joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c685
Capabilities:
Read file on windows

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x46c613
test byte [edi + 8], 4
jne 0x46c7a5
mov ecx, dword [esp + 0x18]
movzx ebp, cx
cmp ebp, 0x14
ja case.0x46c62a.1
movzx eax, byte [ebp + 0x46c5e2]
jmp dword [eax*4 + 0x46c5c6]
mov esi, 1
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push edi
call fcn.0046cc6a
test al, al
je 0x46c6ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46c79f
push ebx
push eax
push dword [esp + 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCreateEx]
test eax, eax
js 0x46c793
lea eax, [ebp - 8]
cmp eax, 5
ja case.0x46c677.10
jmp dword [eax*4 + 0x46c5aa]
mov esi, 2
jmp 0x46c636
mov esi, 4
jmp 0x46c636
mov esi, 8
jmp 0x46c636
mov esi, 0x10
jmp 0x46c636
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov esi, ecx
sar esi, 0x10
add esi, esi
jmp 0x46c6af
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov dword [edi + 0x24], 0x80020005
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
mov ecx, 0x100
jmp 0x46c6dd
mov ecx, 0x200
jmp 0x46c6dd
mov ecx, 0x400
jmp 0x46c6dd
mov ecx, 0x800
mov eax, dword [ebx]
or word [eax + 2], cx
mov eax, dword [ebx]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
add ecx, 0x10
mov dword [esp + 0x18], ecx
lea esi, [eax*8]
test esi, esi
je 0x46c787
test byte [edi + 8], 4
je 0x46c73f
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi + 4], ecx
cmp ecx, esi
setne al
mov byte [edi + 0x29], al
je 0x46c787
mov edx, dword [esp + 0x18]
sub esi, ecx
lea edx, [ecx + edx]
jmp 0x46c780
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
sub ebp, eax
add edx, eax
add eax, esi
mov dword [edi + 0x14], eax
cmp esi, ebp
jg 0x46c762
push esi
push edx
push ecx
call fcn.0055fcbe
add esp, 0xc
jmp 0x46c787
test ebp, ebp
js 0x46c77e
jle 0x46c777
push ebp
push edx
push ecx
call fcn.0055fcbe
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [ecx + ebp]
sub esi, ebp
jmp 0x46c780
mov edx, ecx
mov ecx, esi
call fcn.0055d86a
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroyDescriptor]
test eax, eax
jns 0x46c7a5
mov dword [edi + 0x24], eax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov dword [ebx], 0
mov edx, dword [ebx]
xor ecx, ecx
test edx, edx
je 0x46c7ca
movzx eax, word [edx]
test ax, ax
mov esi, eax
setne cl
test esi, esi
je 0x46c7ca
add edx, 0x10
imul ecx, dword [edx]
lea edx, [edx + 8]
sub esi, 1
jne 0x46c7bf
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov al, 1
pop ebx
ret 0x10
Function at 0x46c68c
Capabilities:
Read file on windows

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x46c613
test byte [edi + 8], 4
jne 0x46c7a5
mov ecx, dword [esp + 0x18]
movzx ebp, cx
cmp ebp, 0x14
ja case.0x46c62a.1
movzx eax, byte [ebp + 0x46c5e2]
jmp dword [eax*4 + 0x46c5c6]
mov esi, 1
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push edi
call fcn.0046cc6a
test al, al
je 0x46c6ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46c79f
push ebx
push eax
push dword [esp + 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCreateEx]
test eax, eax
js 0x46c793
lea eax, [ebp - 8]
cmp eax, 5
ja case.0x46c677.10
jmp dword [eax*4 + 0x46c5aa]
mov esi, 2
jmp 0x46c636
mov esi, 4
jmp 0x46c636
mov esi, 8
jmp 0x46c636
mov esi, 0x10
jmp 0x46c636
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov esi, ecx
sar esi, 0x10
add esi, esi
jmp 0x46c6af
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov dword [edi + 0x24], 0x80020005
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
mov ecx, 0x100
jmp 0x46c6dd
mov ecx, 0x200
jmp 0x46c6dd
mov ecx, 0x400
jmp 0x46c6dd
mov ecx, 0x800
mov eax, dword [ebx]
or word [eax + 2], cx
mov eax, dword [ebx]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
add ecx, 0x10
mov dword [esp + 0x18], ecx
lea esi, [eax*8]
test esi, esi
je 0x46c787
test byte [edi + 8], 4
je 0x46c73f
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi + 4], ecx
cmp ecx, esi
setne al
mov byte [edi + 0x29], al
je 0x46c787
mov edx, dword [esp + 0x18]
sub esi, ecx
lea edx, [ecx + edx]
jmp 0x46c780
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
sub ebp, eax
add edx, eax
add eax, esi
mov dword [edi + 0x14], eax
cmp esi, ebp
jg 0x46c762
push esi
push edx
push ecx
call fcn.0055fcbe
add esp, 0xc
jmp 0x46c787
test ebp, ebp
js 0x46c77e
jle 0x46c777
push ebp
push edx
push ecx
call fcn.0055fcbe
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [ecx + ebp]
sub esi, ebp
jmp 0x46c780
mov edx, ecx
mov ecx, esi
call fcn.0055d86a
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroyDescriptor]
test eax, eax
jns 0x46c7a5
mov dword [edi + 0x24], eax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov dword [ebx], 0
mov edx, dword [ebx]
xor ecx, ecx
test edx, edx
je 0x46c7ca
movzx eax, word [edx]
test ax, ax
mov esi, eax
setne cl
test esi, esi
je 0x46c7ca
add edx, 0x10
imul ecx, dword [edx]
lea edx, [edx + 8]
sub esi, 1
jne 0x46c7bf
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov al, 1
pop ebx
ret 0x10
Function at 0x46c693
Capabilities:
Read file on windows

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x46c613
test byte [edi + 8], 4
jne 0x46c7a5
mov ecx, dword [esp + 0x18]
movzx ebp, cx
cmp ebp, 0x14
ja case.0x46c62a.1
movzx eax, byte [ebp + 0x46c5e2]
jmp dword [eax*4 + 0x46c5c6]
mov esi, 1
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push edi
call fcn.0046cc6a
test al, al
je 0x46c6ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46c79f
push ebx
push eax
push dword [esp + 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCreateEx]
test eax, eax
js 0x46c793
lea eax, [ebp - 8]
cmp eax, 5
ja case.0x46c677.10
jmp dword [eax*4 + 0x46c5aa]
mov esi, 2
jmp 0x46c636
mov esi, 4
jmp 0x46c636
mov esi, 8
jmp 0x46c636
mov esi, 0x10
jmp 0x46c636
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov esi, ecx
sar esi, 0x10
add esi, esi
jmp 0x46c6af
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov dword [edi + 0x24], 0x80020005
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
mov ecx, 0x100
jmp 0x46c6dd
mov ecx, 0x200
jmp 0x46c6dd
mov ecx, 0x400
jmp 0x46c6dd
mov ecx, 0x800
mov eax, dword [ebx]
or word [eax + 2], cx
mov eax, dword [ebx]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
add ecx, 0x10
mov dword [esp + 0x18], ecx
lea esi, [eax*8]
test esi, esi
je 0x46c787
test byte [edi + 8], 4
je 0x46c73f
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi + 4], ecx
cmp ecx, esi
setne al
mov byte [edi + 0x29], al
je 0x46c787
mov edx, dword [esp + 0x18]
sub esi, ecx
lea edx, [ecx + edx]
jmp 0x46c780
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
sub ebp, eax
add edx, eax
add eax, esi
mov dword [edi + 0x14], eax
cmp esi, ebp
jg 0x46c762
push esi
push edx
push ecx
call fcn.0055fcbe
add esp, 0xc
jmp 0x46c787
test ebp, ebp
js 0x46c77e
jle 0x46c777
push ebp
push edx
push ecx
call fcn.0055fcbe
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [ecx + ebp]
sub esi, ebp
jmp 0x46c780
mov edx, ecx
mov ecx, esi
call fcn.0055d86a
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroyDescriptor]
test eax, eax
jns 0x46c7a5
mov dword [edi + 0x24], eax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov dword [ebx], 0
mov edx, dword [ebx]
xor ecx, ecx
test edx, edx
je 0x46c7ca
movzx eax, word [edx]
test ax, ax
mov esi, eax
setne cl
test esi, esi
je 0x46c7ca
add edx, 0x10
imul ecx, dword [edx]
lea edx, [edx + 8]
sub esi, 1
jne 0x46c7bf
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov al, 1
pop ebx
ret 0x10
Function at 0x46c69a
Capabilities:
Read file on windows

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x46c613
test byte [edi + 8], 4
jne 0x46c7a5
mov ecx, dword [esp + 0x18]
movzx ebp, cx
cmp ebp, 0x14
ja case.0x46c62a.1
movzx eax, byte [ebp + 0x46c5e2]
jmp dword [eax*4 + 0x46c5c6]
mov esi, 1
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push edi
call fcn.0046cc6a
test al, al
je 0x46c6ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46c79f
push ebx
push eax
push dword [esp + 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCreateEx]
test eax, eax
js 0x46c793
lea eax, [ebp - 8]
cmp eax, 5
ja case.0x46c677.10
jmp dword [eax*4 + 0x46c5aa]
mov esi, 2
jmp 0x46c636
mov esi, 4
jmp 0x46c636
mov esi, 8
jmp 0x46c636
mov esi, 0x10
jmp 0x46c636
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov esi, ecx
sar esi, 0x10
add esi, esi
jmp 0x46c6af
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov dword [edi + 0x24], 0x80020005
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
mov ecx, 0x100
jmp 0x46c6dd
mov ecx, 0x200
jmp 0x46c6dd
mov ecx, 0x400
jmp 0x46c6dd
mov ecx, 0x800
mov eax, dword [ebx]
or word [eax + 2], cx
mov eax, dword [ebx]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
add ecx, 0x10
mov dword [esp + 0x18], ecx
lea esi, [eax*8]
test esi, esi
je 0x46c787
test byte [edi + 8], 4
je 0x46c73f
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi + 4], ecx
cmp ecx, esi
setne al
mov byte [edi + 0x29], al
je 0x46c787
mov edx, dword [esp + 0x18]
sub esi, ecx
lea edx, [ecx + edx]
jmp 0x46c780
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
sub ebp, eax
add edx, eax
add eax, esi
mov dword [edi + 0x14], eax
cmp esi, ebp
jg 0x46c762
push esi
push edx
push ecx
call fcn.0055fcbe
add esp, 0xc
jmp 0x46c787
test ebp, ebp
js 0x46c77e
jle 0x46c777
push ebp
push edx
push ecx
call fcn.0055fcbe
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [ecx + ebp]
sub esi, ebp
jmp 0x46c780
mov edx, ecx
mov ecx, esi
call fcn.0055d86a
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroyDescriptor]
test eax, eax
jns 0x46c7a5
mov dword [edi + 0x24], eax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov dword [ebx], 0
mov edx, dword [ebx]
xor ecx, ecx
test edx, edx
je 0x46c7ca
movzx eax, word [edx]
test ax, ax
mov esi, eax
setne cl
test esi, esi
je 0x46c7ca
add edx, 0x10
imul ecx, dword [edx]
lea edx, [edx + 8]
sub esi, 1
jne 0x46c7bf
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov al, 1
pop ebx
ret 0x10
Function at 0x46c6ab
Capabilities:
Read file on windows

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x46c613
test byte [edi + 8], 4
jne 0x46c7a5
mov ecx, dword [esp + 0x18]
movzx ebp, cx
cmp ebp, 0x14
ja case.0x46c62a.1
movzx eax, byte [ebp + 0x46c5e2]
jmp dword [eax*4 + 0x46c5c6]
mov esi, 1
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push edi
call fcn.0046cc6a
test al, al
je 0x46c6ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46c79f
push ebx
push eax
push dword [esp + 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCreateEx]
test eax, eax
js 0x46c793
lea eax, [ebp - 8]
cmp eax, 5
ja case.0x46c677.10
jmp dword [eax*4 + 0x46c5aa]
mov esi, 2
jmp 0x46c636
mov esi, 4
jmp 0x46c636
mov esi, 8
jmp 0x46c636
mov esi, 0x10
jmp 0x46c636
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov esi, ecx
sar esi, 0x10
add esi, esi
jmp 0x46c6af
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov dword [edi + 0x24], 0x80020005
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
mov ecx, 0x100
jmp 0x46c6dd
mov ecx, 0x200
jmp 0x46c6dd
mov ecx, 0x400
jmp 0x46c6dd
mov ecx, 0x800
mov eax, dword [ebx]
or word [eax + 2], cx
mov eax, dword [ebx]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
add ecx, 0x10
mov dword [esp + 0x18], ecx
lea esi, [eax*8]
test esi, esi
je 0x46c787
test byte [edi + 8], 4
je 0x46c73f
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi + 4], ecx
cmp ecx, esi
setne al
mov byte [edi + 0x29], al
je 0x46c787
mov edx, dword [esp + 0x18]
sub esi, ecx
lea edx, [ecx + edx]
jmp 0x46c780
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
sub ebp, eax
add edx, eax
add eax, esi
mov dword [edi + 0x14], eax
cmp esi, ebp
jg 0x46c762
push esi
push edx
push ecx
call fcn.0055fcbe
add esp, 0xc
jmp 0x46c787
test ebp, ebp
js 0x46c77e
jle 0x46c777
push ebp
push edx
push ecx
call fcn.0055fcbe
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [ecx + ebp]
sub esi, ebp
jmp 0x46c780
mov edx, ecx
mov ecx, esi
call fcn.0055d86a
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroyDescriptor]
test eax, eax
jns 0x46c7a5
mov dword [edi + 0x24], eax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov dword [ebx], 0
mov edx, dword [ebx]
xor ecx, ecx
test edx, edx
je 0x46c7ca
movzx eax, word [edx]
test ax, ax
mov esi, eax
setne cl
test esi, esi
je 0x46c7ca
add edx, 0x10
imul ecx, dword [edx]
lea edx, [edx + 8]
sub esi, 1
jne 0x46c7bf
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov al, 1
pop ebx
ret 0x10
Function at 0x46c6c3
Capabilities:
Read file on windows

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x46c613
test byte [edi + 8], 4
jne 0x46c7a5
mov ecx, dword [esp + 0x18]
movzx ebp, cx
cmp ebp, 0x14
ja case.0x46c62a.1
movzx eax, byte [ebp + 0x46c5e2]
jmp dword [eax*4 + 0x46c5c6]
mov esi, 1
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push edi
call fcn.0046cc6a
test al, al
je 0x46c6ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46c79f
push ebx
push eax
push dword [esp + 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCreateEx]
test eax, eax
js 0x46c793
lea eax, [ebp - 8]
cmp eax, 5
ja case.0x46c677.10
jmp dword [eax*4 + 0x46c5aa]
mov esi, 2
jmp 0x46c636
mov esi, 4
jmp 0x46c636
mov esi, 8
jmp 0x46c636
mov esi, 0x10
jmp 0x46c636
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov esi, ecx
sar esi, 0x10
add esi, esi
jmp 0x46c6af
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov dword [edi + 0x24], 0x80020005
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
mov ecx, 0x100
jmp 0x46c6dd
mov ecx, 0x200
jmp 0x46c6dd
mov ecx, 0x400
jmp 0x46c6dd
mov ecx, 0x800
mov eax, dword [ebx]
or word [eax + 2], cx
mov eax, dword [ebx]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
add ecx, 0x10
mov dword [esp + 0x18], ecx
lea esi, [eax*8]
test esi, esi
je 0x46c787
test byte [edi + 8], 4
je 0x46c73f
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi + 4], ecx
cmp ecx, esi
setne al
mov byte [edi + 0x29], al
je 0x46c787
mov edx, dword [esp + 0x18]
sub esi, ecx
lea edx, [ecx + edx]
jmp 0x46c780
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
sub ebp, eax
add edx, eax
add eax, esi
mov dword [edi + 0x14], eax
cmp esi, ebp
jg 0x46c762
push esi
push edx
push ecx
call fcn.0055fcbe
add esp, 0xc
jmp 0x46c787
test ebp, ebp
js 0x46c77e
jle 0x46c777
push ebp
push edx
push ecx
call fcn.0055fcbe
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [ecx + ebp]
sub esi, ebp
jmp 0x46c780
mov edx, ecx
mov ecx, esi
call fcn.0055d86a
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroyDescriptor]
test eax, eax
jns 0x46c7a5
mov dword [edi + 0x24], eax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov dword [ebx], 0
mov edx, dword [ebx]
xor ecx, ecx
test edx, edx
je 0x46c7ca
movzx eax, word [edx]
test ax, ax
mov esi, eax
setne cl
test esi, esi
je 0x46c7ca
add edx, 0x10
imul ecx, dword [edx]
lea edx, [edx + 8]
sub esi, 1
jne 0x46c7bf
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov al, 1
pop ebx
ret 0x10
Function at 0x46c6ca
Capabilities:
Read file on windows

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x46c613
test byte [edi + 8], 4
jne 0x46c7a5
mov ecx, dword [esp + 0x18]
movzx ebp, cx
cmp ebp, 0x14
ja case.0x46c62a.1
movzx eax, byte [ebp + 0x46c5e2]
jmp dword [eax*4 + 0x46c5c6]
mov esi, 1
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push edi
call fcn.0046cc6a
test al, al
je 0x46c6ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46c79f
push ebx
push eax
push dword [esp + 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCreateEx]
test eax, eax
js 0x46c793
lea eax, [ebp - 8]
cmp eax, 5
ja case.0x46c677.10
jmp dword [eax*4 + 0x46c5aa]
mov esi, 2
jmp 0x46c636
mov esi, 4
jmp 0x46c636
mov esi, 8
jmp 0x46c636
mov esi, 0x10
jmp 0x46c636
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov esi, ecx
sar esi, 0x10
add esi, esi
jmp 0x46c6af
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov dword [edi + 0x24], 0x80020005
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
mov ecx, 0x100
jmp 0x46c6dd
mov ecx, 0x200
jmp 0x46c6dd
mov ecx, 0x400
jmp 0x46c6dd
mov ecx, 0x800
mov eax, dword [ebx]
or word [eax + 2], cx
mov eax, dword [ebx]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
add ecx, 0x10
mov dword [esp + 0x18], ecx
lea esi, [eax*8]
test esi, esi
je 0x46c787
test byte [edi + 8], 4
je 0x46c73f
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi + 4], ecx
cmp ecx, esi
setne al
mov byte [edi + 0x29], al
je 0x46c787
mov edx, dword [esp + 0x18]
sub esi, ecx
lea edx, [ecx + edx]
jmp 0x46c780
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
sub ebp, eax
add edx, eax
add eax, esi
mov dword [edi + 0x14], eax
cmp esi, ebp
jg 0x46c762
push esi
push edx
push ecx
call fcn.0055fcbe
add esp, 0xc
jmp 0x46c787
test ebp, ebp
js 0x46c77e
jle 0x46c777
push ebp
push edx
push ecx
call fcn.0055fcbe
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [ecx + ebp]
sub esi, ebp
jmp 0x46c780
mov edx, ecx
mov ecx, esi
call fcn.0055d86a
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroyDescriptor]
test eax, eax
jns 0x46c7a5
mov dword [edi + 0x24], eax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov dword [ebx], 0
mov edx, dword [ebx]
xor ecx, ecx
test edx, edx
je 0x46c7ca
movzx eax, word [edx]
test ax, ax
mov esi, eax
setne cl
test esi, esi
je 0x46c7ca
add edx, 0x10
imul ecx, dword [edx]
lea edx, [edx + 8]
sub esi, 1
jne 0x46c7bf
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov al, 1
pop ebx
ret 0x10
Function at 0x46c6d1
Capabilities:
Read file on windows

Disassembly:
cmp byte [esp + 4], 0
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x46c613
test byte [edi + 8], 4
jne 0x46c7a5
mov ecx, dword [esp + 0x18]
movzx ebp, cx
cmp ebp, 0x14
ja case.0x46c62a.1
movzx eax, byte [ebp + 0x46c5e2]
jmp dword [eax*4 + 0x46c5c6]
mov esi, 1
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push edi
call fcn.0046cc6a
test al, al
je 0x46c6ba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46c79f
push ebx
push eax
push dword [esp + 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayCreateEx]
test eax, eax
js 0x46c793
lea eax, [ebp - 8]
cmp eax, 5
ja case.0x46c677.10
jmp dword [eax*4 + 0x46c5aa]
mov esi, 2
jmp 0x46c636
mov esi, 4
jmp 0x46c636
mov esi, 8
jmp 0x46c636
mov esi, 0x10
jmp 0x46c636
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov esi, ecx
sar esi, 0x10
add esi, esi
jmp 0x46c6af
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x46c636
mov dword [edi + 0x24], 0x80020005
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
mov ecx, 0x100
jmp 0x46c6dd
mov ecx, 0x200
jmp 0x46c6dd
mov ecx, 0x400
jmp 0x46c6dd
mov ecx, 0x800
mov eax, dword [ebx]
or word [eax + 2], cx
mov eax, dword [ebx]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
add ecx, 0x10
mov dword [esp + 0x18], ecx
lea esi, [eax*8]
test esi, esi
je 0x46c787
test byte [edi + 8], 4
je 0x46c73f
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push esi
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x1c]
add dword [edi + 4], ecx
cmp ecx, esi
setne al
mov byte [edi + 0x29], al
je 0x46c787
mov edx, dword [esp + 0x18]
sub esi, ecx
lea edx, [ecx + edx]
jmp 0x46c780
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0xc]
mov edx, dword [edi + 0x10]
sub ebp, eax
add edx, eax
add eax, esi
mov dword [edi + 0x14], eax
cmp esi, ebp
jg 0x46c762
push esi
push edx
push ecx
call fcn.0055fcbe
add esp, 0xc
jmp 0x46c787
test ebp, ebp
js 0x46c77e
jle 0x46c777
push ebp
push edx
push ecx
call fcn.0055fcbe
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea edx, [ecx + ebp]
sub esi, ebp
jmp 0x46c780
mov edx, ecx
mov ecx, esi
call fcn.0055d86a
push dword [ebx]
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroyDescriptor]
test eax, eax
jns 0x46c7a5
mov dword [edi + 0x24], eax
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov dword [ebx], 0
mov edx, dword [ebx]
xor ecx, ecx
test edx, edx
je 0x46c7ca
movzx eax, word [edx]
test ax, ax
mov esi, eax
setne cl
test esi, esi
je 0x46c7ca
add edx, 0x10
imul ecx, dword [edx]
lea edx, [edx + 8]
sub esi, 1
jne 0x46c7bf
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov al, 1
pop ebx
ret 0x10