joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40160d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bb07c]
jne 0x401617
repz ret
jmp fcn.00401f23

Function at 0x406b4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bb07c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004044cb
and dword [ebp - 0x14], 0
cmp dword [0x4bda58], 0
mov dword [ebp - 0x18], eax
jne 0x406bff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406ca7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406ca7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4bda58], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4bda5c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4bda60], eax
call edi
push eax
call esi
mov dword [0x4bda68], eax
test eax, eax
je 0x406bff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4bda64], eax
mov eax, dword [0x4bda64]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406c58
cmp dword [0x4bda68], ecx
je 0x406c58
push eax
call esi
push dword [0x4bda68]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406c58
test ebx, ebx
je 0x406c58
call edi
test eax, eax
je 0x406c4f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406c4f
test byte [ebp - 8], 1
jne 0x406c58
or dword [ebp + 0x10], 0x200000
jmp 0x406c8b
mov eax, dword [0x4bda5c]
cmp eax, dword [ebp - 0x18]
je 0x406c8b
push eax
call esi
test eax, eax
je 0x406c8b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406c8b
mov eax, dword [0x4bda60]
cmp eax, dword [ebp - 0x18]
je 0x406c8b
push eax
call esi
test eax, eax
je 0x406c8b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4bda58]
call esi
test eax, eax
je 0x406ca7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406ca9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040160d
leave
ret
Function at 0x413460
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov word [ebp - 0x1768], dx
mov eax, 0x32
mov word [ebp - 0x1766], ax
mov ecx, 0x2e
mov word [ebp - 0x1764], cx
mov edx, 0x64
mov word [ebp - 0x1762], dx
mov eax, 0x6c
mov word [ebp - 0x1760], ax
mov ecx, 0x6c
mov word [ebp - 0x175e], cx
xor edx, edx
mov word [ebp - 0x175c], dx
push edi
push ecx
add esp, 4
sub edi, 0xbf8b
and edi, 0x6ac6
pop edi
push ecx
push edx
add esp, 4
sub ecx, 0x9af3
sub ecx, 0x112e9
and ecx, 0x16bad
pop ecx
push edx
or edx, 0x88c6
pop edx
mov byte [ebp - 0x894], 0x4c
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
mov byte [ebp - 0x88e], 0x62
mov byte [ebp - 0x88d], 0x72
mov byte [ebp - 0x88c], 0x61
mov byte [ebp - 0x88b], 0x72
mov byte [ebp - 0x88a], 0x79
mov byte [ebp - 0x889], 0x57
mov byte [ebp - 0x888], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x15e4], eax
push edx
jmp 0x413567
pop edx
push eax
add eax, 0x7072
pop eax
push edx
add edx, 0x1499f
or edx, 0x1467b
jmp 0x413583
sub edx, 0x11dc6
pop edx
push ecx
xor ecx, 0xd7de
pop ecx
cmp dword [ebp - 0x15e4], 0
jne 0x4135aa
mov dword [ebp - 0x750], 0
jmp 0x413866
mov ecx, dword [ebp - 0x15e4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xca4], eax
push edi
or edi, 0xd6a7
and edi, 0x1af5
call 0x4135d8
add byte [esi + 0x4d], al
cmp ecx, dword [eax + 0x4e]
cmp byte ds:[eax + 0x4b], al
add esp, 4
call 0x4135ea
add byte [ecx], bh
inc ebx
push eax
aas
dec edi
cmp byte [ebx + 0x3c], al
cmp eax, dword [ebx - 0x7ca0fb3c]
mov ebp, 0xfffff35c
add byte [ebp + 0xf], dh
mov dword [ebp - 0x750], 0
jmp 0x413866
push ecx
push edi
add esp, 4
xor ecx, 0x15cec
jmp 0x413877
sub ecx, 0x80d6
pop ecx
push ebx
call 0x41388e
add byte [edi], bh
aaa
aas
inc edx
aaa
cmp dh, byte [ebx]
dec eax
dec esp
add esp, 4
and ebx, 0x3615
pop ebx
cmp dword [ebp - 0x750], 0
jne 0x4138e2
push edi
push edi
add esp, 4
jmp 0x4138ad
pop edi
push edx
push edi
add esp, 4
xor edx, 0x11f17
call 0x4138c9
add byte [ebx], dh
dec ebp
inc edx
inc esp
xor eax, 0x373a4d37
add esp, 4
jmp 0x4138d2
pop edx
mov dword [ebp - 0x79c], 0
jmp 0x414409
push ecx
push edx
add esp, 4
or ecx, 0x74c2
pop ecx
push eax
and eax, 0x3eb1
or eax, 0x1242e
sub eax, 0x9cfb
xor eax, 0x1b7e
pop eax
push esi
push ecx
add esp, 4
or esi, 0x32b1
xor al, byte [eax]
add byte [esi - 0x75], bl
test dword [eax - 0x74000008], esi
dec eax
sbb byte [ecx - 0x31f73], cl
inc edi
test dword [eax + 0xfffff8], esp
add byte [eax], al
add byte [ebx - 0x31f6b], cl
dec dword [ecx - 0x15ef6b]
inc dword [ebx - 0x15ef43]
inc dword [eax]
Function at 0x100018f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x100d8034]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x68]
stosd dword es:[edi], eax
mov esi, edx
push 0x44
mov dword [ebp - 0x6c], esi
mov ebx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
pop edi
push edi
push 0
push eax
call fcn.1004df70
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [ebp - 0x28], 1
xor eax, eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], edi
push eax
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1000197b
push 0xffffffffffffffff
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x68]
call esi
xor eax, eax
jmp 0x100019c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push edi
mov esi, eax
lea eax, [ebp - 0x58]
push eax
push 0x400
push esi
push edi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x58]
mov ecx, str._null_
test ebx, ebx
mov eax, ecx
cmovne eax, ebx
push esi
push eax
mov eax, dword [ebp - 0x6c]
test eax, eax
cmovne ecx, eax
push ecx
push str.cimg::system___:_Command__s__module_name__s__failed_with_error__lu:__s
call fcn.100018a4
add esp, 0x14
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004bd72
leave
ret
Function at 0x10003225
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
test eax, eax
push ebx
push esi
mov esi, 0x100942b2
push edi
cmovne esi, eax
mov edi, ecx
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10003240
sub ecx, edx
lea ebx, [ecx + 1]
test ebx, ebx
je 0x10003269
push ebx
call fcn.1004c2e0
push ebx
push esi
push eax
mov dword [ebp - 4], eax
call fcn.1004d9f0
mov ebx, dword [ebp - 4]
add esp, 0x10
jmp 0x1000326b
xor ebx, ebx
cmp dword [edi + 0x18], 0
lea esi, [edi + 0x1c]
je 0x10003280
cmp dword [esi], 0
je 0x10003280
mov ecx, edi
call fcn.10003344
call fcn.100029a0
mov ecx, dword [ebp + 8]
cmp eax, ecx
cmovb ecx, eax
mov dword [edi + 0x18], ecx
call fcn.100029dd
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
push 3
cmovb ecx, eax
mov word [edi + 0xbc], 0x100
cmp dword [ebp + 0x14], 4
pop eax
cmovb eax, dword [ebp + 0x14]
mov dword [edi + 0x20], eax
mov al, byte [ebp + 0x18]
mov byte [edi + 0x30], al
mov eax, 0x80000000
mov dword [edi + 0x50], eax
mov dword [edi + 0x4c], eax
mov al, byte [ebp + 0x1c]
mov dword [esi], ecx
mov ecx, edi
mov byte [edi + 0x60], al
mov dword [edi + 0x34], ebx
call fcn.10002949
cmp byte [edi + 0x30], 0
je 0x100032e4
mov ecx, edi
call fcn.10003191
push 8
call fcn.1004c2e0
pop ecx
mov esi, eax
xor ebx, ebx
push ebx
push ebx
push ebx
mov dword [esi], edi
mov eax, dword [edi + 0x34]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0xc8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push esi
push 0x10002dd9
push ebx
push ebx
mov dword [edi + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [edi + 0xc4]
mov dword [edi + 0xc0], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x10003344
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
je 0x100033fc
cmp dword [esi + 0x1c], ebx
je 0x100033fc
push dword [esi + 0xcc]
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
push dword [esi + 0xc0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0xdc]
call fcn.1004bd80
push dword [esi + 0x34]
call fcn.1004bd80
pop ecx
pop ecx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0x34], ebx
cmp byte [esi + 0x30], bl
je 0x100033c6
mov eax, dword [esi + 0xd0]
test eax, eax
je 0x100033a9
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0xd0], ebx
cmp word [esi + 0x124], bx
je 0x100033c6
push ebx
lea eax, [esi + 0xe0]
push eax
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
and dword [esi + 0x2c], ebx
mov eax, 0x80000000
and dword [esi + 0x28], ebx
mov ecx, esi
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
mov byte [esi + 0x30], bl
mov byte [esi + 0x60], 1
mov dword [esi + 0x34], ebx
call fcn.10002949
mov eax, esi
pop esi
pop ebx
ret
pop esi
pop ebx
jmp fcn.10002949

Function at 0x10003852
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100038c8
xor eax, eax
push eax
push eax
push esi
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test ebx, ebx
je 0x100038c8
sub esp, 0xc
lea ecx, [esp + 0x1c]
push ebx
call fcn.10008c64
push ebx
push dword [esp + 0x28]
push esi
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100038b7
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp byte [esp + 0x20], 0
jne 0x100038c8
push dword [esp + 0x24]
call fcn.1004bd80
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100038d1
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100d97f4]
push ebx
push esi
xor ebx, ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100da4d4]
push edi
cmp eax, dword [ecx + 4]
jle 0x1000393d
mov esi, 0x100da4d4
push esi
call fcn.1004be0f
cmp dword [0x100da4d4], 0xffffffff
pop ecx
jne 0x1000393d
push 0x100775b3
mov dword [0x100da348], ebx
mov dword [0x100da34c], ebx
mov dword [0x100da350], ebx
mov dword [0x100da354], ebx
mov byte [0x100da358], bl
mov dword [0x100da35c], ebx
call fcn.1004c2bd
pop ecx
push esi
call fcn.1004bdbe
pop ecx
call fcn.100017a0
push 0xffffffffffffffff
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x100da35c], ebx
jne 0x100039b8
push 1
push 1
push 1
push 0x104
mov ecx, 0x100da348
call fcn.10009376
mov eax, dword [0x100da35c]
push ebx
push 0x26
mov byte [eax], bl
push dword [0x100da35c]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x100039b8
push str.PROGRAMFILES
call fcn.1005c315
pop ecx
test eax, eax
je 0x100039aa
push 0x103
push eax
push dword [0x100da35c]
call fcn.10055580
add esp, 0xc
jmp 0x100039b8
mov edi, dword [0x100da35c]
mov esi, str.C:PROGRA1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100017a0
push dword [eax + 0x1c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x100da35c]
pop edi
pop esi
pop ebx
ret
Function at 0x100081c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100081ea
mov eax, dword [ebp + 8]
push eax
mov dword [0x100d9fa8], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
push eax
push eax
push eax
push 0x10008808
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x100081f1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100d8034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 8], ebx
mov edi, ebx
mov dword [ebp - 8], ebx
xor eax, eax
push 0x25ec
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.100246ac
mov esi, eax
mov dword [esp], 0x25ec
push edi
mov dword [ebx], esi
push esi
lea eax, [esi + 0x25ec]
mov dword [ebx + 8], eax
call fcn.1004df70
lea eax, [esi + 0x25ec]
add esp, 0xc
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 8
jb 0x1000825c
mov eax, dword [eax]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push edi
mov esi, eax
push 0x1f638
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push 0x25ec
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004bd72
leave
ret
Function at 0x1002426d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov eax, ecx
mov dword [esp + 0xc], eax
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test eax, eax
je 0x100242e6
cmp dword [ebp + 8], 0
je 0x100242e6
test edi, edi
jne 0x1002429c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov edi, edx
push dword [ebp + 8]
mov esi, 0x3f00000
cmp edi, esi
cmovb esi, edi
add eax, ebx
push esi
push 1
push eax
call fcn.1005bd4d
add esp, 0x10
add ebx, eax
sub edi, eax
cmp esi, eax
jne 0x100242cb
mov eax, dword [esp + 0x10]
test edi, edi
jne 0x100242a0
test edi, edi
mov edi, dword [esp + 0x14]
je 0x100242e2
push edi
push ebx
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.100018a4
add esp, 0xc
mov eax, ebx
jmp 0x10024295
push eax
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100cc608
mov ecx, 0x100942b2
cmovbe eax, ecx
push eax
call fcn.10001713
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001488
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100d6e34
push eax
call fcn.1004d8c7
int3

Function at 0x10024324
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov eax, ecx
mov dword [esp + 0xc], eax
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test eax, eax
je 0x1002439d
cmp dword [ebp + 8], 0
je 0x1002439d
test edi, edi
jne 0x10024353
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov edi, edx
push dword [ebp + 8]
mov esi, 0x3f00000
cmp edi, esi
cmovb esi, edi
add eax, ebx
push esi
push 1
push eax
call fcn.1005bd4d
add esp, 0x10
add ebx, eax
sub edi, eax
cmp esi, eax
jne 0x10024382
mov eax, dword [esp + 0x10]
test edi, edi
jne 0x10024357
test edi, edi
mov edi, dword [esp + 0x14]
je 0x10024399
push edi
push ebx
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.100018a4
add esp, 0xc
mov eax, ebx
jmp 0x1002434c
push eax
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100cc608
mov ecx, 0x100942b2
cmovbe eax, ecx
push eax
call fcn.10001719
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001488
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100d6e34
push eax
call fcn.1004d8c7
int3
Function at 0x10024a14
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024a9a
cmp dword [ebp + 8], 0
je 0x10024a9a
test edi, edi
jne 0x10024a41
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
lea eax, [ebx + ebx]
mov esi, 0x1f80000
cmp eax, 0x3f00000
lea eax, [ecx + edi*2]
cmovb esi, ebx
push esi
push 2
push eax
call fcn.1005bd4d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024a77
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024a45
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024a96
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.100018a4
add esp, 0xc
mov eax, esi
jmp 0x10024a3a
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100cc608
mov ecx, 0x100942b2
cmovbe eax, ecx
push eax
call fcn.1000171f
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001488
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100d6e34
push eax
call fcn.1004d8c7
int3

Function at 0x10024af7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024b7f
cmp dword [ebp + 8], 0
je 0x10024b7f
test edi, edi
jne 0x10024b24
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.1005bd4d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024b5c
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024b28
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024b7b
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.100018a4
add esp, 0xc
mov eax, esi
jmp 0x10024b1d
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100cc608
mov ecx, 0x100942b2
cmovbe eax, ecx
push eax
call fcn.1000172b
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001488
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100d6e34
push eax
call fcn.1004d8c7
int3
Function at 0x10024bd4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024c5c
cmp dword [ebp + 8], 0
je 0x10024c5c
test edi, edi
jne 0x10024c01
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.1005bd4d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024c39
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024c05
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024c58
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.100018a4
add esp, 0xc
mov eax, esi
jmp 0x10024bfa
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100cc608
mov ecx, 0x100942b2
cmovbe eax, ecx
push eax
call fcn.1002530b
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001488
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100d6e34
push eax
call fcn.1004d8c7
int3

Function at 0x10024c9a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 4], ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10024d22
cmp dword [ebp + 8], 0
je 0x10024d22
test edi, edi
jne 0x10024cc7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, edi
xor edi, edi
push dword [ebp + 8]
mov eax, ebx
mov esi, 0xfc0000
shl eax, 2
cmp eax, 0x3f00000
lea eax, [ecx + edi*4]
cmovb esi, ebx
push esi
push 4
push eax
call fcn.1005bd4d
add esp, 0x10
add edi, eax
sub ebx, eax
cmp esi, eax
jne 0x10024cff
mov ecx, dword [esp + 0x10]
test ebx, ebx
jne 0x10024ccb
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ebx, ebx
je 0x10024d1e
push edi
push esi
push str.cimg::fread__:_Only__lu__lu_elements_could_be_read_from_file.
call fcn.100018a4
add esp, 0xc
mov eax, esi
jmp 0x10024cc0
push ecx
push dword [ebp + 8]
cmp edi, 1
mov eax, 0x100cc608
mov ecx, 0x100942b2
cmovbe eax, ecx
push eax
call fcn.10001731
push eax
push edi
lea eax, [esp + 0x2c]
push str.cimg::fread__:_Invalid_reading_request_of__u__s_s_from_file__p_to_buffer__p.
push eax
call fcn.10001488
add esp, 0x1c
lea eax, [esp + 0x18]
push 0x100d6e34
push eax
call fcn.1004d8c7
int3