joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dcfa0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
test esi, esi
push ebp
mov ebp, dword [esp + 0x10]
jne 0x4dcfb6
mov eax, 4
pop ebp
add esp, 8
ret
test ebp, ebp
je 0x4dcfac
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x4dcfcc
lea eax, [edi + 4]
pop edi
pop ebp
add esp, 8
ret
mov ecx, dword [esi + 0x14]
test ecx, ecx
push ebx
je 0x4dd01b
mov eax, dword [esi + 0x1c]
mov ebx, 2
cmp eax, ebx
jb 0x4dcfea
mov edi, dword [esi + 0x18]
lea edx, [edi + 2]
cmp edx, eax
jbe 0x4dcff3
mov edi, dword [esi + 0x18]
sub eax, edi
mov ebx, eax
je 0x4dd00f
lea eax, [edi + ecx]
push ebx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0060d1b0
add edi, ebx
add esp, 0xc
cmp ebx, 2
mov dword [esi + 0x18], edi
je 0x4dd04a
pop ebx
pop edi
mov eax, 3
pop ebp
add esp, 8
ret
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esp + 0x18]
push 2
push eax
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4dd04e
cmp dword [esi + 4], eax
jne 0x4dd00f
cmp dword [esi + 0xc], eax
je 0x4dd04e
pop ebx
pop edi
mov eax, 3
pop ebp
add esp, 8
ret
mov edi, dword [esp + 0x1c]
mov ax, word [esp + 0x10]
cmp ax, 0x4949
jne 0x4dd05e
mov byte [edi], 0
jmp 0x4dd067
cmp ax, 0x4d4d
jne 0x4dd00f
mov byte [edi], 1
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4dd133
mov eax, dword [esi + 0x1c]
mov ebx, 2
cmp eax, ebx
jb 0x4dd088
mov edi, dword [esi + 0x18]
lea edx, [edi + 2]
cmp edx, eax
jbe 0x4dd095
mov edi, dword [esi + 0x18]
sub eax, edi
mov ebx, eax
je 0x4dd00f
lea eax, [edi + ecx]
push ebx
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0060d1b0
add edi, ebx
add esp, 0xc
cmp ebx, 2
mov dword [esi + 0x18], edi
jne 0x4dd00f
mov edi, dword [esp + 0x1c]
cmp byte [edi], 0
je 0x4dd0c7
lea eax, [esp + 0xc]
call fcn.004dc400
cmp word [esp + 0xc], 0x2a
jne 0x4dd00f
mov edx, dword [esi + 0x14]
test edx, edx
je 0x4dd16e
mov eax, dword [esi + 0x1c]
mov edi, 4
cmp eax, edi
jb 0x4dd0f4
mov ecx, dword [esi + 0x18]
lea ebx, [ecx + 4]
cmp ebx, eax
jbe 0x4dd101
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4dd00f
push edi
add ecx, edx
push ecx
push ebp
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 4
jne 0x4dd00f
mov edi, dword [esp + 0x1c]
cmp byte [edi], 0
je 0x4dd12a
mov ecx, ebp
call fcn.004dc410
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esp + 0x14]
push 2
push eax
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4dd0b9
cmp dword [esi + 4], eax
jne 0x4dd00f
cmp dword [esi + 0xc], eax
je 0x4dd0b9
pop ebx
pop edi
mov eax, 3
pop ebp
add esp, 8
ret
mov ecx, dword [esi + 4]
push ecx
push 1
push 4
push ebp
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4dd11e
cmp dword [esi + 4], eax
jne 0x4dd00f
cmp dword [esi + 0xc], eax
je 0x4dd11e
pop ebx
pop edi
mov eax, 3
pop ebp
add esp, 8
ret
Function at 0x4e5e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, eax
mov edx, dword [esi + 4]
mov eax, edx
shr eax, 1
push edi
je 0x4e5ead
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
mov edi, dword [edi + 0xc]
mov ebx, dword [esi]
mov ecx, dword [ebx + eax*4 - 4]
movzx ebp, word [edi]
mov ecx, dword [ecx + 0xc]
movzx ecx, word [ecx]
movzx edi, bp
cmp cx, di
jb 0x4e5ead
lea ecx, [eax - 1]
xor edi, edi
test ecx, ecx
jbe 0x4e5e82
movzx edx, bp
mov dword [esp + 0x14], edx
lea eax, [ecx + edi]
shr eax, 1
mov edx, dword [ebx + eax*4]
mov edx, dword [edx + 0xc]
movzx edx, word [edx]
cmp dx, word [esp + 0x14]
jae 0x4e5e7c
lea edi, [eax + 1]
jmp 0x4e5e7e
mov ecx, eax
cmp edi, ecx
jb 0x4e5e62
mov eax, dword [ebx + edi*4]
mov ecx, dword [eax + 0xc]
movzx eax, word [ecx]
movzx ecx, bp
cmp ax, cx
jae 0x4e5e96
add edi, 1
mov edx, dword [esp + 0x1c]
push edx
push edi
call fcn.004e73f0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
test dl, 1
jne 0x4e5efe
lea ecx, [eax - 1]
test eax, ecx
jne 0x4e5edb
add eax, eax
jne 0x4e5ec2
mov eax, 1
lea edx, [eax*4]
mov eax, dword [esi]
push edx
push eax
call fcn.0045d790
add esp, 8
test eax, eax
mov dword [esi], eax
je 0x4e5efe
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov edx, dword [esi]
shr ecx, 1
mov dword [edx + ecx*4], eax
mov eax, dword [esi + 4]
mov ecx, eax
and ecx, 0xfffffffe
add ecx, 2
and eax, 1
xor ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
pop edi
pop esi
shr eax, 1
pop ebp
sub eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4e79d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0x135
push ebx
push ebp
push esi
push edi
jne 0x4e79f5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
mov dword [esp + 0xc], 0x135
jmp fcn.004ebe40
mov ebx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
mov edi, ecx
call fcn.004ef410
xor edx, edx
cmp eax, edx
jne 0x4e7b79
mov esi, dword [ebx + 4]
xor ebp, ebp
cmp esi, 0x7fffffff
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
ja 0x4e7a8c
cmp esi, edx
je 0x4e7a8c
lea eax, [edx + 1]
cmp esi, eax
jb 0x4e7a38
add eax, eax
cmp eax, esi
jbe 0x4e7a32
fldz
xor edi, edi
fstp dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4e7a59
mov edx, 1
shl edx, cl
cmp edx, eax
je 0x4e7a74
push eax
push 0
call fcn.0045d790
add esp, 8
test eax, eax
mov dword [esp + 0x18], eax
mov edi, eax
je 0x4e7a8c
mov ebp, eax
test edi, edi
lea ecx, [esi + esi]
mov dword [esp + 0x1c], ecx
jne 0x4e7a9b
test ebp, ebp
je 0x4e7a8c
push ebp
call fcn.0045da90
add esp, 4
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
xor ebp, ebp
cmp dword [ebx + 4], ebp
jbe 0x4e7b30
mov ebx, dword [esp + 0x18]
lea ebx, [ebx]
mov edx, dword [esp + 0x24]
mov edi, dword [edx + 0x10]
cmp dword [edi + 0x14], 0
je 0x4e7aee
mov eax, 1
call fcn.00410220
cmp eax, 1
je 0x4e7b21
mov esi, 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e7ae2
push eax
call fcn.0045da90
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x4e7b0b
push eax
push 1
push 1
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4e7b0b
xor edi, edi
jmp 0x4e7b1b
cmp dword [edi + 4], 0
je 0x4e7b18
mov edi, 2
jmp 0x4e7b1b
mov edi, dword [edi + 0xc]
test edi, edi
mov esi, edi
jne 0x4e7ad1
mov eax, dword [esp + 0x28]
add ebp, 1
add ebx, 1
cmp ebp, dword [eax + 4]
jb 0x4e7ab0
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x14]
mov esi, dword [eax]
mov edi, dword [esp + 0x2c]
call fcn.004dabf0
test al, al
jne 0x4e7b66
test dword [esp + 0x1c], 0xfffffffe
je 0x4e7b66
lea edx, [esp + 0x18]
push edx
push edi
push esi
call fcn.004ee590
mov esi, eax
test esi, esi
jne 0x4e7ad1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e7b77
push eax
call fcn.0045da90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4e7f40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0x135
push ebx
push ebp
push esi
push edi
jne 0x4e7f65
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
mov dword [esp + 0xc], 0x135
jmp fcn.004eba70
mov ebx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
mov esi, ecx
call fcn.004efb00
xor edx, edx
cmp eax, edx
jne 0x4e80e9
mov esi, dword [ebx + 4]
xor ebp, ebp
cmp esi, 0x7fffffff
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
ja 0x4e7ffc
cmp esi, edx
je 0x4e7ffc
lea eax, [edx + 1]
cmp esi, eax
jb 0x4e7fa8
add eax, eax
cmp eax, esi
jbe 0x4e7fa2
fldz
xor edi, edi
fstp dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4e7fc9
mov edx, 1
shl edx, cl
cmp edx, eax
je 0x4e7fe4
push eax
push 0
call fcn.0045d790
add esp, 8
test eax, eax
mov dword [esp + 0x18], eax
mov edi, eax
je 0x4e7ffc
mov ebp, eax
test edi, edi
lea ecx, [esi + esi]
mov dword [esp + 0x1c], ecx
jne 0x4e800b
test ebp, ebp
je 0x4e7ffc
push ebp
call fcn.0045da90
add esp, 4
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
xor ebp, ebp
cmp dword [ebx + 4], ebp
jbe 0x4e80a0
mov ebx, dword [esp + 0x18]
lea ebx, [ebx]
mov edx, dword [esp + 0x24]
mov edi, dword [edx + 0x10]
cmp dword [edi + 0x14], 0
je 0x4e805e
mov eax, 1
call fcn.00410220
cmp eax, 1
je 0x4e8091
mov esi, 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e8052
push eax
call fcn.0045da90
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x4e807b
push eax
push 1
push 1
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4e807b
xor edi, edi
jmp 0x4e808b
cmp dword [edi + 4], 0
je 0x4e8088
mov edi, 2
jmp 0x4e808b
mov edi, dword [edi + 0xc]
test edi, edi
mov esi, edi
jne 0x4e8041
mov eax, dword [esp + 0x28]
add ebp, 1
add ebx, 1
cmp ebp, dword [eax + 4]
jb 0x4e8020
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x14]
mov esi, dword [eax]
mov edi, dword [esp + 0x2c]
call fcn.004dabf0
test al, al
jne 0x4e80d6
test dword [esp + 0x1c], 0xfffffffe
je 0x4e80d6
lea edx, [esp + 0x18]
push edx
push edi
push esi
call fcn.004ee590
mov esi, eax
test esi, esi
jne 0x4e8041
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e80e7
push eax
call fcn.0045da90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4e8100
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0x135
push ebx
push ebp
push esi
push edi
jne 0x4e8125
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
mov dword [esp + 0xc], 0x135
jmp 0x4ebbb0
mov ebx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
mov esi, ecx
call fcn.004efb70
xor edx, edx
cmp eax, edx
jne 0x4e82a9
mov esi, dword [ebx + 4]
xor ebp, ebp
cmp esi, 0x3fffffff
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
ja 0x4e81bf
cmp esi, edx
je 0x4e81bf
lea eax, [edx + 1]
cmp esi, eax
jb 0x4e8168
add eax, eax
cmp eax, esi
jbe 0x4e8162
fldz
xor edi, edi
fstp dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4e8189
mov edx, 1
shl edx, cl
cmp edx, eax
je 0x4e81a7
lea ecx, [eax + eax]
push ecx
push 0
call fcn.0045d790
add esp, 8
test eax, eax
mov dword [esp + 0x18], eax
mov edi, eax
je 0x4e81bf
mov ebp, eax
test edi, edi
lea edx, [esi + esi]
mov dword [esp + 0x1c], edx
jne 0x4e81ce
test ebp, ebp
je 0x4e81bf
push ebp
call fcn.0045da90
add esp, 4
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
xor ebp, ebp
cmp dword [ebx + 4], ebp
jbe 0x4e8260
mov ebx, dword [esp + 0x18]
lea ecx, [ecx]
mov eax, dword [esp + 0x24]
mov edi, dword [eax + 0x10]
cmp dword [edi + 0x14], 0
je 0x4e821e
mov eax, 2
call fcn.00410220
cmp eax, 2
je 0x4e8251
mov esi, 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e8212
push eax
call fcn.0045da90
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x4e823b
push eax
push 1
push 2
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4e823b
xor edi, edi
jmp 0x4e824b
cmp dword [edi + 4], 0
je 0x4e8248
mov edi, 2
jmp 0x4e824b
mov edi, dword [edi + 0xc]
test edi, edi
mov esi, edi
jne 0x4e8201
mov ecx, dword [esp + 0x28]
add ebp, 1
add ebx, 2
cmp ebp, dword [ecx + 4]
jb 0x4e81e0
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 0x14]
mov esi, dword [eax]
mov edi, dword [esp + 0x2c]
call fcn.004dabf0
test al, al
jne 0x4e8296
test dword [esp + 0x1c], 0xfffffffe
je 0x4e8296
lea eax, [esp + 0x18]
push eax
push edi
push esi
call fcn.004ee810
mov esi, eax
test esi, esi
jne 0x4e8201
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e82a7
push eax
call fcn.0045da90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4e8480
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0x135
push ebx
push ebp
push esi
push edi
jne 0x4e84a5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
mov dword [esp + 0xc], 0x135
jmp 0x4ebcf0
mov edi, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, edi
mov esi, ecx
call fcn.004eb8c0
xor edx, edx
cmp eax, edx
jne 0x4e8662
mov ebp, dword [edi + 4]
xor ebx, ebx
cmp ebp, 0xfffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
ja 0x4e8577
cmp ebp, edx
je 0x4e8577
lea esi, [edx + 1]
cmp ebp, esi
jb 0x4e84f6
lea ebx, [ebx]
add esi, esi
cmp esi, ebp
jbe 0x4e84f0
fldz
fstp dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4e8517
mov eax, 1
shl eax, cl
jmp 0x4e8519
xor eax, eax
cmp eax, esi
je 0x4e8562
xor eax, eax
test esi, esi
je 0x4e8556
xor ecx, ecx
mov eax, esi
mov edx, 8
mul edx
seto cl
neg ecx
or eax, ecx
call fcn.00457920
mov edi, eax
test edi, edi
je 0x4e8577
push 8
mov ebx, 0x4e73e0
mov eax, esi
mov ecx, edi
call fcn.00401380
mov eax, edi
mov edi, dword [esp + 0x28]
test eax, eax
mov dword [esp + 0x18], eax
mov edx, eax
je 0x4e8577
mov ebx, eax
add ebp, ebp
test edx, edx
mov dword [esp + 0x1c], ebp
jne 0x4e8586
test ebx, ebx
je 0x4e8577
mov eax, ebx
call fcn.00457930
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
xor esi, esi
cmp dword [edi + 4], esi
jbe 0x4e860a
lea ecx, [ecx]
mov eax, dword [esp + 0x24]
mov edi, dword [eax + 0x10]
cmp dword [edi + 0x14], 0
je 0x4e85ca
mov eax, 8
call fcn.00410220
cmp eax, 8
je 0x4e85fb
mov edi, 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e85be
call fcn.00457930
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x4e85e7
push eax
push 1
push 8
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4e85e7
xor edi, edi
jmp 0x4e85f7
cmp dword [edi + 4], 0
je 0x4e85f4
mov edi, 2
jmp 0x4e85f7
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4e85b1
mov ecx, dword [esp + 0x28]
add esi, 1
add ebx, 8
cmp esi, dword [ecx + 4]
jb 0x4e8590
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 0x14]
mov esi, dword [eax]
mov edi, dword [esp + 0x2c]
call fcn.004dabf0
test al, al
jne 0x4e8653
test ebp, 0xfffffffe
je 0x4e8653
lea eax, [esp + 0x18]
push eax
push edi
push esi
call fcn.004eed10
mov esi, eax
test esi, esi
je 0x4e8653
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e8647
call fcn.00457930
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e8660
call fcn.00457930
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4e8fb0
Capabilities:
Read file on windows

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x135
push ebx
push ebp
push esi
push edi
mov ebx, edx
jne 0x4e8fd9
mov edx, dword [esp + 0x18]
push 0x135
push ebx
push edx
call fcn.004eba70
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push eax
mov eax, dword [esp + 0x1c]
push eax
mov eax, ebx
mov esi, ecx
call fcn.004efb00
test eax, eax
jne 0x4e90da
mov eax, 0x10
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4e906c
call fcn.00495bc0
lea ebp, [esi + 8]
xor edi, edi
mov eax, ebp
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebx + 4]
push edi
mov ecx, ebp
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4e90cf
mov edx, dword [esp + 0x18]
mov edi, dword [edx + 0x10]
cmp dword [edi + 0x14], eax
mov ecx, dword [esi + 0xc]
mov ebp, dword [ebx + 4]
je 0x4e9079
mov eax, ebp
mov ebx, ecx
call fcn.00410220
cmp eax, ebp
je 0x4e90bc
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [edi + 4]
test eax, eax
je 0x4e9095
push eax
push 1
push ebp
push ecx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4e9095
xor edi, edi
jmp 0x4e90a5
cmp dword [edi + 4], 0
je 0x4e90a2
mov edi, 2
jmp 0x4e90a5
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4e90bc
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov ecx, dword [esp + 0x1c]
push esi
call fcn.004eb5a0
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4e90f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0x135
push ebx
push ebp
push esi
push edi
jne 0x4e9115
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
mov dword [esp + 0xc], 0x135
jmp fcn.004eba70
mov ebx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
mov esi, ecx
call fcn.004efb00
xor edx, edx
cmp eax, edx
jne 0x4e9299
mov esi, dword [ebx + 4]
xor ebp, ebp
cmp esi, 0x7fffffff
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
ja 0x4e91ac
cmp esi, edx
je 0x4e91ac
lea eax, [edx + 1]
cmp esi, eax
jb 0x4e9158
add eax, eax
cmp eax, esi
jbe 0x4e9152
fldz
xor edi, edi
fstp dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4e9179
mov edx, 1
shl edx, cl
cmp edx, eax
je 0x4e9194
push eax
push 0
call fcn.0045d790
add esp, 8
test eax, eax
mov dword [esp + 0x18], eax
mov edi, eax
je 0x4e91ac
mov ebp, eax
test edi, edi
lea ecx, [esi + esi]
mov dword [esp + 0x1c], ecx
jne 0x4e91bb
test ebp, ebp
je 0x4e91ac
push ebp
call fcn.0045da90
add esp, 4
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
xor ebp, ebp
cmp dword [ebx + 4], ebp
jbe 0x4e9250
mov ebx, dword [esp + 0x18]
lea ebx, [ebx]
mov edx, dword [esp + 0x24]
mov edi, dword [edx + 0x10]
cmp dword [edi + 0x14], 0
je 0x4e920e
mov eax, 1
call fcn.00410220
cmp eax, 1
je 0x4e9241
mov esi, 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e9202
push eax
call fcn.0045da90
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x4e922b
push eax
push 1
push 1
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4e922b
xor edi, edi
jmp 0x4e923b
cmp dword [edi + 4], 0
je 0x4e9238
mov edi, 2
jmp 0x4e923b
mov edi, dword [edi + 0xc]
test edi, edi
mov esi, edi
jne 0x4e91f1
mov eax, dword [esp + 0x28]
add ebp, 1
add ebx, 1
cmp ebp, dword [eax + 4]
jb 0x4e91d0
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x14]
mov esi, dword [eax]
mov edi, dword [esp + 0x2c]
call fcn.004dabf0
test al, al
jne 0x4e9286
test dword [esp + 0x1c], 0xfffffffe
je 0x4e9286
lea edx, [esp + 0x18]
push edx
push edi
push esi
call fcn.004ee090
mov esi, eax
test esi, esi
jne 0x4e91f1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e9297
push eax
call fcn.0045da90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4e9b40
Capabilities:
Read file on windows

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x135
push ebx
push ebp
push esi
push edi
mov ebx, edx
jne 0x4e9b69
mov edx, dword [esp + 0x18]
push 0x135
push ebx
push edx
call fcn.004ebe40
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push eax
mov eax, dword [esp + 0x1c]
push eax
mov eax, ebx
mov edi, ecx
call fcn.004ef410
test eax, eax
jne 0x4e9c6a
mov eax, 0x10
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4e9bfc
call fcn.00495bc0
lea ebp, [esi + 8]
xor edi, edi
mov eax, ebp
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebx + 4]
push edi
mov ecx, ebp
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4e9c5f
mov edx, dword [esp + 0x18]
mov edi, dword [edx + 0x10]
cmp dword [edi + 0x14], eax
mov ecx, dword [esi + 0xc]
mov ebp, dword [ebx + 4]
je 0x4e9c09
mov eax, ebp
mov ebx, ecx
call fcn.00410220
cmp eax, ebp
je 0x4e9c4c
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [edi + 4]
test eax, eax
je 0x4e9c25
push eax
push 1
push ebp
push ecx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4e9c25
xor edi, edi
jmp 0x4e9c35
cmp dword [edi + 4], 0
je 0x4e9c32
mov edi, 2
jmp 0x4e9c35
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4e9c4c
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x14]
mov ecx, dword [esp + 0x1c]
push esi
call fcn.004eb5a0
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4e9c80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0x135
push ebx
push ebp
push esi
push edi
jne 0x4e9ca5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
mov dword [esp + 0xc], 0x135
jmp fcn.004ebe40
mov ebx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
mov edi, ecx
call fcn.004ef410
xor edx, edx
cmp eax, edx
jne 0x4e9e29
mov esi, dword [ebx + 4]
xor ebp, ebp
cmp esi, 0x7fffffff
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
ja 0x4e9d3c
cmp esi, edx
je 0x4e9d3c
lea eax, [edx + 1]
cmp esi, eax
jb 0x4e9ce8
add eax, eax
cmp eax, esi
jbe 0x4e9ce2
fldz
xor edi, edi
fstp dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4e9d09
mov edx, 1
shl edx, cl
cmp edx, eax
je 0x4e9d24
push eax
push 0
call fcn.0045d790
add esp, 8
test eax, eax
mov dword [esp + 0x18], eax
mov edi, eax
je 0x4e9d3c
mov ebp, eax
test edi, edi
lea ecx, [esi + esi]
mov dword [esp + 0x1c], ecx
jne 0x4e9d4b
test ebp, ebp
je 0x4e9d3c
push ebp
call fcn.0045da90
add esp, 4
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
xor ebp, ebp
cmp dword [ebx + 4], ebp
jbe 0x4e9de0
mov ebx, dword [esp + 0x18]
lea ebx, [ebx]
mov edx, dword [esp + 0x24]
mov edi, dword [edx + 0x10]
cmp dword [edi + 0x14], 0
je 0x4e9d9e
mov eax, 1
call fcn.00410220
cmp eax, 1
je 0x4e9dd1
mov esi, 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e9d92
push eax
call fcn.0045da90
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x4e9dbb
push eax
push 1
push 1
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4e9dbb
xor edi, edi
jmp 0x4e9dcb
cmp dword [edi + 4], 0
je 0x4e9dc8
mov edi, 2
jmp 0x4e9dcb
mov edi, dword [edi + 0xc]
test edi, edi
mov esi, edi
jne 0x4e9d81
mov eax, dword [esp + 0x28]
add ebp, 1
add ebx, 1
cmp ebp, dword [eax + 4]
jb 0x4e9d60
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x14]
mov esi, dword [eax]
mov edi, dword [esp + 0x2c]
call fcn.004dabf0
test al, al
jne 0x4e9e16
test dword [esp + 0x1c], 0xfffffffe
je 0x4e9e16
lea edx, [esp + 0x18]
push edx
push edi
push esi
call fcn.004ee090
mov esi, eax
test esi, esi
jne 0x4e9d81
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e9e27
push eax
call fcn.0045da90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc