joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452643
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x4c32e4
call fcn.00483c30
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
fldz
xor edi, edi
lea eax, [esi + 0x8c]
fstp qword [esi + 4]
fldz
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
fstp qword [esi + 0x10]
fldz
mov dword [esi + 0x24], edi
push edi
fstp qword [esi + 0x1c]
fldz
mov dword [esi + 0x30], edi
push edi
fstp qword [esi + 0x28]
fldz
mov dword [esi + 0x3c], edi
push edi
fstp qword [esi + 0x34]
fldz
mov dword [esi + 0x48], edi
push 1
fstp qword [esi + 0x40]
fldz
mov dword [esi + 0x54], edi
pop ebx
fstp qword [esi + 0x4c]
fldz
mov dword [esi + 0x60], edi
push ebx
fstp qword [esi + 0x58]
fldz
mov dword [esi + 0x6c], edi
push ebx
fstp qword [esi + 0x64]
fldz
mov dword [esi + 0x78], edi
push 0x64
fstp qword [esi + 0x70]
fldz
mov dword [eax + 8], edi
lea ecx, [ebp - 0x1c]
fstp qword [eax]
lea eax, [esi + 0xa0]
mov dword [ebp - 4], edi
fldz
mov dword [eax + 8], edi
fstp qword [eax]
fldz
mov dword [esi + 0xb4], edi
fstp qword [esi + 0xac]
fldz
mov dword [esi + 0xc0], edi
fstp qword [esi + 0xb8]
mov dword [esi], 0x4cb764
call sub.MFC42.DLL_COleDateTime::SetDateTime
fld qword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
push edi
fstp qword [esi + 0x40]
push edi
push edi
push ebx
push ebx
push 0x64
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x48], eax
call sub.MFC42.DLL_COleDateTime::SetDateTime
fld qword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
push edi
fstp qword [esi + 0x34]
mov dword [esi + 0x3c], eax
push edi
push edi
push ebx
push ebx
push 0x64
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_COleDateTime::SetDateTime
fld qword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
push edi
fstp qword [esi + 0xb8]
push edi
push edi
push ebx
push ebx
push 0x64
lea ecx, [ebp - 0x1c]
mov dword [esi + 0xc0], eax
call sub.MFC42.DLL_COleDateTime::SetDateTime
fld qword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
push edi
fstp qword [esi + 0xac]
push edi
push edi
push edi
lea ecx, [ebp - 0x1c]
mov dword [esi + 0xb4], eax
call fcn.0041126c
push eax
lea ecx, [esi + 0x70]
call fcn.00482cdc
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x1c]
call fcn.0041126c
push eax
lea ecx, [esi + 0x64]
call fcn.00482cdc
lea eax, [esi + 0x64]
lea ecx, [esi + 0xa0]
push eax
call fcn.00482cdc
push edi
push edi
push edi
push ebx
push ebx
push 0x64
lea ecx, [ebp - 0x1c]
mov dword [esi + 0x9c], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], edi
call fcn.004531a3
push eax
lea ecx, [esi + 0x8c]
call fcn.004531c7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x45edf8
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
jne 0x45ee19
add esi, 0xd8
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x45ee99
lea edi, [esi + 0xe0]
push edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esi + 0xd0]
test ecx, ecx
jne 0x45ee44
cmp dword [esi + 0xd4], ecx
jne 0x45ee44
mov dword [esi + 0xcc], 0xbf800000
jmp 0x45ee99
mov eax, dword [edi]
and dword [ebp - 4], 0
sub eax, dword [esi + 0xd8]
mov dword [ebp - 8], eax
fild qword [ebp - 8]
fcom dword [0x4caf28]
fst dword [esi + 0xcc]
fnstsw ax
sahf
jae 0x45ee75
fadd dword [0x4cc4d0]
fstp dword [esi + 0xcc]
jmp 0x45ee77
fstp st(0)
mov eax, dword [esi + 0xd4]
lea eax, [ecx + eax*2]
xor eax, 0x20
and dword [ebp - 4], 0
mov dword [ebp - 8], eax
fild qword [ebp - 8]
fdivr dword [esi + 0xcc]
fstp dword [esi + 0xcc]
pop edi
pop esi
leave
ret 4
Function at 0x47584b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4c5ad8
call fcn.00483c30
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
add eax, 0xb
add ecx, 0xb
cmp dword [edi], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
je 0x47588c
push 0x14
call ebx
push eax
push 0x10
jmp 0x475899
cmp dword [edi + 4], 0
je 0x4758a7
push 0x10
call ebx
push eax
push 0x14
call ebx
push eax
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::Draw3dRect
push dword [esi + 8]
call dword [sym.imp.GDI32.dll_GetTextColor]
mov edx, dword [esi]
push 0x12
mov dword [ebp - 0x18], eax
mov dword [ebp + 8], edx
call ebx
push eax
mov eax, dword [ebp + 8]
mov ecx, esi
call dword [eax + 0x38]
push 1
mov ecx, esi
call sub.MFC42.DLL_CDC::SetBkMode
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4c8eb4
push 0x58
mov dword [ebp - 4], ebx
push dword [esi + 8]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 0x60
push 0x3c
call dword [sym.imp.KERNEL32.dll_MulDiv]
push ebx
push str.Marlett
push eax
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CFont::CreatePointFont
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
call dword [eax + 0x30]
push 0x4fcd74
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00482970
mov eax, dword [eax]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 8]
inc ecx
mov edi, dword [eax - 8]
inc ecx
mov dword [ebp + 8], edi
mov edi, dword [esi]
push dword [ebp + 8]
inc edx
inc edx
mov byte [ebp - 4], 1
push eax
push ecx
push edx
mov ecx, esi
call dword [edi + 0x64]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x30]
push dword [ebp - 0x14]
mov ecx, esi
call sub.MFC42.DLL_CDC::SetBkMode
mov eax, dword [esi]
push dword [ebp - 0x18]
mov ecx, esi
call dword [eax + 0x38]
mov dword [ebp - 0x20], 0x4c870c
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x47ab29
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4c5e14
call fcn.00483c30
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4c86f8
and dword [ebp - 4], 0
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00482cac
mov dword [edi], 0x4d09a4
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x4d0990
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x47abe7
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4c5e8b
call fcn.00483c30
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4d0990
mov eax, dword [esi + 0x14]
xor edi, edi
test eax, eax
mov dword [ebp - 4], 9
jle 0x47ac26
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x47ac20
mov eax, dword [ecx]
push 1
call dword [eax + 4]
inc edi
cmp edi, dword [esi + 0x14]
jl 0x47ac0f
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call sub.MFC42.DLL_CObArray::CObArray
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x4c86f8
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x47c718
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x4c606a
call fcn.00483c30
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx], 0x4c86f8
lea esi, [ebx + 8]
xor edi, edi
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.00482cac
mov dword [esi], 0x4d0bd4
lea ecx, [ebx + 0x1c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CWordArray::CWordArray
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 8
mov byte [ebp - 4], 2
mov dword [ebx], 0x4d0bc0
call esi
push 5
mov dword [ebx + 0xec], eax
call esi
push 0xa
mov dword [ebx + 0xf0], eax
call esi
push 0x10
mov dword [ebx + 0xf4], eax
call esi
and byte [ebx + 0xb0], 0
and byte [ebx + 0xb1], 0
and byte [ebx + 0xb2], 0
push 1
mov dword [ebx + 0xf8], eax
pop eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x54], eax
mov eax, dword [ebx + 0xf4]
mov ecx, 0xc0c0c0
mov dword [ebx + 0xa0], edi
mov dword [ebx + 0xa4], edi
mov dword [ebx + 0xa8], edi
mov esi, 0x4faaf8
lea edi, [ebp - 0x18]
mov dword [ebx + 0xfc], ecx
mov dword [ebx + 0x38], 0x14
mov dword [ebx + 0x34], 0x64
mov dword [ebx + 0x58], 4
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0xdc], 0xffffff
mov dword [ebx + 0xe4], 0xffff66
mov dword [ebx + 0xe0], 0xcc6600
mov byte [ebx + 0xb3], 0x86
mov dword [ebx + 0x9c], 0xfffffff4
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0xb8]
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
call esi
mov eax, dword [ebx + 0xec]
and byte [ebx + 0x70], 0
and byte [ebx + 0x71], 0
mov dword [ebx + 0xd8], eax
lea eax, [ebp - 0x18]
xor edi, edi
and byte [ebx + 0x72], 0
push eax
lea eax, [ebx + 0x78]
mov byte [ebx + 0x73], 0x86
mov dword [ebx + 0x60], edi
mov dword [ebx + 0x5c], 0xfffffff4
mov dword [ebx + 0x64], edi
mov dword [ebx + 0x68], edi
push eax
call esi
mov eax, dword [ebx + 0xec]
push 1
push edi
lea ecx, [ebx + 8]
mov dword [ebx + 0x98], eax
mov dword [ebx + 0xe8], edi
call sub.MFC42.DLL_CObArray::SetSize
push 1
push edi
lea ecx, [ebx + 0x1c]
call sub.MFC42.DLL_CWordArray::SetSize
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x47d7a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
lea eax, [esp + 8]
push ebx
push esi
push edi
push ebp
push 0x22
push eax
call fcn.0047d730
mov dx, 8
add esp, 8
movzx eax, dx
dec dx
mov ecx, dword [esp + 0x40]
mov ebx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
sub dword [eax], ebx
cmp dx, 2
jae 0x47d7ba
mov si, 8
xor edi, edi
mov word [esp + 0x12], di
mov ebx, 0x80000000
mov eax, dword [esp + 0x12]
and eax, 0xffff
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + eax*4]
mov ecx, eax
and ecx, ebx
cmp ecx, 1
sbb dl, dl
xor cx, cx
inc dl
mov ebp, ebx
and ebp, eax
je 0x47d80a
test dl, dl
je 0x47d81d
test ebp, ebp
jne 0x47d812
test dl, dl
jne 0x47d81d
shr ebx, 1
inc cx
cmp cx, 0x20
jb 0x47d800
shr cx, 2
mov bl, 7
sub bl, cl
movzx cx, bl
lea edx, [edx + ebx*2]
lea ecx, [ecx*4 + 4]
mov word [esp + 0x14], cx
mov byte [esp + 0x11], dl
xor dx, dx
mov bl, byte [esp + 0x11]
mov cl, 3
movzx ebp, di
sub cl, dl
shr bl, cl
and bl, 1
lea ecx, [esi - 1]
shl bl, cl
or byte [esp + ebp + 0x18], bl
dec si
jne 0x47d862
mov si, 8
inc di
inc dx
cmp dx, 4
jb 0x47d83f
xor dx, dx
cmp word [esp + 0x14], dx
je 0x47d8a2
mov ebx, eax
mov cl, byte [esp + 0x14]
movzx ebp, di
sub cl, dl
dec cl
shr ebx, cl
and bl, 1
lea ecx, [esi - 1]
shl bl, cl
or byte [esp + ebp + 0x18], bl
dec si
jne 0x47d899
mov si, 8
inc di
inc dx
cmp dx, word [esp + 0x14]
jb 0x47d874
inc word [esp + 0x12]
cmp word [esp + 0x12], 9
jb 0x47d7dd
cmp si, 8
je 0x47d8bb
inc di
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x44]
push 0x28
mov dword [esp + 0x18], eax
push esi
call fcn.0047d730
mov al, byte [esp + 0x1c]
add esp, 8
movzx ecx, di
mov edi, 0x26
mov byte [esi], al
xor eax, eax
sub edi, ecx
mov al, byte [esp + 0x15]
cdq
idiv edi
add dl, 2
mov al, byte [esp + 0x14]
sub al, dl
movzx bx, dl
movzx edx, bx
mov byte [esi + 1], al
lea edi, [ecx + edx]
cmp edi, edx
jle 0x47d917
movzx eax, bx
inc bx
mov byte [eax + esi], 1
movzx ebp, bx
cmp ebp, edi
jl 0x47d907
mov bx, 2
movzx eax, bx
lea edi, [eax + esi]
cmp byte [edi], 0
jne 0x47d92c
mov al, byte [esp + 0x16]
mov byte [edi], al
inc bx
cmp bx, 0x28
jb 0x47d91b
lea eax, [esp + 0x18]
push ecx
push eax
add edx, esi
push edx
call fcn.0047d750
mov cx, 1
add esp, 0xc
movzx eax, cx
inc cx
add eax, esi
mov dl, byte [eax - 1]
xor byte [eax], dl
cmp cx, 0x28
jb 0x47d949
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x47fcb0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x19c], 0x4000
jl 0x47fcf4
mov eax, dword [esp + 8]
lea ecx, [esi + 0x1a0]
push eax
push 0x4000
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 0x4000
jge 0x47fcea
mov byte [eax + esi + 0x1a0], 0xff
mov dword [esi + 0x19c], 0
mov eax, dword [esi + 0x19c]
xor edx, edx
mov dl, byte [eax + esi + 0x1a0]
inc eax
mov dword [esi + 0x19c], eax
mov eax, edx
pop esi
ret 4
Function at 0x480660
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x50c620]
test eax, eax
jle 0x48069e
mov ecx, dword [0x50ee44]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_fputc]
mov edx, dword [0x50ee44]
mov eax, dword [0x50c620]
push edx
push eax
push 1
push 0x50c624
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x18
mov dword [0x50c620], 0
ret
Function at 0x481cd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x418]
push ebp
push esi
push edi
mov esi, ecx
push ebx
push 1
mov ebp, dword [esi + 0x158]
lea eax, [esp + 0x18]
push 6
push eax
mov dword [esp + 0x2c], ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp word [esp + 0x10], 0
jne 0x481e77
cmp word [esp + 0x12], 1
jne 0x481e77
mov eax, dword [esp + 0x14]
and eax, 0xffff
mov dword [esi + 0x15c], eax
shl eax, 4
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ecx, dword [esp + 0x18]
add esp, 4
xor edi, edi
mov dword [esp + 0x18], eax
test cx, cx
jbe 0x481d70
mov ebp, eax
push ebx
push 1
push 0x10
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov edx, ecx
inc edi
and edx, 0xffff
add ebp, 0x10
cmp edi, edx
jl 0x481d45
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 0x158]
test edx, edx
jl 0x481e6d
and ecx, 0xffff
cmp edx, ecx
jge 0x481e6d
shl ebp, 4
lea edi, [eax + ebp]
xor eax, eax
mov al, byte [edi + 2]
sub eax, 2
je 0x481dbf
sub eax, 0xe
je 0x481db0
mov word [esi + 0x16], 8
mov dword [esi + 0x28], 0x100
jmp 0x481dcc
mov word [esi + 0x16], 4
mov dword [esi + 0x28], 0x10
jmp 0x481dcc
mov word [esi + 0x16], 1
mov dword [esi + 0x28], 2
xor eax, eax
xor ecx, ecx
mov al, byte [edi]
push 0
mov dword [esi + 0xc], eax
mov ax, word [esi + 0x16]
mov cl, byte [edi + 1]
cmp ax, 8
push eax
mov dword [esi + 0x10], ecx
mov eax, ecx
mov ecx, dword [esi + 0xc]
seta dl
push eax
inc edx
push ecx
mov ecx, esi
mov byte [esi + 0x40], dl
mov dword [esi + 0x14c], 0xffffffff
call fcn.0047e020
mov edx, dword [edi + 0xc]
push 0
add edx, 0x28
push edx
push ebx
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [esi + 0x28]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push ebx
push 1
shl eax, 2
lea ecx, [esp + 0x34]
push eax
push ecx
call edi
mov edx, dword [esi + 0x28]
add esp, 0x1c
lea eax, [esp + 0x20]
mov ecx, esi
push edx
push eax
call fcn.0047e570
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
imul ecx, dword [esi + 0x10]
push ebx
push 1
push ecx
push edx
call edi
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x410
ret 4
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x410
ret 4
Function at 0x481e90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x40
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
mov esi, ecx
je 0x482058
cmp word [esi + 0x16], 8
ja 0x482033
mov ecx, dword [esi + 0xc]
mov eax, 0xff
cmp ecx, eax
jg 0x482033
cmp dword [esi + 0x10], eax
jg 0x482033
mov ecx, esi
call fcn.0047e160
cmp eax, ebx
mov dword [esp + 0x54], eax
je 0x482058
mov dl, byte [esi + 0x28]
mov edi, dword [esi + 0x10]
mov eax, 1
mov cl, byte [esi + 0x10]
mov word [esp + 0x12], ax
mov word [esp + 0x14], ax
mov al, byte [esi + 0xc]
mov byte [esp + 0x1a], dl
mov edx, dword [esi + 0xc]
mov byte [esp + 0x18], al
mov ax, word [esi + 0x16]
mov byte [esp + 0x19], cl
mov word [esp + 0x1e], ax
mov ecx, dword [esi + 0x30]
mov eax, edi
imul ecx, edi
imul eax, edx
cdq
and edx, 3
mov word [esp + 0x10], bx
add eax, edx
mov edx, dword [esi + 0x28]
mov byte [esp + 0x1b], bl
mov word [esp + 0x1c], bx
sar eax, 2
mov ebx, ecx
push ebp
add ebx, eax
push 1
push 6
mov dword [esp + 0x30], 0x16
lea eax, [ebx + edx*4 + 0x28]
lea edx, [edi + edi]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp + 0x38], eax
mov ax, word [esi + 0x16]
xor ebx, ebx
mov word [esp + 0x42], ax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x38], 0x28
mov dword [esp + 0x40], edx
mov word [esp + 0x44], 1
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
call edi
push ebp
push 1
lea ecx, [esp + 0x30]
push 0x10
push ecx
call edi
push ebp
push 1
lea edx, [esp + 0x50]
push 0x28
push edx
call edi
mov eax, dword [esi + 0x28]
mov ecx, dword [esp + 0x84]
push ebp
push 1
shl eax, 2
push eax
push ecx
call edi
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x34]
imul edx, dword [esi + 0x10]
add esp, 0x40
push ebp
push 1
push edx
push eax
call edi
mov eax, dword [esi + 0x10]
push 1
imul eax, dword [esi + 0xc]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
mov ecx, eax
add esp, 0x18
cmp ecx, ebx
mov dword [esp + 0x54], ecx
je 0x482058
mov eax, dword [esi + 0x10]
push ebp
imul eax, dword [esi + 0xc]
cdq
and edx, 3
push 1
add eax, edx
sar eax, 2
push eax
push ecx
call edi
mov ecx, dword [esp + 0x64]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
mov edi, str.Cant_save_this_image_as_icon
or ecx, 0xffffffff
xor eax, eax
lea edx, [esi + 0x41]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x40
ret 4
Function at 0x482070
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
jne 0x48208d
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10
ret 4
mov ecx, esi
mov word [esp + 0xc], 0x4d42
call fcn.0047e620
add eax, 0xe
mov ecx, esi
mov dword [esp + 0xe], eax
mov word [esp + 0x14], bx
mov word [esp + 0x12], bx
call fcn.0047dff0
mov ecx, dword [esi + 8]
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
lea edx, [eax + ecx + 0xe]
lea eax, [esp + 0x14]
push 0xe
push eax
mov dword [esp + 0x26], edx
call ebx
add esp, 0x10
mov ecx, esi
push edi
push 1
call fcn.0047e620
mov ecx, dword [esi + 4]
push eax
push ecx
call ebx
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x482880
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
xor edi, edi
cmp ebx, edi
je 0x48295f
mov esi, dword [esp + 0x20]
cmp esi, edi
je 0x48295f
push ebx
push 1
push 0x28
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
je 0x48295f
cmp dword [esi], 0xc
jne 0x482919
mov ecx, esi
push 1
push 0xffffffffffffffe4
push ebx
mov edx, dword [ecx]
mov dword [esi + 0x10], edi
mov dword [esp + 0x18], edx
mov dword [esi + 0x14], edi
mov eax, dword [ecx + 4]
mov dword [esi + 0x18], edi
mov dword [esp + 0x1c], eax
and eax, 0xffff
mov ecx, dword [ecx + 8]
mov dword [esi + 4], eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x1e]
mov word [esi + 0xc], cx
mov cx, word [esp + 0x22]
and eax, 0xffff
mov dword [esi], 0x28
mov dword [esi + 8], eax
mov word [esi + 0xe], cx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
cmp dword [esi + 0x14], edi
jne 0x48293b
xor edx, edx
mov dx, word [esi + 0xe]
imul edx, dword [esi + 4]
add edx, 0x1f
shr edx, 3
and edx, 0x1ffffffc
imul edx, dword [esi + 8]
mov dword [esi + 0x14], edx
cmp dword [esi + 0x20], edi
jne 0x482954
mov cx, word [esi + 0xe]
cmp cx, 8
ja 0x482951
mov edi, 1
shl edi, cl
mov dword [esi + 0x20], edi
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0xc
ret 8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xc
ret 8

Function at 0x490230
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
cmp eax, 3
push esi
jne 0x49029a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov cx, word [eax + 0x118]
test cx, cx
jne 0x49025e
push ebx
mov bl, byte [eax + 0x230]
test bl, 1
pop ebx
jne 0x49027a
movzx si, byte [edx]
cmp si, cx
jbe 0x49027a
push str.Invalid_background_palette_index
push eax
call fcn.0048ba90
add esp, 8
pop esi
add esp, 8
ret
mov cl, byte [edx]
lea edx, [esp + 4]
push 1
push edx
push str.bKGD
push eax
mov byte [esp + 0x14], cl
call fcn.0048f0f0
add esp, 0x10
pop esi
add esp, 8
ret
test al, 2
je 0x4902f3
mov esi, dword [esp + 0x14]
xor eax, eax
lea ecx, [esp + 4]
mov ax, word [esi + 2]
push eax
push ecx
call fcn.0048f0d0
xor edx, edx
lea eax, [esp + 0xe]
mov dx, word [esi + 4]
push edx
push eax
call fcn.0048f0d0
xor ecx, ecx
lea edx, [esp + 0x18]
mov cx, word [esi + 6]
push ecx
push edx
call fcn.0048f0d0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x1c]
push 6
push eax
push str.bKGD
push ecx
call fcn.0048f0f0
add esp, 0x28
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
xor edx, edx
lea ecx, [esp + 4]
mov dx, word [eax + 8]
push edx
push ecx
call fcn.0048f0d0
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xc]
push 2
push edx
push str.bKGD
push eax
call fcn.0048f0f0
add esp, 0x18
pop esi
add esp, 8
ret
Function at 0x492a10
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x492a40
push esi
call fcn.00496cc0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x492a39
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x492ac3
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x492aaf
mov eax, dword [esi + 8]
test eax, eax
je 0x492a64
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x492aab
cmp eax, 2
je 0x492aaf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x492a57
cmp eax, 3
je 0x492a8a
cmp eax, 1
jne 0x492a57
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x492a57
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x492a57
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00492af0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x492ae3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00492af0
add esp, 4
pop esi
ret