joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472c20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x881d52
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [0xba37c1]
test eax, eax
je 0x472c56
mov dword [ebp - 0x34], 0x8a23d4
jmp 0x472c5d
mov dword [ebp - 0x34], 0x8a2400
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
push 2
push 0
push 0
push 0
mov edx, dword [ebp - 0x34]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x472d86
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0x10]
sub edx, dword [ecx + 0xc]
sar edx, 2
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
shl eax, 2
mov dword [ebp - 0x1c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00822266
add esp, 4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x472cec
mov dword [ebp - 0x2c], 0xffffffff
push 0xb69a64
lea edx, [ebp - 0x2c]
push edx
call fcn.0083d8fb
mov dword [ebp - 0x24], 0
jmp 0x472cfe
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x20]
jge 0x472d3a
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 0x10]
sub ecx, dword [eax + 0xc]
sar ecx, 2
cmp dword [ebp - 0x24], ecx
jb 0x472d1f
call fcn.0083d831
xor edx, edx
jne 0x472d1f
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x472cf5
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 3
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call fcn.0082225b
add esp, 4
jmp 0x472d7f
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movsd xmm0, qword [0x891db0]
movsd qword [ebp - 0x10], xmm0
movzx eax, byte [0xba37c1]
test eax, eax
je 0x472dc7
mov dword [ebp - 0x1c], 0x8a2428
jmp 0x472dce
mov dword [ebp - 0x1c], 0x8a2454
lea ecx, [ebp - 4]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x1c]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x472e16
mov dword [ebp - 0x18], 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fld qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x472e20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, byte [0xba37c1]
test eax, eax
je 0x472e3a
mov dword [ebp - 8], 0x8a247c
jmp 0x472e41
mov dword [ebp - 8], 0x8a24a8
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 2
push 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x472e86
push 8
lea eax, [ebp + 0xc]
push eax
push 3
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x472e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 8], 0xc8
mov byte [ebp - 0xd8], 0
movzx eax, byte [0xba37c1]
test eax, eax
je 0x472ebe
mov dword [ebp - 0x128], 0x8a24d0
jmp 0x472ec8
mov dword [ebp - 0x128], 0x8a24fc
lea ecx, [ebp - 4]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x128]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x472f1f
mov dword [ebp - 0xe0], 0xc8
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0xdc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xd8]
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
add ecx, 1
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp - 0x12c]
mov al, byte [edx]
mov byte [ebp - 0x131], al
add dword [ebp - 0x12c], 1
cmp byte [ebp - 0x131], 0
jne 0x472f3a
mov ecx, dword [ebp - 0x12c]
sub ecx, dword [ebp - 0x130]
mov dword [ebp - 0x138], ecx
mov edx, dword [ebp - 0x138]
push edx
lea eax, [ebp - 0xd8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0041cda0
mov esp, ebp
pop ebp
ret
Function at 0x472f90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [0xba37c1]
test eax, eax
je 0x472faa
mov dword [ebp - 8], 0x8a2524
jmp 0x472fb1
mov dword [ebp - 8], 0x8a2550
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 2
push 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x473025
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 0x11], al
add dword [ebp - 0xc], 1
cmp byte [ebp - 0x11], 0
jne 0x472fe3
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
add edx, 1
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x473030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x881d64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x158
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ecx, dword [ebp + 0xc]
call fcn.00475ab0
movzx eax, byte [0xba37c1]
test eax, eax
je 0x473074
mov dword [ebp - 0x150], 0x8a2578
jmp 0x47307e
mov dword [ebp - 0x150], 0x8a25a4
lea ecx, [ebp - 0x14]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x150]
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47325f
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x1c], 0
jbe 0x473255
cmp dword [ebp - 0x18], 7
jne 0x473255
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00822266
add esp, 4
mov dword [ebp - 0x154], eax
mov edx, dword [ebp - 0x154]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x473118
mov dword [ebp - 0x2c], 0xffffffff
push 0xb69a64
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0083d8fb
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
cmp dword [ebp - 0x24], ecx
jae 0x47322d
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0xc8], edx
lea eax, [ebp - 0xb1]
mov dword [ebp - 0xb0], eax
push 0
push 0
lea ecx, [ebp - 0x48]
call fcn.0041ccf0
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x158]
add edx, 1
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp - 0x158]
mov cl, byte [eax]
mov byte [ebp - 0x15d], cl
add dword [ebp - 0x158], 1
cmp byte [ebp - 0x15d], 0
jne 0x473189
mov edx, dword [ebp - 0x158]
sub edx, dword [ebp - 0x15c]
mov dword [ebp - 0x164], edx
mov eax, dword [ebp - 0x164]
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0x48]
call fcn.0041cda0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x48]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.004759a0
mov byte [ebp - 4], 0
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.0041ccf0
mov ecx, dword [ebp + 0xc]
call fcn.00475920
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0x148]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x14c], edx
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x24], edx
jmp 0x47313b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.0082225b
add esp, 4
jmp 0x47324e
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48de90
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.00840340
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x201c], eax
mov ecx, dword [ebp - 0x201c]
add ecx, 1
mov dword [ebp - 0x2020], ecx
mov edx, dword [ebp - 0x201c]
mov al, byte [edx]
mov byte [ebp - 0x2021], al
add dword [ebp - 0x201c], 1
cmp byte [ebp - 0x2021], 0
jne 0x48deb5
mov ecx, dword [ebp - 0x201c]
sub ecx, dword [ebp - 0x2020]
mov dword [ebp - 0x2028], ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x2028]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nContent_type:_application_x_www_form_urlencoded_r_nContent_length:___d_r_n_r_n_s
push 0xc8
lea eax, [ebp - 0x2018]
push eax
call fcn.0083e255
add esp, 0x1c
lea ecx, [ebp - 0x2018]
mov dword [ebp - 0x202c], ecx
mov edx, dword [ebp - 0x202c]
add edx, 1
mov dword [ebp - 0x2030], edx
mov eax, dword [ebp - 0x202c]
mov cl, byte [eax]
mov byte [ebp - 0x2031], cl
add dword [ebp - 0x202c], 1
cmp byte [ebp - 0x2031], 0
jne 0x48df2c
mov edx, dword [ebp - 0x202c]
sub edx, dword [ebp - 0x2030]
mov dword [ebp - 0x2038], edx
push 0
mov eax, dword [ebp - 0x2038]
push eax
lea ecx, [ebp - 0x2018]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0
push 0x1000
lea eax, [ebp - 0x1008]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
jle 0x48dfc3
mov edx, dword [ebp - 0x100c]
mov byte [ebp + edx - 0x1008], 0
lea eax, [ebp - 0x1008]
push eax
push 0x8a8da0
push 0
call fcn.00476e30
add esp, 0xc
jmp 0x48df76
mov eax, dword [ebp - 0x100c]
mov esp, ebp
pop ebp
ret
Function at 0x49f610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov dword [ebp - 0xbc], ecx
call fcn.008237ce
mov eax, dword [eax + 8]
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 4], ecx
push 0x10
push 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49f7bf
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x49f7bf
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x20
jmp 0x49f68b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x40
jge 0x49f6a3
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x10]
cmp dword [ecx], 0xfeef04bd
jne 0x49f6a1
jmp 0x49f6a3
jmp 0x49f682
cmp dword [ebp - 0x10], 0x40
jge 0x49f7b5
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 2]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 6]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x49f70d
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
push str._d._d._d._d
lea edx, [ebp - 0x90]
push edx
call fcn.0083d947
add esp, 0x18
jmp 0x49f751
cmp dword [ebp - 0x1c], 0
je 0x49f735
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push str._d._d._d
lea eax, [ebp - 0x90]
push eax
call fcn.0083d947
add esp, 0x14
jmp 0x49f751
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push str._d._d
lea eax, [ebp - 0x90]
push eax
call fcn.0083d947
add esp, 0x10
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0xc0]
add edx, 1
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0xc0]
mov cl, byte [eax]
mov byte [ebp - 0xc5], cl
add dword [ebp - 0xc0], 1
cmp byte [ebp - 0xc5], 0
jne 0x49f76c
mov edx, dword [ebp - 0xc0]
sub edx, dword [ebp - 0xc4]
mov dword [ebp - 0xcc], edx
mov eax, dword [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x90]
push ecx
mov ecx, dword [ebp - 0xbc]
call fcn.0041cda0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esp, ebp
pop ebp
ret
Function at 0x4b6690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8832fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xe4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xec], ecx
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
call fcn.008237ce
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x88], ecx
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4b675f
mov dword [ebp - 0x98], 0xffffff94
mov dword [ebp - 0x94], 0
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], eax
push 0xb69d6c
lea ecx, [ebp - 0x90]
push ecx
call fcn.0083d8fb
mov edx, dword [ebp - 0x84]
push edx
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x50]
call fcn.00564410
mov dword [ebp - 0xf4], eax
mov byte [ebp - 4], 1
lea edx, [ebp - 0xa1]
mov dword [ebp - 0xa0], edx
push 0
push 0
lea ecx, [ebp - 0x80]
call fcn.0041ccf0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x80]
call fcn.00449a80
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xec]
push edx
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x50]
call fcn.00564450
mov byte [ebp - 0x15], 1
mov byte [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.0041ccf0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00564430
jmp 0x4b6808
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x4b681f
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bc100
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x2c], 0
je 0x4bc124
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.004bcc10
jmp 0x4bc1a1
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x4bc1a1
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4bc178
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4bc178
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
push 0xb6f1d8
lea edx, [ebp - 0x10]
push edx
call fcn.0083d8fb
cmp dword [ebp - 0xc], 0
jne 0x4bc1a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4bc1a1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
push 0xb6f1d8
lea ecx, [ebp - 0x18]
push ecx
call fcn.0083d8fb
mov esp, ebp
pop ebp
ret 8

Function at 0x4bc1b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x2c], 0
je 0x4bc1d4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.004bcca0
jmp 0x4bc253
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x4bc253
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4bc228
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4bc228
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
push 0xb6f1d8
lea edx, [ebp - 0x10]
push edx
call fcn.0083d8fb
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
je 0x4bc253
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4bc253
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
push 0xb6f1d8
lea edx, [ebp - 0x18]
push edx
call fcn.0083d8fb
mov esp, ebp
pop ebp
ret 8
Function at 0x4bc3b0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x2c], 0
je 0x4bc3cc
mov ecx, dword [ebp - 0x10]
call fcn.004bcdd0
jmp 0x4bc419
mov ecx, dword [ebp - 0x10]
call fcn.004bc340
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004bc260
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4bc419
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4bc419
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
push 0xb6f1d8
lea edx, [ebp - 8]
push edx
call fcn.0083d8fb
mov esp, ebp
pop ebp
ret

Function at 0x4bc4c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x4bc4da
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], edx
jmp 0x4bc4e3
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4bc51a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4bc51a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push 0xb6f1d8
lea ecx, [ebp - 8]
push ecx
call fcn.0083d8fb
mov esp, ebp
pop ebp
ret

Function at 0x4bc520
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x4bc53a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], edx
jmp 0x4bc543
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x4bc57e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4bc57e
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
push 0xb6f1d8
lea edx, [ebp - 8]
push edx
call fcn.0083d8fb
mov esp, ebp
pop ebp
ret
Function at 0x524390
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0xba5d7c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [0xba5d80]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x524405
cmp dword [ebp - 4], 0
jle 0x524405
mov byte [0xba5d4e], 1
push 0xba5d45
push 0xba5db0
mov ecx, 0xba5fa4
call fcn.00528750
push eax
push 0xba5da8
push 0xba5d60
push 0xba5d74
call fcn.00471410
push eax
movzx ecx, byte [ebp + 8]
push ecx
call fcn.00473510
add esp, 0x20
jmp 0x5244ee
push str.LS3FrameData
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5244ee
mov dword [ebp - 0x2c], 0xba5fa4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x10]
sub ecx, dword [eax + 0xc]
mov eax, ecx
cdq
mov ecx, 0x2c
idiv ecx
neg eax
sbb eax, eax
add eax, 1
movzx edx, al
neg edx
sbb edx, edx
add edx, 1
movzx eax, dl
test eax, eax
je 0x52449d
mov dword [ebp - 0x74], str.Currently_working_with_files_from_Lightroom._Canceling_Looks_plug_in_edit_request.
mov ecx, dword [ebp - 0x74]
add ecx, 1
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x74]
mov al, byte [edx]
mov byte [ebp - 0x79], al
add dword [ebp - 0x74], 1
cmp byte [ebp - 0x79], 0
jne 0x524466
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp - 0x78]
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp - 0x80]
push edx
push str.Currently_working_with_files_from_Lightroom._Canceling_Looks_plug_in_edit_request.
mov ecx, 0xba5db0
call fcn.0041cda0
mov byte [0xba5d4d], 1
jmp 0x5244e4
mov byte [0xba5d4e], 1
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5244e4
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, 0xba5f00
call fcn.00526010
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0xba5d4e], 0
mov esp, ebp
pop ebp
ret