joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d52a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
push esi
push edi
jne 0x4d52bc
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [esp + 0x20], 0
je 0x4d52af
cmp dword [esp + 0x2c], 0
je 0x4d52af
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x1c], esi
jb 0x4d549c
cmp dword [ebp + 0x14], 0
je 0x4d52e3
mov eax, dword [ebp + 0x18]
jmp 0x4d52ef
mov ecx, dword [ebp + 4]
push ecx
call fcn.00609413
add esp, 4
mov dword [esp + 0x28], eax
mov edi, esi
lea eax, [esp + 0x10]
call fcn.00487150
cmp dword [ebp + 0x14], 0
mov ebx, dword [esp + 0x14]
je 0x4d5343
mov eax, esi
mov edi, ebp
call fcn.00410220
cmp eax, esi
je 0x4d5367
cmp dword [ebp + 0x14], 0
mov ecx, dword [esp + 0x28]
je 0x4d5484
mov eax, dword [ebp + 0x1c]
cmp eax, ecx
jbe 0x4d532c
mov eax, ecx
lea esi, [esp + 0x10]
mov dword [ebp + 0x18], eax
call fcn.00487190
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [ebp + 4]
test eax, eax
je 0x4d535b
push eax
push 1
push esi
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d5367
cmp dword [ebp + 4], 0
jne 0x4d5315
cmp dword [ebp + 0xc], 0
jne 0x4d5315
cmp esi, 4
mov edx, dword [esp + 0x20]
mov eax, esi
mov ecx, ebx
jb 0x4d5388
mov edi, dword [edx]
cmp edi, dword [ecx]
jne 0x4d538c
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x4d5374
test eax, eax
je 0x4d53f1
movzx edi, byte [ecx]
movzx esi, byte [edx]
sub esi, edi
jne 0x4d53db
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4d53ed
movzx edi, byte [ecx]
movzx esi, byte [edx]
sub esi, edi
jne 0x4d53db
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4d53ed
movzx edi, byte [ecx]
movzx esi, byte [edx]
sub esi, edi
jne 0x4d53db
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4d53ed
movzx eax, byte [ecx]
movzx esi, byte [edx]
sub esi, eax
je 0x4d53ed
test esi, esi
mov esi, dword [esp + 0x24]
mov eax, 1
jg 0x4d53f3
or eax, 0xffffffff
jmp 0x4d53f3
mov esi, dword [esp + 0x24]
xor eax, eax
test eax, eax
jne 0x4d5315
mov edi, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x20]
sub eax, esi
mov ecx, edi
call fcn.00487200
mov ebx, eax
test ebx, ebx
je 0x4d5426
lea esi, [esp + 0x10]
call fcn.00487190
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp dword [ebp + 0x14], 0
mov esi, dword [edi]
mov edi, dword [edi + 4]
je 0x4d5445
mov ebx, edi
mov eax, esi
mov edi, ebp
call fcn.00410220
cmp eax, esi
je 0x4d5471
jmp 0x4d5315
mov eax, dword [ebp + 4]
test eax, eax
je 0x4d545d
push eax
push 1
push esi
push edi
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d5471
cmp dword [ebp + 4], 0
jne 0x4d5315
cmp dword [ebp + 0xc], 0
jne 0x4d5315
lea esi, [esp + 0x10]
call fcn.00487190
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [ebp + 4]
push 0
push ecx
push edx
call fcn.006081d8
add esp, 0xc
lea esi, [esp + 0x10]
call fcn.00487190
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x4d55a0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ebp + 4]
mov edx, dword [esi + 0x14]
test edx, edx
push edi
je 0x4d55ea
mov eax, dword [esi + 0x1c]
mov edi, 1
cmp eax, edi
jb 0x4d55c8
mov ecx, dword [esi + 0x18]
lea ebx, [ecx + 1]
cmp ebx, eax
jbe 0x4d55d1
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d560d
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x1c]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 1
jmp 0x4d560b
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d5617
cmp dword [esi + 4], eax
jne 0x4d560d
cmp dword [esi + 0xc], eax
je 0x4d5617
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
cmp byte [esp + 0x14], 0xff
je 0x4d5690
mov edi, edi
mov esi, dword [ebp + 4]
mov edx, dword [esi + 0x14]
test edx, edx
je 0x4d5662
mov eax, dword [esi + 0x1c]
mov edi, 1
cmp eax, edi
jb 0x4d5640
mov ecx, dword [esi + 0x18]
lea ebx, [ecx + 1]
cmp ebx, eax
jbe 0x4d5649
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d560d
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x1c]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 1
jmp 0x4d5683
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d5685
cmp dword [esi + 4], eax
jne 0x4d560d
cmp dword [esi + 0xc], eax
jne 0x4d560d
cmp byte [esp + 0x14], 0xff
jne 0x4d5620
lea esp, [esp]
mov esi, dword [ebp + 4]
mov edx, dword [esi + 0x14]
test edx, edx
je 0x4d56d6
mov eax, dword [esi + 0x1c]
mov edi, 1
cmp eax, edi
jb 0x4d56b0
mov ecx, dword [esi + 0x18]
lea ebx, [ecx + 1]
cmp ebx, eax
jbe 0x4d56bd
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d560d
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x1c]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 1
jmp 0x4d56fb
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d5701
cmp dword [esi + 4], eax
jne 0x4d560d
cmp dword [esi + 0xc], eax
jne 0x4d560d
mov al, byte [esp + 0x14]
cmp al, 0xff
je 0x4d5690
pop edi
pop esi
pop ebp
movzx eax, al
pop ebx
ret 4
Function at 0x4d5720
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 4]
mov edx, dword [esi + 0x14]
test edx, edx
push edi
je 0x4d576e
mov eax, dword [esi + 0x1c]
mov edi, 1
cmp eax, edi
jb 0x4d5748
mov ecx, dword [esi + 0x18]
push ebp
lea ebp, [ecx + 1]
cmp ebp, eax
pop ebp
jbe 0x4d5755
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d580b
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x16]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 1
jmp 0x4d578f
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x16]
push 1
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d5791
cmp dword [esi + 4], eax
jne 0x4d580b
cmp dword [esi + 0xc], eax
jne 0x4d580b
mov esi, dword [ebx + 4]
mov edx, dword [esi + 0x14]
test edx, edx
je 0x4d57d3
mov eax, dword [esi + 0x1c]
mov edi, 1
cmp eax, edi
jb 0x4d57b1
mov ecx, dword [esi + 0x18]
lea ebx, [ecx + 1]
cmp ebx, eax
jbe 0x4d57ba
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d580b
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x17]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 1
jmp 0x4d57f4
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x17]
push 1
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d57f6
cmp dword [esi + 4], eax
jne 0x4d580b
cmp dword [esi + 0xc], eax
jne 0x4d580b
cmp byte [esp + 0xe], 0xff
jne 0x4d580b
cmp byte [esp + 0xf], 0xd8
jne 0x4d580b
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
pop edi
pop esi
mov eax, 3
pop ebx
pop ecx
ret

Function at 0x4d5820
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, dword [ebx + 4]
mov edx, dword [esi + 0x14]
test edx, edx
push edi
je 0x4d5867
mov eax, dword [esi + 0x1c]
mov edi, 2
cmp eax, edi
jb 0x4d5845
mov ecx, dword [esi + 0x18]
push ebp
lea ebp, [ecx + 2]
cmp ebp, eax
pop ebp
jbe 0x4d584e
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d588a
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 2
jmp 0x4d5888
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x10]
push 2
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d5893
cmp dword [esi + 4], eax
jne 0x4d588a
cmp dword [esi + 0xc], eax
je 0x4d5893
pop edi
mov eax, 3
pop esi
pop ecx
ret
mov ax, word [esp + 8]
rol ax, 8
movzx eax, ax
cmp ax, 2
jb 0x4d588a
add eax, 0xfffe
mov dword [esp + 8], eax
movzx edx, ax
mov eax, dword [ebx + 4]
cmp dword [eax + 0x14], 0
je 0x4d58d1
mov ecx, dword [eax + 0x18]
add ecx, edx
mov edx, dword [eax + 0x1c]
cmp edx, ecx
ja 0x4d58c8
mov ecx, edx
pop edi
mov dword [eax + 0x18], ecx
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [eax + 4]
push 1
push edx
push ecx
call fcn.006081d8
add esp, 0xc
test eax, eax
jne 0x4d588a
pop edi
pop esi
pop ecx
ret
Function at 0x4d58f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
cmp dword [ebp + 0xc], 0
push esi
push edi
jne 0x4d5910
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov esi, dword [ebp + 4]
mov edx, dword [esi + 0x14]
test edx, edx
je 0x4d5956
mov eax, dword [esi + 0x1c]
mov edi, 2
cmp eax, edi
jb 0x4d5930
mov ecx, dword [esi + 0x18]
lea ebx, [ecx + 2]
cmp ebx, eax
jbe 0x4d593d
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d59f1
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x2c]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 2
jmp 0x4d5977
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x2c]
push 2
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d5979
cmp dword [esi + 4], eax
jne 0x4d59f1
cmp dword [esi + 0xc], eax
jne 0x4d59f1
mov ax, word [esp + 0x24]
rol ax, 8
movzx eax, ax
cmp ax, 2
jb 0x4d59f1
add eax, 0xfffe
test ax, ax
mov dword [esp + 0x24], eax
je 0x4d5aed
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
jne 0x4d5a00
mov edx, dword [ebp]
shr edx, 0x1f
test dl, 1
jne 0x4d5a00
movzx edx, ax
mov eax, dword [ebp + 4]
cmp dword [eax + 0x14], 0
je 0x4d59da
mov ecx, dword [eax + 0x18]
add ecx, edx
mov edx, dword [eax + 0x1c]
cmp edx, ecx
ja 0x4d59cb
mov ecx, edx
mov dword [eax + 0x18], ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov eax, dword [eax + 4]
push 1
push edx
push eax
call fcn.006081d8
add esp, 0xc
test eax, eax
je 0x4d5aed
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
movzx edi, ax
add edi, 1
lea eax, [esp + 0x18]
call fcn.00487150
mov edi, dword [ebp + 4]
cmp dword [edi + 0x14], 0
movzx esi, word [esp + 0x24]
mov ebx, dword [esp + 0x1c]
je 0x4d5a46
mov eax, esi
call fcn.00410220
cmp eax, esi
je 0x4d5a8b
lea esi, [esp + 0x18]
mov edi, 2
call fcn.00487190
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov eax, dword [edi + 4]
test eax, eax
je 0x4d5a62
push eax
push 1
push esi
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4d5a62
xor edi, edi
jmp 0x4d5a72
cmp dword [edi + 4], 0
je 0x4d5a6f
mov edi, 2
jmp 0x4d5a72
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4d5a8b
lea esi, [esp + 0x18]
call fcn.00487190
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
movzx ecx, word [esp + 0x24]
lea edx, [esp + 0x14]
mov byte [ecx + ebx], 0
push edx
mov ecx, ebx
call fcn.0045af30
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x4d5adb
test dword [eax], 0xffffff00
je 0x4d5adb
cmp byte [eax + 4], 0
je 0x4d5adb
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
push 0x12a
push ecx
call fcn.00406b00
mov eax, dword [ebp + 8]
add eax, 0x28
lea esi, [esp + 0x14]
call fcn.004017d0
lea edi, [esp + 0x14]
call fcn.00401700
lea esi, [esp + 0x18]
call fcn.00487190
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 4
Function at 0x4d5b00
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [ebp + 4]
mov edx, dword [esi + 0x14]
test edx, edx
push edi
je 0x4d5b51
mov eax, dword [esi + 0x1c]
mov edi, 2
cmp eax, edi
jb 0x4d5b2b
mov ecx, dword [esi + 0x18]
lea ebx, [ecx + 2]
cmp ebx, eax
jbe 0x4d5b38
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d5bec
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x24]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 2
jmp 0x4d5b72
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x24]
push 2
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d5b74
cmp dword [esi + 4], eax
jne 0x4d5bec
cmp dword [esi + 0xc], eax
jne 0x4d5bec
mov ax, word [esp + 0x1c]
rol ax, 8
movzx eax, ax
cmp ax, 2
jb 0x4d5bec
add eax, 0xfffe
test ax, ax
mov dword [esp + 0x1c], eax
je 0x4d5cab
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0x2c], 0
jne 0x4d5bfb
mov edx, dword [ebp]
shr edx, 0x1f
test dl, 1
jne 0x4d5bfb
movzx edx, ax
mov eax, dword [ebp + 4]
cmp dword [eax + 0x14], 0
je 0x4d5bd5
mov ecx, dword [eax + 0x18]
add ecx, edx
mov edx, dword [eax + 0x1c]
cmp edx, ecx
ja 0x4d5bc6
mov ecx, edx
mov dword [eax + 0x18], ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [eax + 4]
push 1
push edx
push eax
call fcn.006081d8
add esp, 0xc
test eax, eax
je 0x4d5cab
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
movzx edi, ax
lea eax, [esp + 0x10]
call fcn.00487150
mov edi, dword [ebp + 4]
cmp dword [edi + 0x14], 0
movzx esi, word [esp + 0x1c]
mov ebx, dword [esp + 0x14]
je 0x4d5c3e
mov eax, esi
call fcn.00410220
cmp eax, esi
je 0x4d5c83
lea esi, [esp + 0x10]
mov edi, 2
call fcn.00487190
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [edi + 4]
test eax, eax
je 0x4d5c5a
push eax
push 1
push esi
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4d5c5a
xor edi, edi
jmp 0x4d5c6a
cmp dword [edi + 4], 0
je 0x4d5c67
mov edi, 2
jmp 0x4d5c6a
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4d5c83
lea esi, [esp + 0x10]
call fcn.00487190
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x1c]
mov ecx, dword [esp + 0x10]
add eax, 0x1c
mov dword [esp + 0x10], esi
mov esi, dword [eax + 4]
mov edx, ebx
mov dword [esp + 0x14], esi
lea esi, [esp + 0x10]
mov dword [eax], ecx
mov dword [eax + 4], edx
call fcn.00487190
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x4d65c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [ebx + 4]
mov edx, dword [esi + 0x14]
test edx, edx
push edi
je 0x4d6608
mov eax, dword [esi + 0x1c]
mov edi, 2
cmp eax, edi
jb 0x4d65e6
mov ecx, dword [esi + 0x18]
lea ebp, [ecx + 2]
cmp ebp, eax
jbe 0x4d65ef
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d662b
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x18]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 2
jmp 0x4d6629
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x18]
push 2
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d6637
cmp dword [esi + 4], eax
jne 0x4d662b
cmp dword [esi + 0xc], eax
je 0x4d6637
mov eax, 3
pop edi
pop esi
pop ebp
add esp, 8
ret
mov ax, word [esp + 0x10]
rol ax, 8
movzx esi, ax
cmp si, 2
jb 0x4d662b
add esi, 0xfffe
test si, si
mov dword [esp + 0x10], esi
je 0x4d66d0
mov edi, dword [ebx + 8]
cmp byte [edi + 0x2c], 0
jne 0x4d6670
mov ecx, dword [ebx]
push ecx
call fcn.004fb8b0
add esp, 4
test al, al
je 0x4d6693
mov edx, dword [ebx + 4]
add edi, 0x14
push edi
push edx
push 0xe
movzx eax, si
push str.Photoshop_3.0
push eax
call fcn.004d52a0
add esp, 0x14
test eax, eax
je 0x4d66d0
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
cmp dword [eax + 0x14], 0
movzx edx, si
je 0x4d66b9
mov ecx, dword [eax + 0x18]
add ecx, edx
mov edx, dword [eax + 0x1c]
cmp edx, ecx
ja 0x4d66ad
mov ecx, edx
mov dword [eax + 0x18], ecx
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 8
ret
mov ecx, dword [eax + 4]
push 1
push edx
push ecx
call fcn.006081d8
add esp, 0xc
test eax, eax
jne 0x4d662b
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
Function at 0x4d66e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [ebx + 4]
mov edx, dword [esi + 0x14]
test edx, edx
push edi
je 0x4d6728
mov eax, dword [esi + 0x1c]
mov edi, 2
cmp eax, edi
jb 0x4d6706
mov ecx, dword [esi + 0x18]
lea ebp, [ecx + 2]
cmp ebp, eax
jbe 0x4d670f
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov edi, eax
je 0x4d674b
push edi
add ecx, edx
push ecx
lea eax, [esp + 0x18]
push eax
call fcn.0060d1b0
add dword [esi + 0x18], edi
add esp, 0xc
cmp edi, 2
jmp 0x4d6749
mov ecx, dword [esi + 4]
push ecx
push 1
lea edx, [esp + 0x18]
push 2
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d6757
cmp dword [esi + 4], eax
jne 0x4d674b
cmp dword [esi + 0xc], eax
je 0x4d6757
mov eax, 3
pop edi
pop esi
pop ebp
add esp, 8
ret
mov ax, word [esp + 0x10]
rol ax, 8
movzx esi, ax
cmp si, 2
jb 0x4d674b
add esi, 0xfffe
test si, si
mov dword [esp + 0x10], esi
je 0x4d682f
mov edi, dword [ebx + 8]
cmp byte [edi + 0x2c], 0
jne 0x4d6794
mov ecx, dword [ebx]
push ecx
call fcn.004dd540
add esp, 4
test al, al
je 0x4d67b7
mov edx, dword [ebx + 4]
add edi, 4
push edi
push edx
push 6
movzx eax, si
push 0x6a18a4
push eax
call fcn.004d52a0
add esp, 0x14
test eax, eax
je 0x4d682f
mov esi, dword [esp + 0x10]
mov edi, dword [ebx + 8]
cmp byte [edi + 0x2c], 0
jne 0x4d67cf
mov ecx, dword [ebx]
push ecx
call fcn.004f0ef0
add esp, 4
test al, al
je 0x4d67f2
mov edx, dword [ebx + 4]
add edi, 0xc
push edi
push edx
push 0x1d
movzx eax, si
push 0x6a18ac
push eax
call fcn.004d52a0
add esp, 0x14
test eax, eax
je 0x4d682f
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
cmp dword [eax + 0x14], 0
movzx edx, si
je 0x4d6818
mov ecx, dword [eax + 0x18]
add ecx, edx
mov edx, dword [eax + 0x1c]
cmp edx, ecx
ja 0x4d680c
mov ecx, edx
mov dword [eax + 0x18], ecx
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 8
ret
mov ecx, dword [eax + 4]
push 1
push edx
push ecx
call fcn.006081d8
add esp, 0xc
test eax, eax
jne 0x4d674b
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
Function at 0x4d6840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov eax, esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.004d5720
cmp eax, edi
jne 0x4d68ae
push esi
call fcn.004d55a0
cmp eax, 0xfe
jg case.0x4d6890.0
je 0x4d6a02
add eax, 1
cmp eax, 0xee
ja case.0x4d6890.0
movzx eax, byte [eax + 0x4d6a94]
jmp dword [eax*4 + 0x4d6a70]
push esi
call fcn.004d5cc0
mov edi, eax
test edi, edi
je 0x4d6864
lea ecx, [esp + 0x18]
call fcn.00407460
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, esi
call fcn.004d65c0
jmp 0x4d689d
mov ebx, esi
call fcn.004d66e0
jmp 0x4d689d
mov eax, esi
call fcn.004d6580
jmp 0x4d689d
push esi
call fcn.004d5b00
jmp 0x4d689d
mov edi, dword [esi + 4]
cmp dword [edi + 0x14], 0
je 0x4d6922
mov eax, dword [edi + 0x1c]
mov ebx, 2
cmp eax, ebx
jb 0x4d68f9
mov ecx, dword [edi + 0x18]
lea edx, [ecx + 2]
cmp edx, eax
jbe 0x4d6906
mov ecx, dword [edi + 0x18]
sub eax, ecx
mov ebx, eax
je 0x4d6a59
mov eax, dword [edi + 0x14]
add ecx, eax
push ebx
push ecx
lea eax, [esp + 0x18]
push eax
call fcn.0060d1b0
add dword [edi + 0x18], ebx
add esp, 0xc
cmp ebx, 2
jmp 0x4d6947
mov ecx, dword [edi + 4]
push ecx
push 1
lea edx, [esp + 0x18]
push 2
push edx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d694d
cmp dword [edi + 4], eax
jne 0x4d6a59
cmp dword [edi + 0xc], eax
jne 0x4d6a59
mov ax, word [esp + 0x10]
rol ax, 8
movzx eax, ax
cmp ax, 2
mov dword [esp + 0x10], eax
jb 0x4d6a59
add eax, 0xfffe
test ax, ax
mov dword [esp + 0x10], eax
jbe 0x4d6864
xor edi, edi
lea eax, [esp + 0x20]
call fcn.00487150
movzx eax, word [esp + 0x10]
push edi
lea ecx, [esp + 0x24]
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4d6a33
movzx eax, word [esp + 0x10]
mov edi, dword [esi + 4]
cmp dword [edi + 0x14], 0
mov dword [esp + 0x14], eax
je 0x4d69be
mov ebx, dword [esp + 0x24]
call fcn.00410220
cmp eax, dword [esp + 0x14]
jmp 0x4d69e4
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4d69da
push ecx
mov ecx, dword [esp + 0x28]
push 1
push eax
push ecx
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x4d69e6
cmp dword [edi + 4], 0
jne 0x4d6a50
cmp dword [edi + 0xc], 0
jne 0x4d6a50
lea edx, [esp + 0x20]
push edx
push esi
call fcn.004d6320
lea esi, [esp + 0x20]
call fcn.00487190
mov esi, dword [ebp + 8]
jmp 0x4d6864
push esi
call fcn.004d58f0
jmp 0x4d689d
mov ebx, esi
call fcn.004d5820
jmp 0x4d689d
push esi
call fcn.004d6b90
lea ecx, [esp + 0x18]
call fcn.00407460
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [esp + 0x20]
call fcn.00487190
lea ecx, [esp + 0x18]
call fcn.00407460
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esi, [esp + 0x20]
call fcn.00487190
lea ecx, [esp + 0x18]
call fcn.00407460
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4d9cc0
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
test ecx, ecx
push esi
push edi
je 0x4d9d05
mov eax, dword [ebp + 4]
shr eax, 1
push 0
call fcn.00487200
test eax, eax
jne 0x4d9dac
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
mov edx, dword [ebp + 8]
shr eax, 1
push eax
mov eax, dword [edx + 4]
push ecx
push eax
call fcn.0060d1b0
add esp, 0xc
mov dword [ebp + 8], 0
jmp 0x4d9d31
cmp dword [ebp + 0x10], 0
je 0x4d9d31
mov ecx, dword [ebp + 4]
shr ecx, 1
je 0x4d9d29
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4d9d29
push eax
push ecx
mov ecx, dword [ebp]
push 1
push ecx
call fcn.00608896
add esp, 0x10
lea ebx, [ebp + 0xc]
call fcn.00486bd0
mov eax, dword [ebp]
test eax, eax
je 0x4d9d4c
push eax
call fcn.0045da90
add esp, 4
and dword [ebp + 4], 1
mov dword [ebp], 0
mov eax, 0xb
mov edi, str.Invalid
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.00459750
mov esi, dword [esp + 0x14]
cmp dword [ebp + 0x20], esi
lea edi, [ebp + 0x20]
je 0x4d9da3
call fcn.00401700
test esi, esi
mov dword [edi], esi
je 0x4d9da3
movzx edx, byte [esi]
cmp edx, 0x80
jae 0x4d9d9c
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
cmp eax, 0xff
jne 0x4d9da3
mov eax, edi
call fcn.00459380
lea edi, [esp + 0x14]
call fcn.00401700
lea edi, [ebp + 0x20]
call fcn.00401700
lea esi, [ebp + 0xc]
mov dword [edi], 0
mov eax, dword [esi]
test eax, eax
je 0x4d9dd3
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4d9dda
call fcn.00457970
mov ebx, esi
call fcn.00486bd0
mov eax, dword [ebp]
test eax, eax
je 0x4d9df5
push eax
call fcn.0045da90
add esp, 4
and dword [ebp + 4], 1
mov dword [ebp], 0
pop edi
pop esi
pop ebp
pop ebx
ret 4