joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6374b0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x6374c2
jmp dword [eax*4 + 0x6376b8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x63759f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x6376a0
cmp esi, 0xffffffff
jne 0x6375b6
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x6375c6
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x6375eb
mov al, byte [ecx - 1]
test al, al
je 0x6375eb
cmp al, 0xff
je 0x6375eb
test esi, esi
jne 0x63760f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x637639
test esi, esi
jne 0x6375fa
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x637639
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x637606
cmp eax, esi
jae 0x637617
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x637668
mov al, byte [eax - 1]
test al, al
je 0x637658
cmp al, 0xff
je 0x637658
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x637663
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x63766d
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x637695
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x637690
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x637930
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x637942
jmp dword [eax*4 + 0x637b38]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x637a1f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x637b20
cmp esi, 0xffffffff
jne 0x637a36
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x637a46
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x637a6b
mov al, byte [ecx - 1]
test al, al
je 0x637a6b
cmp al, 0xff
je 0x637a6b
test esi, esi
jne 0x637a8f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x637ab9
test esi, esi
jne 0x637a7a
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x637ab9
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x637a86
cmp eax, esi
jae 0x637a97
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x637ae8
mov al, byte [eax - 1]
test al, al
je 0x637ad8
cmp al, 0xff
je 0x637ad8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x637ae3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x637aed
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x637b15
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x637b10
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x637db0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x637dc2
jmp dword [eax*4 + 0x637fb8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x637e9f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x637fa0
cmp esi, 0xffffffff
jne 0x637eb6
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x637ec6
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x637eeb
mov al, byte [ecx - 1]
test al, al
je 0x637eeb
cmp al, 0xff
je 0x637eeb
test esi, esi
jne 0x637f0f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x637f39
test esi, esi
jne 0x637efa
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x637f39
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x637f06
cmp eax, esi
jae 0x637f17
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x637f68
mov al, byte [eax - 1]
test al, al
je 0x637f58
cmp al, 0xff
je 0x637f58
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x637f63
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x637f6d
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x637f95
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x637f90
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x638230
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x638242
jmp dword [eax*4 + 0x638438]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x63831f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x638420
cmp esi, 0xffffffff
jne 0x638336
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x638346
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x63836b
mov al, byte [ecx - 1]
test al, al
je 0x63836b
cmp al, 0xff
je 0x63836b
test esi, esi
jne 0x63838f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x6383b9
test esi, esi
jne 0x63837a
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x6383b9
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x638386
cmp eax, esi
jae 0x638397
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x6383e8
mov al, byte [eax - 1]
test al, al
je 0x6383d8
cmp al, 0xff
je 0x6383d8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x6383e3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x6383ed
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x638415
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x638410
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x6386b0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x6386c2
jmp dword [eax*4 + 0x6388b8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x63879f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x6388a0
cmp esi, 0xffffffff
jne 0x6387b6
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x6387c6
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x6387eb
mov al, byte [ecx - 1]
test al, al
je 0x6387eb
cmp al, 0xff
je 0x6387eb
test esi, esi
jne 0x63880f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x638839
test esi, esi
jne 0x6387fa
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x638839
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x638806
cmp eax, esi
jae 0x638817
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x638868
mov al, byte [eax - 1]
test al, al
je 0x638858
cmp al, 0xff
je 0x638858
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x638863
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x63886d
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x638895
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x638890
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x638b30
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x638b42
jmp dword [eax*4 + 0x638d38]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x638c1f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x638d20
cmp esi, 0xffffffff
jne 0x638c36
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x638c46
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x638c6b
mov al, byte [ecx - 1]
test al, al
je 0x638c6b
cmp al, 0xff
je 0x638c6b
test esi, esi
jne 0x638c8f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x638cb9
test esi, esi
jne 0x638c7a
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x638cb9
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x638c86
cmp eax, esi
jae 0x638c97
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x638ce8
mov al, byte [eax - 1]
test al, al
je 0x638cd8
cmp al, 0xff
je 0x638cd8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x638ce3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x638ced
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x638d15
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x638d10
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x638fb0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x638fc2
jmp dword [eax*4 + 0x6391b8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x63909f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x6391a0
cmp esi, 0xffffffff
jne 0x6390b6
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x6390c6
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x6390eb
mov al, byte [ecx - 1]
test al, al
je 0x6390eb
cmp al, 0xff
je 0x6390eb
test esi, esi
jne 0x63910f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x639139
test esi, esi
jne 0x6390fa
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x639139
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x639106
cmp eax, esi
jae 0x639117
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x639168
mov al, byte [eax - 1]
test al, al
je 0x639158
cmp al, 0xff
je 0x639158
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x639163
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x63916d
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x639195
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x639190
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc