44ff2c]
xor esi, esi
jmp case.default.0x44fe3a
push 0xfffffffffffffff6
jmp 0x44fe4f
push 0xfffffffffffffff5
jmp 0x44fe4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x44ff03
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44fe7a
jmp dword [edi*4 + 0x44ff3c]
xor eax, eax
jmp 0x44fea5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44fee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44fee0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x44fe45
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x44fe71
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44fe3a
jmp dword [edi*4 + 0x44ff2c]
xor esi, esi
jmp case.default.0x44fe3a
push 0xfffffffffffffff6
jmp 0x44fe4f
push 0xfffffffffffffff5
jmp 0x44fe4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x44ff03
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44fe7a
jmp dword [edi*4 + 0x44ff3c]
xor eax, eax
jmp 0x44fea5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44fee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44fee0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x44fe49
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x44fe71
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44fe3a
jmp dword [edi*4 + 0x44ff2c]
xor esi, esi
jmp case.default.0x44fe3a
push 0xfffffffffffffff6
jmp 0x44fe4f
push 0xfffffffffffffff5
jmp 0x44fe4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x44ff03
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44fe7a
jmp dword [edi*4 + 0x44ff3c]
xor eax, eax
jmp 0x44fea5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44fee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44fee0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x44fe4d
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x44fe71
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44fe3a
jmp dword [edi*4 + 0x44ff2c]
xor esi, esi
jmp case.default.0x44fe3a
push 0xfffffffffffffff6
jmp 0x44fe4f
push 0xfffffffffffffff5
jmp 0x44fe4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x44ff03
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44fe7a
jmp dword [edi*4 + 0x44ff3c]
xor eax, eax
jmp 0x44fea5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44fee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44fee0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x44fe81
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x44fe71
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44fe3a
jmp dword [edi*4 + 0x44ff2c]
xor esi, esi
jmp case.default.0x44fe3a
push 0xfffffffffffffff6
jmp 0x44fe4f
push 0xfffffffffffffff5
jmp 0x44fe4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x44ff03
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44fe7a
jmp dword [edi*4 + 0x44ff3c]
xor eax, eax
jmp 0x44fea5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44fee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44fee0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x44fe85
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x44fe71
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44fe3a
jmp dword [edi*4 + 0x44ff2c]
xor esi, esi
jmp case.default.0x44fe3a
push 0xfffffffffffffff6
jmp 0x44fe4f
push 0xfffffffffffffff5
jmp 0x44fe4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x44ff03
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44fe7a
jmp dword [edi*4 + 0x44ff3c]
xor eax, eax
jmp 0x44fea5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44fee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44fee0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x44fe8f
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.00433dc0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.00464190
test eax, eax
je 0x44fe71
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x44fe3a
jmp dword [edi*4 + 0x44ff2c]
xor esi, esi
jmp case.default.0x44fe3a
push 0xfffffffffffffff6
jmp 0x44fe4f
push 0xfffffffffffffff5
jmp 0x44fe4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x44ff03
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x44fe7a
jmp dword [edi*4 + 0x44ff3c]
xor eax, eax
jmp 0x44fea5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x44fea5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44fee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44fee0
push 0
push 0
call fcn.00450740
add esp, 8
xor esi, esi
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.0044ea20
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00450740
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.00432080
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret