joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8592f2
Capabilities:
Parse credit card information

Disassembly:
mov esi, dword [0x444398]
lodsb al, byte [esi]
cmp al, 3
jne 0x8592f8
lodsb al, byte [esi]
cmp al, 3
jne 0x8592fd
cmp byte [esi + 1], 0xf
jne 0x859487
mov al, byte [esi]
mov byte [0x4443d0], al
mov word [esi], 0
add esi, 2
mov byte [0x4443d5], 6
cmp byte [esi], 2
jne 0x859333
pushal
popal
mov eax, dword [str.Unvalid_parameter]
jmp fcn.0086e2d2
cmp al, 0x44
jne 0x859347
mov byte [0x4443e2], 1
jmp 0x859429
cmp al, 0x42
jne 0x85935b
mov byte [0x4443e2], 0
jmp 0x859429
cmp al, 0x57
jne 0x85936f
mov byte [0x4443e2], 3
jmp 0x859429
cmp al, 0x51
jne 0x859383
mov byte [0x4443e2], 4
jmp 0x859429
cmp al, 0x52
jne 0x859397
mov byte [0x4443e2], 4
jmp 0x859429
cmp al, 0x48
jne 0x8593b0
pushal
popal
mov eax, dword [str._H___now_reserved_for_futher_developement._Use__R___or__F___instead]
jmp fcn.0086e2d2
cmp al, 0x46
jne 0x8593d1
cmp byte [esi], 0x41
jae 0x8593c5
call fcn.00859067
ret
mov byte [0x4443e2], 1
jmp 0x859429
cmp al, 0x54
jne 0x8593e5
mov byte [0x4443e2], 8
jmp 0x859429
cmp al, 0x58
jne 0x8593f9
mov byte [0x4443e2], 0xff
jmp 0x859429
cmp al, 0x4f
jne 0x85940d
mov byte [0x4443e2], 0x10
jmp 0x859429
cmp al, 0x48
jne 0x85941d
pushal
popal
mov eax, dword [str._H___now_reserved_for_futher_developement._Use__R___or__F___instead]
jmp fcn.0086e2d2
pushal
popal
mov eax, dword [str.Unknown_Size_marker]
jmp fcn.0086e2d2
call fcn.008589a2
call fcn.00858ca4
call fcn.00858dec
cmp byte [0x4443ca], 1
jne 0x859481
cmp byte [0x4443c9], 0
jne 0x859481
cmp byte [0x4443d4], 1
jne 0x859481
cmp byte [0x4443ec], 1
jne 0x859481
mov al, byte [0x4443c6]
and al, 7
cmp al, 5
jne 0x859481
mov byte [0x4443c9], 1
mov byte [0x4443a8], 0
call fcn.00858f3d
ret
call fcn.00858565
cmp ah, 0
je 0x8594fc
mov byte [0x4443d5], 1
mov byte [0x4443d2], al
mov byte [0x4443d8], ah
mov al, byte [0x4443e0]
mov byte [0x4443e2], al
cmp byte [0x4443ca], 1
jne 0x8594fb
cmp byte [0x4443c9], 0
jne 0x8594fb
cmp byte [0x4443d4], 6
jne 0x8594fb
cmp byte [0x4443ec], 1
jne 0x8594fb
mov al, byte [0x4443c6]
and al, 7
cmp al, 5
jne 0x8594f6
mov byte [0x4443c9], 1
mov byte [0x4443a8], 0
call fcn.00858f3d
ret
call fcn.00858b48
cmp byte [0x4443c8], 0
je 0x859519
mov byte [0x4443d5], 5
mov byte [0x4443ef], 1
ret
cmp byte [0x50e308], 1
jne 0x85954d
mov byte [0x4443c9], 1
mov byte [0x50e308], 0
mov byte [0x4443d5], 6
mov byte [0x4443e4], 0
mov byte [0x4443da], 5
mov byte [0x4443e2], 1
ret
cmp dword [0x4443c9], 1
jne 0x859565
mov byte [0x4443d5], 5
mov byte [0x4443ef], 1
ret
cmp byte [0x4443cd], 0
jne 0x859591
call fcn.00858dec
cmp byte [0x4443cc], 0
jne 0x859588
pushal
popal
mov eax, dword [str.unable_to_resolve_this_parameter]
jmp fcn.0086e2d2
mov byte [0x4443d5], 7
jmp 0x8595a6
mov byte [0x4443c8], 1
mov byte [0x4443d5], 5
mov byte [0x4443ef], 1
mov byte [0x4443dd], 0
ret
Function at 0x859c22
Capabilities:
Parse credit card information

Disassembly:
push eax
cmp al, 0x42
jne 0x859c29
jmp 0x859c65
cmp al, 0x57
jne 0x859c2f
jmp 0x859c65
cmp al, 0x55
jne 0x859c35
jmp 0x859c65
cmp al, 0x44
jne 0x859c3b
jmp 0x859c65
cmp al, 0x51
jne 0x859c41
jmp 0x859c65
cmp al, 0x46
jne 0x859c47
jmp 0x859c65
cmp al, 0x52
jne 0x859c4d
jmp 0x859c65
cmp al, 0x54
jne 0x859c53
jmp 0x859c65
cmp al, 0x58
jne 0x859c59
jmp 0x859c65
pushal
popal
mov eax, dword [str.Unknown_mnemonic]
jmp fcn.0086e2d2
pop eax
mov edi, dword [0x509884]
cmp al, 0x42
jne 0x859c7e
call fcn.00859d8d
jmp 0x859d36
cmp al, 0x57
jne 0x859c90
call fcn.00859de5
jmp 0x859d36
cmp al, 0x55
jne 0x859ca2
call fcn.00859e06
jmp 0x859d36
cmp al, 0x44
jne 0x859cb4
call fcn.00859e63
jmp 0x859d36
cmp al, 0x51
jne 0x859cc6
call fcn.00859e81
jmp 0x859d36
cmp al, 0x46
jne 0x859cdf
pushal
popal
mov eax, dword [str.Sorry__this_mnemonic_is_not_yet_implemented._Information_needed]
jmp fcn.0086e2d2
cmp al, 0x52
jne 0x859cf8
pushal
popal
mov eax, dword [str.Sorry__this_mnemonic_is_not_yet_implemented._Information_needed]
jmp fcn.0086e2d2
cmp al, 0x54
jne 0x859d11
pushal
popal
mov eax, dword [str.Sorry__this_mnemonic_is_not_yet_implemented._Information_needed]
jmp fcn.0086e2d2
cmp al, 0x58
jne 0x859d2a
pushal
popal
mov eax, dword [str.Sorry__this_mnemonic_is_not_yet_implemented._Information_needed]
jmp fcn.0086e2d2
pushal
popal
mov eax, dword [str.Unknown_Size_marker]
jmp fcn.0086e2d2
dec esi
cmp byte [esi], 2
jbe 0x859d42
inc esi
jmp 0x859c6c
mov dword [0x509884], edi
mov ebx, dword [0x444398]
cmp ebx, esi
jae 0x859d58
mov byte [ebx], 0
inc ebx
jmp 0x859d4e
dec esi
ret
Function at 0x85a41c
Capabilities:
Parse credit card information

Disassembly:
mov byte [0x50e278], 0
pushal
popal
mov eax, dword [str.No_Lock_Prefix_with_this_instruction]
jmp fcn.0086e2d2
push esi
add esi, 5
cmp byte [esi], 0x41
jne 0x85a489
cmp byte [esi + 1], 0x44
jne 0x85a458
cmp byte [esi + 2], 0x44
jne 0x85a43b
jmp 0x85a448
cmp byte [esi + 2], 0x43
jne 0x85a443
jmp 0x85a448
jmp 0x85a3e3
cmp byte [esi + 3], 3
je 0x85a453
jmp 0x85a3e3
jmp 0x85a484
cmp byte [esi + 1], 0x4e
jne 0x85a47f
cmp byte [esi + 2], 0x44
jne 0x85a475
cmp byte [esi + 3], 3
je 0x85a473
jmp 0x85a3e3
jmp 0x85a47a
jmp 0x85a3e3
jmp 0x85a484
jmp 0x85a3e3
jmp 0x85a6b6
cmp byte [esi], 0x42
jne 0x85a4e9
cmp byte [esi + 1], 0x54
jne 0x85a4df
cmp byte [esi + 2], 0x43
jne 0x85a4af
cmp byte [esi + 3], 3
je 0x85a4ad
jmp 0x85a3e3
jmp 0x85a4da
cmp byte [esi + 2], 0x52
jne 0x85a4c2
cmp byte [esi + 3], 3
je 0x85a4c0
jmp 0x85a3e3
jmp 0x85a4da
cmp byte [esi + 2], 0x53
jne 0x85a4d5
cmp byte [esi + 3], 3
je 0x85a4d3
jmp 0x85a3e3
jmp 0x85a4da
jmp 0x85a3e3
jmp 0x85a4e4
jmp 0x85a3e3
jmp 0x85a6b6
cmp word [esi], 0x4544
jne 0x85a511
cmp byte [esi + 2], 0x43
jne 0x85a507
cmp byte [esi + 3], 3
je 0x85a505
jmp 0x85a3e3
jmp 0x85a50c
jmp 0x85a3e3
jmp 0x85a6b6
cmp word [esi], 0x4e49
jne 0x85a539
cmp byte [esi + 2], 0x43
jne 0x85a52f
cmp byte [esi + 3], 3
je 0x85a52d
jmp 0x85a3e3
jmp 0x85a534
jmp 0x85a3e3
jmp 0x85a6b6
cmp word [esi], 0x454e
jne 0x85a561
cmp byte [esi + 2], 0x47
jne 0x85a557
cmp byte [esi + 3], 3
je 0x85a555
jmp 0x85a3e3
jmp 0x85a55c
jmp 0x85a3e3
jmp 0x85a6b6
cmp word [esi], 0x4f4e
jne 0x85a589
cmp byte [esi + 2], 0x54
jne 0x85a57f
cmp byte [esi + 3], 3
je 0x85a57d
jmp 0x85a3e3
jmp 0x85a584
jmp 0x85a3e3
jmp 0x85a6b6
cmp word [esi], 0x524f
jne 0x85a5a4
cmp byte [esi + 3], 3
je 0x85a59f
jmp 0x85a3e3
jmp 0x85a6b6
cmp word [esi], 0x4253
jne 0x85a5cc
cmp byte [esi + 2], 0x42
jne 0x85a5c2
cmp byte [esi + 3], 3
je 0x85a5c0
jmp 0x85a3e3
jmp 0x85a5c7
jmp 0x85a3e3
jmp 0x85a6b6
cmp word [esi], 0x5553
jne 0x85a5f4
cmp byte [esi + 2], 0x42
jne 0x85a5ea
cmp byte [esi + 3], 3
je 0x85a5e8
jmp 0x85a3e3
jmp 0x85a5ef
jmp 0x85a3e3
jmp 0x85a6b6
cmp dword [esi], 0x44444158
jne 0x85a610
cmp byte [esi + 4], 3
je 0x85a60b
jmp 0x85a3e3
jmp 0x85a6b6
cmp dword [esi], 0x47484358
jne 0x85a62c
cmp byte [esi + 4], 3
je 0x85a627
jmp 0x85a3e3
jmp 0x85a6b6
cmp word [esi], 0x4f58
jne 0x85a654
cmp byte [esi + 2], 0x52
jne 0x85a64a
cmp byte [esi + 3], 3
je 0x85a648
jmp 0x85a3e3
jmp 0x85a64f
jmp 0x85a3e3
jmp 0x85a6b6
cmp dword [esi], 0x58504d43
jne 0x85a6b1
cmp word [esi + 4], 0x4843
jne 0x85a6a7
cmp byte [esi + 6], 0x47
jne 0x85a69d
cmp byte [esi + 7], 3
jne 0x85a67e
jmp 0x85a698
cmp word [esi + 7], 0x4238
jne 0x85a693
cmp byte [esi + 9], 3
je 0x85a691
jmp 0x85a3e3
jmp 0x85a698
jmp 0x85a3e3
jmp 0x85a6a2
jmp 0x85a3e3
jmp 0x85a6ac
jmp 0x85a3e3
jmp 0x85a6b6
jmp 0x85a3e3
pop esi
ret
Function at 0x861aac
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push dword [0x812290]
call fcn.0085e94d
test ax, 0x100
je 0x861b13
cmp byte [ebx], 0x42
je 0x861ad6
cmp byte [ebx], 0x57
je 0x861ad6
jmp 0x861ae6
push 0x2000
push 1
call fcn.00861458
jmp 0x861aeb
cmp byte [ebx], 0x44
jne 0x861b02
cmp byte [ecx + 2], 3
je 0x861af8
push dword [ecx]
call fcn.0085f785
push dword [ebp + 0x10]
call fcn.00861c17
jmp 0x861b0e
pushal
popal
mov eax, str.Invalid_index_type.
jmp fcn.0086e2d2
jmp 0x861c11
test ax, 0x2000
je 0x861b77
cmp byte [ecx + 2], 3
je 0x861b69
cmp byte [ecx], 0x54
jne 0x861b2d
jmp 0x861aeb
mov byte [ebx - 1], 0x70
test ax, 4
je 0x861b50
lea edi, [ebx + 3]
push 2
call fcn.0085f443
mov byte [ebx + 3], 0x78
push ecx
call fcn.00861edd
mov byte [ebx + 4], al
jmp 0x861b67
lea edi, [ebx + 2]
push 2
call fcn.0085f443
mov byte [ebx + 2], 0x78
push ecx
call fcn.00861edd
mov byte [ebx + 3], al
jmp 0x861b72
mov edi, ebx
push 1
call fcn.0085f484
jmp 0x861c11
test ax, 0x4000
je 0x861c05
cmp byte [ecx + 2], 3
je 0x861bf4
cmp byte [ecx], 0x54
jne 0x861b95
jmp 0x861aeb
cmp byte [ebx - 2], 0x70
je 0x861be6
mov byte [ebx - 1], 0x70
mov edi, ebx
push 3
call fcn.0085f443
mov byte [ebx], 3
mov byte [ebx + 1], 0xd
mov byte [ebx + 2], 3
add ebx, 3
cmp byte [ebx], 3
jbe 0x861bbe
inc ebx
jmp 0x861bb6
inc ebx
mov edi, ebx
push 6
call fcn.0085f443
mov byte [ebx], 8
mov byte [ebx + 1], 3
push ecx
call fcn.00861edd
mov byte [ebx + 2], al
mov byte [ebx + 3], 3
mov byte [ebx + 4], 0xc
mov byte [ebx + 5], 3
jmp 0x861bef
mov edi, ebx
push 1
call fcn.0085f484
jmp 0x861c00
pushal
popal
mov eax, str.Invalid_address.
jmp fcn.0086e2d2
jmp 0x861c11
pushal
popal
mov eax, str.Invalid_index_type.
jmp fcn.0086e2d2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x8633a9
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
cmp byte [edi + 2], 0xf
jne 0x863444
cmp byte [edi + 1], 0x42
je 0x8633cf
cmp byte [edi + 1], 0x57
je 0x8633cf
jmp 0x8633de
mov dword [0x8122ac], 0x494df0
jmp 0x86343f
cmp byte [edi + 1], 0x44
jne 0x8633f7
mov dword [0x8122ac], 0x494e00
jmp 0x86343f
cmp byte [edi + 1], 0x46
je 0x86341a
cmp byte [edi + 1], 0x52
je 0x86341a
cmp byte [edi + 1], 0x54
je 0x86341a
jmp 0x863433
push str.SUB_ESP_04___ESI_000FLD_1FISTP_D__
call fcn.0085ef3a
mov dword [0x8122ac], 0x494e38
jmp 0x86343f
pushal
popal
mov eax, str.Source_expression_is_invalid.
jmp fcn.0086e2d2
jmp 0x86348e
cmp word [edi + 1], 0x7473
jne 0x863469
push str.SUB_ESP_04___ESI_000FISTP_D__
call fcn.0085ef3a
mov dword [0x8122ac], 0x494e6c
jmp 0x86348e
lea eax, [edi + 1]
push eax
call fcn.00861db4
test ax, 3
je 0x863484
mov dword [0x8122a8], 0x494e7c
jmp 0x86348e
mov dword [0x8122a8], 0x494e8c
mov esp, ebp
pop ebp
ret

Function at 0x863492
Capabilities:
Parse credit card information

Disassembly:
cmp byte [edi + 2], 0xf
jne 0x863577
push 0x494e9a
call fcn.0085ef3a
cmp byte [edi + 1], 0x42
je 0x8634b5
jmp 0x8634c8
push 0x100
push 1
call fcn.00861458
jmp 0x8634eb
cmp byte [edi + 1], 0x57
je 0x8634eb
cmp byte [edi + 1], 0x44
je 0x8634eb
cmp byte [edi + 1], 0x51
je 0x8634eb
jmp 0x863517
cmp word [0x811fc2], 0x3754
jne 0x863502
push str.FFREE_ST7FILD_1FINCSTP
call fcn.0085ef3a
jmp 0x863512
inc byte [0x811fc3]
push str.FILD_1FSTP_2
call fcn.0085ef3a
jmp 0x863572
cmp byte [edi + 1], 0x52
je 0x86353a
cmp byte [edi + 1], 0x46
je 0x86353a
cmp byte [edi + 1], 0x54
je 0x86353a
jmp 0x863566
cmp word [0x811fc2], 0x3754
jne 0x863551
push 0x494ed3
call fcn.0085ef3a
jmp 0x863561
inc byte [0x811fc3]
push 0x494eed
call fcn.0085ef3a
jmp 0x863572
pushal
popal
mov eax, str.Source_expression_is_invalid.
jmp fcn.0086e2d2
jmp 0x863655
cmp word [edi + 1], 0x7473
jne 0x8635d8
push str.SUB_ESP_0A___ESI_000FSTP_T__
call fcn.0085ef3a
push 0
push 0x54
push 1
call fcn.0085f12b
mov dword [0x812294], 0x811fc1
push 0x494f1f
call fcn.0085ef3a
cmp word [0x811fc2], 0x3754
jne 0x8635c3
push str.FFREE_ST7FLD_1FINCSTP
call fcn.0085ef3a
jmp 0x8635d3
inc byte [0x811fc3]
push str.FLD_1FSTP_2
call fcn.0085ef3a
jmp 0x863655
push str.FRSTOR_X__7
call fcn.0085ef3a
cmp word [0x811fc2], 0x3754
jne 0x8635f7
push str.FFREE_ST7
call fcn.0085ef3a
lea eax, [edi + 1]
push eax
call fcn.00861db4
test ax, 3
je 0x863612
push str.SUB_ESP_04___ESI_000MOVZX_EAX_1MOV_D___EAXFILD_D__
call fcn.0085ef3a
jmp 0x86362e
test ax, 4
je 0x863624
push str.SUB_ESP_04___ESI_000MOV_D___1FILD_D__
call fcn.0085ef3a
jmp 0x86362e
push str.__:R__1FLD_R__
call fcn.0085ef3a
cmp word [0x811fc2], 0x3754
jne 0x863645
push str.FINCSTP
call fcn.0085ef3a
jmp 0x863655
inc byte [0x811fc3]
push str.FSTP_2
call fcn.0085ef3a
ret
Function at 0x86609c
Capabilities:
Get file size
Read file on windows

Disassembly:
pushal
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x81351c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x813620], eax
cmp eax, 0xffffffff
jne 0x8660d9
mov eax, str.IncIncluder:_File_not_found_
call fcn.0084a000
popal
mov eax, 0
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x813624], eax
add eax, 4
mov ebx, 0x813628
mov edx, eax
call fcn.0084b515
mov ebx, dword [0x813628]
mov dword [ebx], 0xa0d0a0d
add dword [0x813628], 4
push 0
push 0x4319c0
push dword [0x813624]
push dword [0x813628]
push dword [0x813620]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x813620]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
popal
mov eax, 1
ret

Function at 0x8663d1
Capabilities:
Get file size
Read file on windows

Disassembly:
call fcn.00866548
mov esi, dword [0x5097dc]
mov edi, dword [0x5097e4]
mov ecx, esi
add ecx, dword [0x508b78]
mov dword [0x81362c], ecx
cmp esi, dword [0x81362c]
jae 0x866523
cmp dword [esi], 0x494e4942
jne 0x86651d
cmp dword [esi + 4], 0x554c434e
jne 0x86651d
cmp word [esi + 8], 0x4544
jne 0x86651d
cmp byte [esi - 1], 0x14
jne 0x86651d
add esi, 0xa
inc esi
cmp byte [esi], 0x20
jbe 0x86642e
mov edx, 0x81351c
mov al, byte [esi]
mov byte [edx], al
inc esi
inc edx
cmp byte [esi], 0x20
ja 0x866439
mov byte [edx], 0
pushal
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x81351c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x813620], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x813624], eax
mov ebx, 0x813628
mov edx, eax
call fcn.0084b515
push 0
push 0x4319c0
push dword [0x813624]
push eax
push dword [0x813620]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x813620]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
popal
push esi
mov esi, 0x81351c
movsb byte es:[edi], byte [esi]
cmp dword [esi], 0
jne 0x8664b1
pop esi
movsb byte es:[edi], byte [esi]
mov al, 0x42
stosb byte es:[edi], al
mov al, 0xf
stosb byte es:[edi], al
push esi
mov esi, dword [0x813628]
mov ecx, dword [0x813624]
movzx eax, byte [esi]
inc esi
call fcn.008b01e2
mov al, 3
stosb byte es:[edi], al
loop 0x8664cc
mov esi, 0x81351c
cmp byte [esi], 0
jbe 0x8664e7
movsb byte es:[edi], byte [esi]
jmp 0x8664df
mov dword [edi], 0x3a4e454c
mov byte [edi + 3], 0xe
add edi, 4
mov dword [edi], 0x5d4e454c
add edi, 3
push edi
cmp dword [0x813628], 0
je 0x86651b
mov eax, dword [0x813628]
call fcn.0084b661
mov dword [0x813628], 0
pop edi
pop esi
movsb byte es:[edi], byte [esi]
jmp 0x8663f0
sub edi, dword [0x5097e4]
mov dword [0x508b78], edi
push dword [0x5097dc]
push dword [0x5097e4]
pop dword [0x5097dc]
pop dword [0x5097e4]
ret
Function at 0x866548
Capabilities:
Get file size

Disassembly:
mov byte [0x813648], 9
mov esi, dword [0x5097dc]
mov dword [0x813630], 0
mov ecx, esi
add ecx, dword [0x508b78]
mov dword [0x81362c], ecx
cmp esi, dword [0x81362c]
jae 0x86663f
cmp dword [esi], 0x494e4942
jne 0x866639
cmp dword [esi + 4], 0x554c434e
jne 0x866639
cmp word [esi + 8], 0x4544
jne 0x866639
cmp byte [esi - 1], 0x14
jne 0x866639
add esi, 0xa
inc esi
cmp byte [esi], 0x20
jbe 0x8665ab
mov edx, 0x81351c
mov al, byte [esi]
mov byte [edx], al
inc esi
inc edx
cmp byte [esi], 0x20
ja 0x8665b6
mov byte [edx], 0
cmp byte [esi], 0xe
je 0x8665d7
pushal
popal
mov eax, str.Bad_BININCLUDE_syntax
jmp fcn.0086e2d2
cmp byte [esi + 1], 0x13
je 0x8665e9
pushal
popal
mov eax, str.Bad_BININCLUDE_syntax
jmp fcn.0086e2d2
pushal
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x81351c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x813620], eax
cmp eax, 0xffffffff
jne 0x86661d
pushal
popal
mov eax, str.BinIncluder:_File_not_found_
jmp fcn.0086e2d2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add dword [0x813630], eax
push dword [0x813620]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
popal
inc esi
jmp 0x86656d
shl dword [0x813630], 2
cmp dword [0x813630], 0x7a120
jbe 0x866725
mov eax, dword [0x4319b4]
add eax, 0xf4240
add eax, dword [0x813630]
push eax
mov ebx, 0x813634
mov edx, eax
call fcn.0084b515
add dword [0x813634], 0x10
pop eax
mov ebx, 0x813638
mov edx, eax
call fcn.0084b515
add dword [0x813638], 0x10
mov ecx, dword [0x4319b4]
add ecx, 3
and ecx, 0xfffffffc
shr ecx, 2
push ecx
mov esi, dword [0x5097dc]
mov edi, dword [0x813634]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, dword [0x5097e4]
mov edi, dword [0x813638]
rep movsd dword es:[edi], dword [esi]
push dword [0x5097dc]
push dword [0x813634]
pop dword [0x5097dc]
pop dword [0x813634]
push dword [0x5097e4]
push dword [0x813638]
pop dword [0x5097e4]
pop dword [0x813638]
cmp dword [0x813634], 0
je 0x866708
mov eax, dword [0x813634]
call fcn.0084b661
mov dword [0x813634], 0
cmp dword [0x813638], 0
je 0x866725
mov eax, dword [0x813638]
call fcn.0084b661
mov dword [0x813638], 0
ret
Function at 0x86ee83
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push str.TestMem.tst
push dword [ebp + 8]
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x8136e4], eax
push dword [ebp + 8]
push 0
push 0
push 0xf001f
push dword [0x8136e4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x8136e8], eax
ret

Function at 0x86fd21
Capabilities:
Get common file path

Disassembly:
push 0x813d78
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0
je 0x86fd64
mov edi, 0x813d78
add edi, eax
mov al, 0x5c
cmp byte [edi - 1], al
je 0x86fd45
stosb byte es:[edi], al
mov esi, str.Equates.equ
cmp byte [esi], 0
je 0x86fd52
movsb byte es:[edi], byte [esi]
jmp 0x86fd4a
mov esi, 0x813d78
mov edi, str.Equates.equ
cmp byte [esi], 0
je 0x86fd64
movsb byte es:[edi], byte [esi]
jmp 0x86fd5c
ret

Function at 0x86fe33
Capabilities:
Enumerate files on windows

Disassembly:
push 0x7571652e
call fcn.0086fb6b
push 0x4461c8
push 0x813c64
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call fcn.0086fd65
mov dword [0x813e88], eax
mov dword [0x813e7c], 0
mov eax, dword [0x4461e8]
add dword [0x813e7c], eax
push 0x4461c8
push dword [0x813e88]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
call fcn.0086fd65
cmp eax, 1
jne 0x86fe89
jmp 0x86fe61
mov ebx, 0x813e80
mov edx, dword [0x813e7c]
call fcn.0084b515
push dword [0x813e88]
call dword [sym.imp.KERNEL32.dll_FindClose]
ret

Function at 0x86fea6
Capabilities:
Get file size
Read file on windows

Disassembly:
call fcn.0086fdad
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x813c64
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4319c0], 0
push eax
push eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
cmp ecx, 0
jne 0x86fee7
pop eax
jmp 0x86ff09
add eax, dword [0x813e80]
mov dword [0x813e84], eax
pop eax
push 0
push 0x4319c0
push ecx
push dword [0x813e80]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop eax
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x86ff34
Capabilities:
Enumerate files on windows
Read file on windows
Terminate process

Disassembly:
push 0x7571652e
call fcn.0086fb6b
push 0x4461c8
push 0x813c64
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
call fcn.0086fd65
push 0xffffffffffffffff
mov dword [0x813e88], eax
call fcn.0086ff11
je 0x86ff85
mov eax, dword [0x4461e8]
push eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x813e8c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
push 0x4461c8
push dword [0x813e88]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
call fcn.0086fd65
cmp eax, 1
jne 0x86ffa2
jmp 0x86ff5a
mov dword [0x4319c0], 0
mov edi, dword [0x813e84]
pop eax
cmp eax, 0xffffffff
jne 0x86ffba
jmp 0x86fff8
pop ecx
push edi
push ecx
push eax
push 0
push 0x4319c0
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop eax
pop ecx
pop edi
add edi, ecx
cmp word [edi - 2], 0xa0d
je 0x86ffe0
jmp 0x8700f9
cmp word [edi - 4], 0xa0d
jne 0x86ffed
jmp 0x8700f9
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
jmp 0x86ffb2
push dword [0x813e88]
call dword [sym.imp.KERNEL32.dll_FindClose]
ret
push 0
push str.Bad_Equates_File
push str.The_Equates_File_must_be_ended_by_one_CR_FL
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x870048
Capabilities:
Terminate process

Disassembly:
mov edx, dword [0x813e80]
add edx, dword [0x813e7c]
cmp word [edx - 2], 0xa0d
je 0x870061
jmp 0x8700f9
cmp word [edx - 4], 0xa0d
jne 0x87006e
jmp 0x8700f9
mov esi, dword [0x813e80]
mov ecx, 0
cmp esi, edx
jae 0x8700bd
mov ebx, esi
cmp byte [esi], 0x20
jbe 0x87008b
inc esi
jmp 0x870083
cmp byte [esi], 0x20
je 0x870095
jmp 0x8700c4
inc esi
cmp byte [esi], 0x30
je 0x8700a0
jmp 0x8700c4
cmp byte [esi], 0x20
jbe 0x8700a8
inc esi
jmp 0x8700a0
cmp word [esi], 0xa0d
je 0x8700b4
jmp 0x8700c4
add esi, 2
inc ecx
jmp 0x870079
mov dword [0x81429c], ecx
ret
mov esi, ebx
mov edi, 0x8142a0
cmp byte [esi], 0x20
jbe 0x8700d3
movsb byte es:[edi], byte [esi]
jmp 0x8700cb
mov dword [edi], 0x2e2e2e
mov byte [edi + 4], 0
push 0
push str.Bad_Equates_File
push 0x8142a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x87038b
Capabilities:
Get file size
Read file on windows

Disassembly:
pushal
mov esi, str.Equates.equ
mov edi, 0x813c64
cmp byte [esi], 0
je 0x87039e
movsb byte es:[edi], byte [esi]
jmp 0x870396
dec edi
cmp byte [edi], 0x2e
je 0x8703a7
dec edi
jmp 0x87039f
dec edi
cmp byte [edi], 0x5c
je 0x8703bc
cmp byte [edi], 0x3a
je 0x8703bc
cmp edi, 0x813c64
ja 0x8703a7
jmp 0x8703bd
inc edi
mov dword [edi], 0x636e7546
mov dword [edi + 4], 0x6e6f6974
mov dword [edi + 8], 0x70612e73
mov byte [edi + 0xc], 0x69
mov byte [edi + 0xd], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x813c64
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x87041f
push str._r_nCopy_B_U_Asm.exe_in_this_directory_or_run:_r_n_r_n_Configuration__menu_option._r_n_r_n_r_nIf_this_is_for_a_first_run__select:_r_n_r_n_Configuration__Companion_Files__and_provide_the_Path_to:_r_n_r_n__B_U_Asm.exe__r_n_r_nThen_provide_the_Path_to:_________r_n_r_n__Equates_Path__r_n_r_nAfter_this__RosAsm_will_shut_down__and_will_be_ready_r_nfor_a_first_Run._r_n_r_n
push str.Include_Files
push str.B_U_Asm.exe
call fcn.008850ab
mov byte [0x816a2c], 0
jmp 0x87047a
mov dword [0x816a28], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x816a24], eax
mov ebx, 0x814ae0
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x816a24]
push dword [0x814ae0]
push dword [0x816a28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [0x816a2c], 1
push dword [0x816a28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
popal
ret