joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c2e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, eax
test edi, edi
jne 0x49c2fa
pop edi
mov eax, 4
pop ebx
add esp, 8
test ebx, ebx
je 0x49c2ef
test esi, esi
je 0x49c2ef
cmp dword [edi + 0x14], 0
je 0x49c31c
lea eax, [esp + 8]
push eax
mov eax, 2
call fcn.00469830
cmp eax, 2
jmp 0x49c341
mov ecx, dword [edi + 4]
push ecx
push 1
lea edx, [esp + 0x10]
push 2
push edx
call fcn.0052edba
add esp, 0x10
test eax, eax
jne 0x49c347
cmp dword [edi + 4], eax
jne 0x49c407
cmp dword [edi + 0xc], eax
jne 0x49c407
mov ax, word [esp + 8]
cmp ax, 0x4949
jne 0x49c357
mov byte [esi], 0
jmp 0x49c364
cmp ax, 0x4d4d
jne 0x49c407
mov byte [esi], 1
cmp dword [edi + 0x14], 0
je 0x49c37e
lea eax, [esp + 0xc]
push eax
mov eax, 2
call fcn.00469830
cmp eax, 2
jmp 0x49c39f
mov ecx, dword [edi + 4]
push ecx
push 1
lea edx, [esp + 0x14]
push 2
push edx
call fcn.0052edba
add esp, 0x10
test eax, eax
jne 0x49c3a1
cmp dword [edi + 4], eax
jne 0x49c407
cmp dword [edi + 0xc], eax
jne 0x49c407
cmp byte [esi], 0
je 0x49c3b6
mov ax, word [esp + 0xc]
rol ax, 8
movzx ecx, ax
mov dword [esp + 0xc], ecx
cmp word [esp + 0xc], 0x2a
jne 0x49c407
cmp dword [edi + 0x14], 0
je 0x49c3d4
push ebx
mov eax, 4
call fcn.00469830
cmp eax, 4
jmp 0x49c3f1
mov edx, dword [edi + 4]
push edx
push 1
push 4
push ebx
call fcn.0052edba
add esp, 0x10
test eax, eax
jne 0x49c3f3
cmp dword [edi + 4], eax
jne 0x49c407
cmp dword [edi + 0xc], eax
jne 0x49c407
cmp byte [esi], 0
je 0x49c3ff
mov ecx, ebx
call fcn.0049b570
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
mov eax, 3
pop ebx
add esp, 8
ret
Function at 0x4a48c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [esi + 4]
shr eax, 1
push edi
je 0x4a4960
mov ebx, dword [esi]
mov ecx, dword [ebx + eax*4 - 4]
mov edx, dword [ecx + 0xc]
mov cx, word [edx]
mov edx, dword [esp + 0x1c]
mov ebp, dword [edx]
mov edx, dword [ebp + 0xc]
mov dx, word [edx]
rol cx, 8
rol dx, 8
movzx edx, dx
movzx ecx, cx
movzx edi, dx
cmp cx, di
jb 0x4a4960
lea ecx, [eax - 1]
xor edi, edi
test ecx, ecx
jbe 0x4a4939
movzx eax, dx
mov dword [esp + 0x14], eax
lea eax, [ecx + edi]
shr eax, 1
mov edx, dword [ebx + eax*4]
mov edx, dword [edx + 0xc]
mov dx, word [edx]
rol dx, 8
movzx edx, dx
cmp dx, word [esp + 0x14]
jae 0x4a4933
lea edi, [eax + 1]
jmp 0x4a4935
mov ecx, eax
cmp edi, ecx
jb 0x4a4912
mov eax, dword [ebx + edi*4]
push ebp
call fcn.004a6ee0
test al, al
jge 0x4a4949
add edi, 1
mov eax, dword [esp + 0x1c]
push eax
push edi
call fcn.004a6d30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
test byte [esi + 4], 1
jne 0x4a49f9
lea edx, [eax*4]
cmp edx, 0x100000
mov ecx, eax
jae 0x4a4992
lea edx, [eax - 1]
test eax, edx
jne 0x4a499e
test eax, eax
je 0x4a498b
lea ecx, [eax + eax]
jmp 0x4a499e
mov ecx, 1
jmp 0x4a499e
and ecx, 0x7ffffc00
add ecx, 0x400
cmp ecx, eax
jbe 0x4a49d2
test ecx, ecx
je 0x4a49bd
lea eax, [ecx*4]
mov ecx, dword [esi]
push eax
push ecx
call fcn.0044d0b0
add esp, 8
mov dword [esi], eax
jmp 0x4a49d2
mov eax, dword [esi]
test eax, eax
je 0x4a49d2
push eax
call fcn.0044d390
add esp, 4
mov dword [esi], 0
mov eax, dword [esi]
test eax, eax
je 0x4a49f9
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx]
shr edx, 1
mov dword [eax + edx*4], ecx
mov eax, dword [esi + 4]
mov edx, eax
and edx, 0xfffffffe
add edx, 2
and eax, 1
xor edx, eax
mov dword [esi + 4], edx
mov eax, dword [esi + 4]
pop edi
pop esi
shr eax, 1
pop ebp
sub eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4a56f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, eax
mov edx, dword [esi + 4]
mov eax, edx
shr eax, 1
push edi
je 0x4a577d
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
mov edi, dword [edi + 0xc]
mov ebx, dword [esi]
mov ecx, dword [ebx + eax*4 - 4]
movzx ebp, word [edi]
mov ecx, dword [ecx + 0xc]
movzx ecx, word [ecx]
movzx edi, bp
cmp cx, di
jb 0x4a577d
lea ecx, [eax - 1]
xor edi, edi
test ecx, ecx
jbe 0x4a5752
movzx edx, bp
mov dword [esp + 0x14], edx
lea eax, [ecx + edi]
shr eax, 1
mov edx, dword [ebx + eax*4]
mov edx, dword [edx + 0xc]
movzx edx, word [edx]
cmp dx, word [esp + 0x14]
jae 0x4a574c
lea edi, [eax + 1]
jmp 0x4a574e
mov ecx, eax
cmp edi, ecx
jb 0x4a5732
mov eax, dword [ebx + edi*4]
mov ecx, dword [eax + 0xc]
movzx eax, word [ecx]
movzx ecx, bp
cmp ax, cx
jae 0x4a5766
add edi, 1
mov edx, dword [esp + 0x1c]
push edx
push edi
call fcn.004a6d30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
test dl, 1
jne 0x4a5815
lea edx, [eax*4]
cmp edx, 0x100000
mov ecx, eax
jae 0x4a57ae
lea edx, [eax - 1]
test eax, edx
jne 0x4a57ba
test eax, eax
je 0x4a57a7
lea ecx, [eax + eax]
jmp 0x4a57ba
mov ecx, 1
jmp 0x4a57ba
and ecx, 0x7ffffc00
add ecx, 0x400
cmp ecx, eax
jbe 0x4a57ee
test ecx, ecx
je 0x4a57d9
lea eax, [ecx*4]
mov ecx, dword [esi]
push eax
push ecx
call fcn.0044d0b0
add esp, 8
mov dword [esi], eax
jmp 0x4a57ee
mov eax, dword [esi]
test eax, eax
je 0x4a57ee
push eax
call fcn.0044d390
add esp, 4
mov dword [esi], 0
mov eax, dword [esi]
test eax, eax
je 0x4a5815
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx]
shr edx, 1
mov dword [eax + edx*4], ecx
mov eax, dword [esi + 4]
mov edx, eax
and edx, 0xfffffffe
add edx, 2
and eax, 1
xor edx, eax
mov dword [esi + 4], edx
mov eax, dword [esi + 4]
pop edi
pop esi
shr eax, 1
pop ebp
sub eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4a5b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x577830]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
mov esi, ecx
test esi, esi
push edi
jne 0x4a5b46
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005120db
add esp, 0x38
ret 4
mov ecx, dword [esi + 0xc]
cmp ecx, dword [esi + 8]
ja 0x4a5db9
mov eax, dword [esi + 4]
add eax, ecx
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x14], 0
je 0x4a5b9d
mov edx, dword [ecx + 0x1c]
cmp edx, eax
ja 0x4a5b69
mov eax, edx
mov dword [ecx + 0x18], eax
mov ecx, dword [esi + 0xc]
add ecx, 2
cmp ecx, dword [esi + 8]
ja 0x4a5db9
mov edi, dword [ebp + 0x10]
cmp dword [edi + 0x14], 0
je 0x4a5bca
lea edx, [esp + 0x14]
push edx
mov eax, 2
call fcn.00469830
cmp eax, 2
je 0x4a5bf5
jmp 0x4a5db9
push 0
push eax
mov eax, dword [ecx + 4]
push eax
call fcn.005303b8
add esp, 0xc
test eax, eax
je 0x4a5b6c
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005120db
add esp, 0x38
ret 4
mov eax, dword [edi + 4]
push eax
push 1
lea ecx, [esp + 0x1c]
push 2
push ecx
call fcn.0052edba
add esp, 0x10
test eax, eax
jne 0x4a5bf5
cmp dword [edi + 4], eax
jne 0x4a5db9
cmp dword [edi + 0xc], eax
jne 0x4a5db9
mov ax, word [esp + 0x14]
cmp ax, 0x3e8
movzx ecx, ax
lea edi, [ecx + ecx*2]
lea edi, [edi*4 + 2]
mov dword [esp + 0x1c], edi
ja 0x4a5db9
mov edx, dword [esi + 8]
cmp edi, edx
ja 0x4a5db9
mov ebx, dword [esi + 0xc]
lea eax, [ebx + edi]
cmp eax, edx
ja 0x4a5db9
test ecx, ecx
mov edx, dword [esi + 4]
mov dword [esi + 0x10], eax
lea ebx, [ebx + edx + 2]
mov dword [esp + 0x18], 0
jbe 0x4a5d01
jmp 0x4a5c50
mov edi, dword [ebp + 0x10]
cmp dword [edi + 0x14], 0
je 0x4a5c87
lea eax, [esp + 0x38]
push eax
mov eax, 0xc
call fcn.00469830
cmp eax, 0xc
je 0x4a5cc2
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.005120db
add esp, 0x38
ret 4
mov eax, dword [edi + 4]
test eax, eax
je 0x4a5ca8
push eax
push 1
lea ecx, [esp + 0x40]
push 0xc
push ecx
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4a5ca8
xor edi, edi
jmp 0x4a5cb8
cmp dword [edi + 4], 0
je 0x4a5cb5
mov edi, 2
jmp 0x4a5cb8
mov edi, dword [edi + 0xc]
test edi, edi
mov eax, edi
jne 0x4a5dbb
push ebx
lea edx, [esp + 0x3c]
push edx
mov eax, esi
mov ecx, ebp
call fcn.004a77d0
invalid
Function at 0x4a95a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x70
mov eax, dword [0x577830]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x74]
push ebx
mov ebx, dword [esp + 0x88]
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
push esi
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x1c], eax
jne 0x4a95f3
lea eax, [ebx + 4]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.005120db
add esp, 0x70
ret 0x14
mov ecx, dword [eax + 4]
cmp ecx, 4
jbe 0x4a992f
mov eax, dword [eax + 8]
mov edi, eax
mov edx, eax
shr edx, 0x10
and edi, 0xff0000
or edi, edx
mov edx, eax
and edx, 0xff00
shl eax, 0x10
or edx, eax
mov eax, dword [ebp + 8]
shr edi, 8
shl edx, 8
or edi, edx
cmp edi, eax
mov dword [esp + 0x18], edi
jae 0x4a992f
cmp ecx, eax
ja 0x4a992f
add ecx, edi
cmp ecx, eax
ja 0x4a992f
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x14]
lea esi, [esp + 0x14]
call fcn.004a9ca0
mov ecx, dword [ebp + 4]
mov eax, dword [esp + 0x20]
add ecx, edi
call fcn.004a6f10
mov esi, eax
test esi, esi
jne 0x4a9a05
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 4]
cmp eax, 0x20
mov esi, 0x20
ja 0x4a9682
mov esi, eax
mov edx, dword [esp + 0x20]
mov edi, dword [edx + 0x10]
cmp dword [edi + 0x14], 0
je 0x4a96c4
lea eax, [esp + 0x5c]
push eax
mov eax, esi
call fcn.00469830
cmp eax, esi
je 0x4a96fe
lea edi, [esp + 0x14]
mov esi, 2
invalid
Function at 0x4a9de0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
cmp dword [ebp + 4], 0x1000
push esi
push edi
jbe 0x4a9dfb
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push eax
push ecx
mov eax, ebp
call fcn.004a9cc0
xor edi, edi
cmp eax, edi
jne 0x4a9f36
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4a9e7d
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx + 0x10], eax
mov dword [ebx], vtable.ytEXIFMetadata.0
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
push edi
mov edi, dword [ebp + 4]
add edi, 8
call fcn.00469960
mov esi, eax
test esi, esi
je 0x4a9e6d
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4a9e89
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [ebp]
mov esi, dword [esp + 0x14]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov edi, dword [esi + 0x10]
mov ebp, dword [ebp + 4]
add eax, 8
cmp dword [edi + 0x14], 0
je 0x4a9eca
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4a9f0c
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4a9ee6
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4a9ee6
xor edi, edi
jmp 0x4a9ef6
cmp dword [edi + 4], 0
je 0x4a9ef3
mov edi, 2
jmp 0x4a9ef6
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4a9f0c
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [ebx + 0xc]
call fcn.0049b5a0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab6c0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14

Function at 0x4a9f40
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4a9f60
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004a9d50
xor edi, edi
cmp eax, edi
jne 0x4aa08f
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4a9fd1
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi + edi + 8]
call fcn.00469960
mov esi, eax
test esi, esi
invalid
invalid
Function at 0x4aa0a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4aa0c2
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004ab430
xor edi, edi
cmp eax, edi
jne 0x4aa1f6
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aa136
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi*4 + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4aa1eb
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aa143
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add ebp, ebp
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4aa189
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aa1cc
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aa1a5
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aa1a5
xor edi, edi
jmp 0x4aa1b5
cmp dword [edi + 4], 0
je 0x4aa1b2
mov edi, 2
jmp 0x4aa1b5
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aa1cc
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebx + 0xc]
call fcn.0049b5a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab6c0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4aa200
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
add eax, eax
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4aa224
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004ab630
xor edi, edi
cmp eax, edi
jne 0x4aa35a
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aa298
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi*8 + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4aa34f
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aa2a5
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add ebp, ebp
add ebp, ebp
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4aa2ed
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aa330
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aa309
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aa309
xor edi, edi
jmp 0x4aa319
cmp dword [edi + 4], 0
je 0x4aa316
mov edi, 2
jmp 0x4aa319
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aa330
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebx + 0xc]
call fcn.0049b5a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab6c0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4aa370
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
cmp dword [ebp + 4], 0x1000
push esi
push edi
jbe 0x4aa38b
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push eax
push ecx
mov eax, ebp
call fcn.004aab20
xor edi, edi
cmp eax, edi
jne 0x4aa4be
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aa40d
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx + 0x10], eax
mov dword [ebx], vtable.ytEXIFMetadata.0
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
push edi
mov edi, dword [ebp + 4]
add edi, 8
call fcn.00469960
mov esi, eax
test esi, esi
je 0x4aa3fd
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aa419
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [ebp]
mov esi, dword [esp + 0x14]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov edi, dword [esi + 0x10]
mov ebp, dword [ebp + 4]
add eax, 8
cmp dword [edi + 0x14], 0
je 0x4aa45a
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aa49c
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aa476
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aa476
xor edi, edi
jmp 0x4aa486
cmp dword [edi + 4], 0
je 0x4aa483
mov edi, 2
jmp 0x4aa486
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aa49c
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab6c0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x4aa4d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4aa4f0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004aa620
xor edi, edi
cmp eax, edi
jne 0x4aa617
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aa561
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi + edi + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4aa60c
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aa56e
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4aa5b2
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aa5f5
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aa5ce
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aa5ce
xor edi, edi
jmp 0x4aa5de
cmp dword [edi + 4], 0
je 0x4aa5db
mov edi, 2
jmp 0x4aa5de
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aa5f5
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab6c0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4aa690
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4aa6b2
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004aa950
xor edi, edi
cmp eax, edi
jne 0x4aa7de
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aa726
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi*4 + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4aa7d3
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aa733
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add ebp, ebp
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4aa779
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aa7bc
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aa795
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aa795
xor edi, edi
jmp 0x4aa7a5
cmp dword [edi + 4], 0
je 0x4aa7a2
mov edi, 2
jmp 0x4aa7a5
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aa7bc
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab6c0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10