joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x94
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x65]
mov byte [esp + 0x64], 0
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x64]
push eax
push 0x252a
call fcn.00493e00
mov ecx, eax
call fcn.00490510
push eax
mov ecx, ebx
call fcn.00482680
test eax, eax
jge 0x481a7c
lea ecx, [esp + 0x64]
push ecx
call fcn.00493e00
mov ecx, eax
call fcn.00491b50
lea edx, [esp + 0x64]
push 0x40
push edx
call fcn.00479e60
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x4d]
mov byte [esp + 0x4c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x4c]
push eax
call fcn.00482710
mov ebp, dword [ebx + 0x4390]
add esp, 0xc
cmp ebp, 0xa0
mov dword [esp + 0x14], eax
jae 0x481c30
lea eax, [ebp + ebp*2]
lea ecx, [eax + eax*8]
lea edi, [ebx + ecx*4 + 0xc]
lea ecx, [edi - 4]
call fcn.0047fee0
test eax, eax
je 0x481b0a
mov esi, edi
lea eax, [esp + 0x64]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x481b01
test cl, cl
je 0x481afd
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x481b01
add eax, 2
add esi, 2
test cl, cl
jne 0x481add
xor eax, eax
jmp 0x481b06
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x481b1b
inc ebp
add edi, 0x6c
cmp ebp, 0xa0
jb 0x481acb
jmp 0x481c30
mov ecx, ebx
call fcn.004822e0
mov edi, eax
mov edx, dword [esp + 0x14]
lea eax, [ebp + ebp*2]
lea ecx, [esp + 0x44]
push ecx
push edx
lea eax, [eax + eax*8]
lea esi, [ebx + eax*4]
lea ecx, [esi + 8]
call fcn.00480640
test eax, eax
jne 0x481b64
test edi, edi
je 0x481b57
mov ecx, 0x6969c0
call fcn.004b4120
test dword [edi + 0x28], eax
jne 0x481b64
mov dword [esp + 0x10], 2
jmp 0x481c30
push 0x2524
call fcn.00493e00
mov ecx, eax
call fcn.004905d0
mov ecx, ebx
mov dword [esi + 0x34], eax
call fcn.00482040
mov ecx, 0x20
mov eax, 0x65
mov word [esp + 0x24], cx
mov word [esp + 0x2e], cx
mov word [esp + 0x22], ax
mov word [esp + 0x2a], ax
mov ecx, 0x63
mov word [esp + 0x38], ax
mov word [esp + 0x42], ax
lea eax, [esp + 0x18]
mov esi, 0x61
mov edx, 0x6e
mov word [esp + 0x30], cx
mov word [esp + 0x36], cx
push 0x16
push eax
mov ecx, ebx
mov word [esp + 0x20], 0x43
mov word [esp + 0x22], 0x68
mov word [esp + 0x24], si
mov word [esp + 0x26], dx
mov word [esp + 0x28], 0x67
mov word [esp + 0x2e], 0x75
mov word [esp + 0x30], 0x73
mov word [esp + 0x34], 0x72
mov word [esp + 0x3a], si
mov word [esp + 0x3c], dx
mov word [esp + 0x42], 0x6c
mov word [esp + 0x44], 0x74
mov word [esp + 0x46], 0x69
mov word [esp + 0x48], 0x6d
call fcn.00482350
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push ecx
push 0x251e
call fcn.00493e00
mov ecx, eax
call fcn.004906f0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
Function at 0x482080
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x28]
push ebx
push esi
push edi
mov edi, ecx
push 0x585050
push eax
mov dword [esp + 0x14], edi
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x482146
push ebp
lea ecx, [esp + 0x14]
call fcn.0047ffa0
push esi
push 1
lea ecx, [esp + 0x1c]
push 0x20
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, 0x6c
mov ebp, 0x6c
jg 0x4820d8
mov ebp, eax
sub eax, ebp
mov ebx, eax
mov eax, dword [esp + 0x14]
cmp eax, 0x40
jl 0x4820ea
mov eax, 0x40
test eax, eax
jle 0x482126
add edi, 8
mov dword [esp + 0x38], eax
push esi
push 1
push ebp
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test ebx, ebx
jle 0x482114
push 1
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov eax, dword [esp + 0x38]
add edi, 0x6c
dec eax
mov dword [esp + 0x38], eax
jne 0x4820f5
mov edi, dword [esp + 0x10]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, edi
call fcn.00482040
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x24
ret 4
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x24
ret 4

Function at 0x482160
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20
push ebx
push esi
push edi
push 0x58518c
mov ebx, ecx
push eax
xor edi, edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4821d7
lea ecx, [esp + 0xc]
call fcn.0047ffa0
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
push esi
push 1
lea ecx, [esp + 0x14]
push 0x20
push ecx
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x20], 0x6c
call edi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push esi
push edx
add ebx, 8
push eax
push ebx
call edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4

Function at 0x482910
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 0
mov ecx, dword [0x67a8cc]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
push edx
push 1
push 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
mov eax, esi
pop esi
ret 4
Function at 0x482950
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 4]
test eax, eax
jle 0x4829d1
mov eax, dword [esp + 0x10]
push 0x58518c
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4829d1
mov ecx, dword [esi + 4]
push ecx
call fcn.00478f00
mov edx, dword [esi + 8]
mov edi, eax
mov eax, dword [0x67a8cc]
push 0
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
mov edx, dword [esi + 4]
push ecx
push edx
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 4]
push ebx
push eax
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
push edi
call fcn.00478f60
add esp, 0x38
mov eax, 1
pop edi
pop esi
pop ebx
ret 4
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x482a00
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
je 0x482ae3
push edi
push eax
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0x34
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
lea edx, [esi + 4]
push edx
push 0x252b
call fcn.00493e00
mov ecx, eax
call fcn.00490570
lea eax, [esi + 6]
push eax
push 0x252c
call fcn.00493e00
mov ecx, eax
call fcn.00490570
test byte [esi], 8
je 0x482a8b
push 0x24
call fcn.004784b0
add esp, 4
cmp eax, edi
je 0x482a84
lea ecx, [esi + 0xc]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
mov dword [esi + 0x28], eax
jmp 0x482a8e
xor eax, eax
mov dword [esi + 0x28], eax
jmp 0x482a8e
mov dword [esi + 0x28], edi
lea eax, [esi + 0x2c]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov eax, dword [esi]
test dword [0x67a8fc], eax
jne 0x482aa8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
test dword [0x67a900], eax
je 0x482ae0
cmp dword [esi + 0x24], edi
je 0x482ae3
push 0xc
call sub.MFC42u.DLL_operatornew
add esp, 4
cmp eax, edi
je 0x482ad6
mov ecx, dword [esi + 0x24]
push ecx
mov ecx, eax
call fcn.00482910
mov dword [esi + 0x24], eax
pop edi
pop esi
ret 4
xor eax, eax
pop edi
mov dword [esi + 0x24], eax
pop esi
ret 4
mov dword [esi + 0x24], edi
pop edi
pop esi
ret 4

Function at 0x482cd0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x482cff
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0x1c
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
pop esi
ret 4
Function at 0x482d30
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
je 0x482e1d
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call ebp
mov ecx, dword [0x67a8cc]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 2
push edi
call esi
mov edx, dword [0x67a8cc]
lea ebx, [edi + 2]
push edx
push 1
push 2
push ebx
call esi
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x50]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x60], 0
call esi
mov edx, dword [esp + 0x60]
mov eax, dword [0x67a8cc]
push 0
push edx
push eax
call ebp
add esp, 0x48
mov ecx, edi
call fcn.00482e30
test eax, eax
pop ebp
je 0x482dfa
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0xc]
push ecx
push 1
push 0x10
push edx
call esi
push 0x24
call fcn.004784b0
add esp, 0x14
test eax, eax
je 0x482dec
lea ecx, [esp + 0xc]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
xor eax, eax
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
xor edx, edx
mov dx, word [ebx]
push edx
call fcn.00478e60
mov dword [edi + 4], eax
mov ecx, dword [0x67a8cc]
xor edx, edx
push ecx
mov dx, word [ebx]
push edx
push 1
push eax
call esi
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x482fb0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
je 0x483092
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call ebp
mov ecx, dword [0x67a8cc]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 2
push edi
call esi
mov edx, dword [0x67a8cc]
lea ebx, [edi + 2]
push edx
push 1
push 2
push ebx
call esi
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x50]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x60], 0
call esi
mov edx, dword [esp + 0x60]
mov eax, dword [0x67a8cc]
push 0
push edx
push eax
call ebp
add esp, 0x48
mov ecx, edi
call fcn.00482e30
test eax, eax
pop ebp
je 0x48307a
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0xc]
push ecx
push 1
push 0x10
push edx
call esi
push 0x24
call fcn.004784b0
add esp, 0x14
test eax, eax
je 0x48306c
lea ecx, [esp + 0xc]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
mov dword [edi + 0xc], eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
xor eax, eax
mov dword [edi + 0xc], eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
mov edx, dword [0x67a8cc]
xor eax, eax
mov ax, word [ebx]
push edx
push eax
add edi, 4
push 1
push edi
call esi
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x483370
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
push edi
mov edi, ecx
je 0x48342c
push esi
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push edi
call esi
mov edx, dword [0x67a8cc]
lea eax, [esp + 0x24]
push edx
push 2
push 4
push eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call esi
mov eax, dword [esp + 0x34]
add esp, 0x2c
test eax, eax
pop esi
je 0x4833fc
push 0x10
call fcn.004784b0
add esp, 4
test eax, eax
je 0x4833eb
mov ecx, eax
call fcn.00482f70
jmp 0x4833ed
xor eax, eax
mov ecx, dword [esp + 4]
mov dword [edi + 4], eax
push ecx
mov ecx, eax
call fcn.00482fb0
mov eax, dword [esp + 8]
test eax, eax
je 0x48342c
push 0x10
call fcn.004784b0
add esp, 4
test eax, eax
je 0x48341b
mov ecx, eax
call fcn.00482f70
jmp 0x48341d
xor eax, eax
mov edx, dword [esp + 8]
mov ecx, eax
push edx
mov dword [edi + 8], eax
call fcn.00482fb0
pop edi
add esp, 8
ret 4

Function at 0x4836d0
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [ecx + 4]
xor eax, eax
test ecx, ecx
je 0x4836ef
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret 8

Function at 0x483c90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
push edi
mov edi, ecx
je 0x483d39
push esi
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push edi
call esi
mov edx, dword [0x67a8cc]
lea eax, [esp + 0x24]
push edx
push 1
push 8
push eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call esi
push 0xc
call sub.MFC42u.DLL_operatornew
add esp, 0x30
test eax, eax
pop esi
je 0x483d00
mov ecx, eax
call fcn.00482d20
jmp 0x483d02
xor eax, eax
mov ecx, dword [esp + 4]
mov dword [edi + 4], eax
push ecx
mov ecx, eax
call fcn.00482d30
push 0xc
call sub.MFC42u.DLL_operatornew
add esp, 4
test eax, eax
je 0x483d28
mov ecx, eax
call fcn.00482d20
jmp 0x483d2a
xor eax, eax
mov edx, dword [esp + 8]
mov ecx, eax
push edx
mov dword [edi + 8], eax
call fcn.00482d30
pop edi
add esp, 8
ret 4
Function at 0x483df0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x708
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
je 0x483f3d
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call edi
mov ecx, dword [0x67a8cc]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push ebx
call ebp
add esp, 0x1c
mov ecx, ebx
call fcn.004af400
mov edx, dword [0x67a8cc]
lea eax, [ebx + 4]
push edx
push 1
push 4
push eax
call ebp
mov ecx, dword [0x67a8cc]
lea esi, [ebx + 8]
push ecx
push 1
push 4
push esi
call ebp
mov edx, dword [0x67a8cc]
lea eax, [esp + 0x34]
push edx
push 1
push 4
push eax
mov dword [esp + 0x44], 0
call ebp
mov ecx, dword [esp + 0x44]
mov edx, dword [0x67a8cc]
push 0
push ecx
push edx
call edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x358]
mov dword [esp + 0x354], 0
rep stosd dword es:[edi], eax
mov eax, dword [0x67a8cc]
mov ecx, dword [esi]
push eax
push ecx
lea edx, [esp + 0x35c]
push 4
push edx
call ebp
mov eax, dword [esi]
add esp, 0x4c
lea eax, [eax + eax*2]
shl eax, 2
push eax
call fcn.00478e60
mov dword [ebx + 0xc], eax
mov eax, dword [esi]
add esp, 4
xor edi, edi
test eax, eax
jle 0x483f3d
lea ecx, [esp + 0x318]
xor ebp, ebp
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [ebx + 0xc]
add ecx, ebp
mov eax, dword [edx]
push eax
call fcn.00483c90
lea ecx, [esp + 0x1a]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [ebx + 0xc]
push edx
add ecx, ebp
call fcn.00483db0
test eax, eax
je 0x483f28
lea eax, [esp + 0x1a]
lea ecx, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x220]
push str.pg_ctl_register__U__s__P__s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
inc edi
add edx, 4
add ebp, 0xc
cmp edi, eax
mov dword [esp + 0x10], edx
jl 0x483edf
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x708
ret 4

Function at 0x483ff0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x484058
push edi
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push 0xc
call sub.MFC42u.DLL_operatornew
add esp, 0x20
test eax, eax
je 0x484047
mov ecx, eax
call fcn.00482d20
mov edx, dword [esi + 8]
mov edi, eax
push edx
mov ecx, edi
call fcn.00482d30
mov dword [esi + 8], edi
pop edi
pop esi
ret 4
mov edx, dword [esi + 8]
xor edi, edi
push edx
mov ecx, edi
call fcn.00482d30
mov dword [esi + 8], edi
pop edi
pop esi
ret 4
Function at 0x4840e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
push edi
mov cl, byte [esi + 5]
cmp ecx, 4
ja case.default.0x4840fe
jmp dword [ecx*4 + 0x4842a4]
mov dword [esp + 0x10], eax
mov ax, word [esi + 6]
mov esi, dword [ebp + 8]
mov ecx, eax
and ecx, 0xffff
lea edi, [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp ax, 2
rep movsb byte es:[edi], byte [esi]
movsx eax, word [esp + 0x10]
je 0x484139
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push 0x5852c8
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
lea edi, [esp + 0x10]
mov cx, word [esi + 6]
mov esi, dword [ebp + 8]
mov edx, ecx
mov dword [esp + 0x10], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push 0x585588
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
lea edi, [esp + 0x10]
mov cx, word [esi + 6]
mov esi, dword [ebp + 8]
mov edx, ecx
mov dword [esp + 0x10], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, dword [ebp + 0xc]
and ecx, 3
sub esp, 8
rep movsb byte es:[edi], byte [esi]
fld dword [esp + 0x18]
fstp qword [esp]
push 0x585660
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
lea edi, [esp + 0x10]
mov cx, word [esi + 6]
mov esi, dword [ebp + 8]
mov edx, ecx
mov dword [esp + 0x10], 0
shr ecx, 2
mov dword [esp + 0x14], 0
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0047ad90
fstp qword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 0xc]
push edx
push eax
push 0x585598
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
mov edi, dword [ebp + 8]
test ah, 0x20
je 0x484259
xor edx, edx
mov dx, word [esi + 6]
push edx
push edi
call fcn.00479d90
add esp, 8
mov ebx, dword [ebp + 0xc]
mov byte [ebx], 0x27
mov eax, dword [esi]
test ah, 0x10
je 0x48427a
lea eax, [ebx + 1]
push 0x400
push eax
push edi
call fcn.004cc8c0
add esp, 0xc
jmp 0x484287
lea ecx, [ebx + 1]
push ecx
push edi
call fcn.0047a300
add esp, 8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ecx + ebx], 0x27
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4844c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x44c
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
je 0x4846b3
push ebx
push ebp
push edi
push eax
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push esi
call ebx
mov edx, dword [0x67a8cc]
lea eax, [esi + 4]
push edx
push 1
push 4
push eax
call ebx
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x44]
push ecx
push 1
push 4
push edx
mov dword [esp + 0x54], edi
call ebx
mov eax, dword [0x67a8cc]
lea ebp, [esi + 0xc]
push eax
push 1
push 4
push ebp
call ebx
mov ecx, dword [0x67a8cc]
add esp, 0x4c
lea edx, [esp + 0x14]
mov dword [esp + 0x14], edi
push ecx
push 1
push 4
push edx
call ebx
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x2c]
push eax
push 4
push 0x10
push ecx
call ebx
push 0x24
call fcn.004784b0
add esp, 0x24
cmp eax, edi
je 0x48457b
lea edx, [esp + 0x1c]
push 1
push edx
mov ecx, eax
call fcn.00495db0
jmp 0x48457d
xor eax, eax
push 0x24
mov dword [esi + 0x14], eax
call fcn.004784b0
add esp, 4
cmp eax, edi
je 0x48459e
lea ecx, [esp + 0x2c]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
jmp 0x4845a0
xor eax, eax
push 0x24
mov dword [esi + 0x18], eax
call fcn.004784b0
add esp, 4
cmp eax, edi
je 0x4845c1
lea edx, [esp + 0x3c]
push 1
push edx
mov ecx, eax
call fcn.00495db0
jmp 0x4845c3
xor eax, eax
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x20]
push 0xc
mov dword [eax], ecx
mov ecx, dword [esp + 0x58]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x5c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call sub.MFC42u.DLL_operatornew
add esp, 4
cmp eax, edi
je 0x4845fb
mov ecx, eax
call fcn.00482d20
jmp 0x4845fd
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], eax
push ecx
mov ecx, eax
call fcn.00482d30
mov edx, dword [esp + 0x14]
mov eax, dword [0x67a8cc]
push edi
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [ebp]
mov dword [esp + 0x68], edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x67a8cc]
lea eax, [esp + 0x68]
push ecx
push edx
push 4
push eax
call ebx
mov eax, dword [ebp]
lea ecx, [eax + eax*2]
shl ecx, 2
push ecx
call fcn.00478e60
mov dword [esi + 0x10], eax
mov eax, dword [ebp]
xor edx, edx
add esp, 0x20
xor edi, edi
cmp eax, edx
jle 0x484694
mov dword [esp + 0x10], edx
lea ebx, [esp + 0x5c]
mov edx, dword [ebx]
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esi + 0x10]
add ecx, edx
call fcn.00483ff0
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp]
inc edi
add ebx, 4
add ecx, 0xc
cmp edi, eax
mov dword [esp + 0x10], ecx
jl 0x48466b
xor edx, edx
mov ecx, 7
xor eax, eax
lea edi, [esi + 0x44]
pop ebp
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x3c]
pop ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x30], edx
pop edi
pop esi
add esp, 0x44c
ret 4
Function at 0x484f30
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x408
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
je 0x48501c
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call edi
mov ecx, dword [0x67a8cc]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push ebx
call ebp
mov edx, dword [0x67a8cc]
lea esi, [ebx + 4]
push edx
push 1
push 4
push esi
call ebp
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x40]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x50], 0
call ebp
mov edx, dword [esp + 0x50]
mov eax, dword [0x67a8cc]
push 0
push edx
push eax
call edi
mov edx, dword [esi]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x64]
mov dword [esp + 0x60], 0
add esp, 0x48
rep stosd dword es:[edi], eax
mov ecx, dword [0x67a8cc]
lea eax, [esp + 0x18]
push ecx
push edx
push 4
push eax
call ebp
mov eax, dword [esi]
lea ecx, [eax + eax*2]
shl ecx, 5
push ecx
call fcn.00478e60
mov dword [ebx + 8], eax
mov eax, dword [esi]
xor edi, edi
add esp, 0x14
cmp eax, edi
jle 0x48501c
mov dword [esp + 0x10], edi
lea ebp, [esp + 0x18]
mov edx, dword [ebp]
mov ecx, dword [ebx + 8]
push edx
mov edx, dword [esp + 0x14]
add ecx, edx
call fcn.004844c0
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
inc edi
add ebp, 4
add ecx, 0x60
cmp edi, eax
mov dword [esp + 0x10], ecx
jl 0x484ff5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret 4

Function at 0x485200
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x4852be
push edi
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0x14
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push 0xc
call sub.MFC42u.DLL_operatornew
add esp, 0x20
test eax, eax
je 0x48524a
mov ecx, eax
call fcn.00482d20
mov edi, eax
jmp 0x48524c
xor edi, edi
mov edx, dword [esi + 4]
mov ecx, edi
push edx
call fcn.00482d30
push 0xc
mov dword [esi + 4], edi
call sub.MFC42u.DLL_operatornew
add esp, 4
test eax, eax
je 0x485273
mov ecx, eax
call fcn.00482d20
mov edi, eax
jmp 0x485275
xor edi, edi
mov eax, dword [esi + 8]
mov ecx, edi
push eax
call fcn.00482d30
push 0xc
mov dword [esi + 8], edi
call sub.MFC42u.DLL_operatornew
add esp, 4
test eax, eax
je 0x4852ad
mov ecx, eax
call fcn.00482d20
mov ecx, dword [esi + 0xc]
mov edi, eax
push ecx
mov ecx, edi
call fcn.00482d30
mov dword [esi + 0xc], edi
pop edi
pop esi
ret 4
mov ecx, dword [esi + 0xc]
xor edi, edi
push ecx
mov ecx, edi
call fcn.00482d30
mov dword [esi + 0xc], edi
pop edi
pop esi
ret 4