joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426b70
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push 0x24
call fcn.004e58d5
mov ebx, eax
push 0x6ba258
push dword [esp + 0x14]
mov dword [ebx], 0
call fcn.004e0761
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x426be6
push esi
push edi
push 2
push 0
push ebp
call fcn.004e66e5
push ebp
call fcn.004e6d44
push ebp
mov esi, eax
call fcn.004e6e5a
push esi
call fcn.004e58d5
push ebp
push esi
mov edi, eax
push 1
push edi
call fcn.004e6342
lea ecx, [ebx + 0x18]
push ecx
lea ecx, [ebx + 0x14]
push ecx
push esi
push edi
call fcn.00426ad0
push ebp
mov dword [ebx], eax
call fcn.004e05b9
push edi
call fcn.004e58ba
add esp, 0x40
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret

Function at 0x4429f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x7be9b8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x10]
mov ebp, 0x108
mov eax, edi
xor ebx, ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
cmp esi, ebp
jbe 0x442a3d
lea eax, [esi + esi]
mov ebp, esi
push eax
call fcn.00470460
add esp, 4
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
xor ecx, ecx
test esi, esi
push 0
setne cl
push ecx
call fcn.00444780
add esp, 8
cmp esi, 2
jb 0x442a7c
cmp esi, ebp
jae 0x442a7c
cmp word [edi + 2], 0x3a
jne 0x442a7c
movzx eax, word [edi]
mov edx, eax
add eax, 0xffffff9f
cmp ax, 0x19
lea ecx, [edx - 0x20]
cmova ecx, edx
xor ebx, ebx
lea eax, [ecx - 0x41]
cmp eax, 0x19
cmovbe ebx, eax
lea eax, [esp + 0x10]
cmp edi, eax
je 0x442a8d
push edi
call fcn.00470430
add esp, 4
mov ecx, dword [esp + 0x220]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004daa4c
add esp, 0x214
ret

Function at 0x442ab0
Capabilities:
Set current directory

Disassembly:
sub esp, 0xc
mov eax, dword [0x7be9b8]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
test eax, eax
js 0x442b0c
cmp eax, 0x19
jg 0x442b0c
push esi
push edi
add eax, 0x41
mov dword [esp + 0xa], 0x3a
push 1
mov word [esp + 0xc], ax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
push edi
sbb esi, esi
neg esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
push esi
call fcn.00444780
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004daa4c
add esp, 0xc
ret

Function at 0x442b70
Capabilities:
Set current directory

Disassembly:
push ebx
push ebp
push esi
push dword [esp + 0x10]
call fcn.00443a20
add esp, 4
mov ebp, eax
call fcn.0043a0b0
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
push esi
sbb ebx, ebx
neg ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
push ebx
call fcn.00444780
add esp, 8
call fcn.0043a0b0
test ebp, ebp
je 0x442bc1
push ebp
call fcn.00470430
add esp, 4
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x442bd0
Capabilities:
Set current directory

Disassembly:
sub esp, 0x10
mov eax, dword [0x7be9b8]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
call fcn.0043a0b0
call fcn.004429f0
mov ebp, dword [esp + 0x20]
mov ebx, eax
mov dword [esp + 0xc], ebx
test ebp, ebp
js 0x442c3f
cmp ebp, 0x19
jg 0x442c3f
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea ecx, [ebp + 0x41]
push edi
push 1
mov word [esp + 0x18], cx
mov dword [esp + 0x1a], 0x3a
call ebx
mov edi, eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
push edi
sbb esi, esi
neg esi
call ebx
push 0
push esi
call fcn.00444780
mov ebx, dword [esp + 0x18]
add esp, 8
pop edi
call fcn.004429f0
cmp ebp, eax
jne 0x442c4c
xor esi, esi
jmp 0x442c58
push ebx
call fcn.00442ab0
add esp, 4
or esi, 0xffffffff
push esi
call fcn.00444760
add esp, 4
call fcn.0043a0b0
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004daa4c
add esp, 0x10
ret

Function at 0x442d80
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
mov dword [esp + 0xc], ebp
mov byte [ebx], 0
push esi
push edi
test ebp, ebp
jle 0x442dc9
call fcn.0043a0b0
call fcn.004429f0
push 0
mov esi, eax
call fcn.00444760
add esp, 4
call fcn.0043a0b0
lea eax, [esi + 1]
mov dword [esp + 0x14], eax
cmp ebp, eax
je 0x442dc9
lea eax, [ebp - 1]
push eax
call fcn.00442bd0
add esp, 4
call fcn.0043a0b0
mov esi, dword [esp + 0x1c]
add esi, esi
push esi
call fcn.00470460
add esp, 4
mov edi, eax
xor eax, eax
push eax
push edi
push dword [esp + 0x24]
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
xor eax, eax
mov word [esi + edi - 2], ax
mov eax, dword [esp + 0x24]
dec eax
push eax
push ebx
push edi
call fcn.00460600
push edi
call fcn.00470430
add esp, 0x18
call fcn.0043a0b0
call fcn.00444730
mov esi, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], esi
cmp ebp, eax
je 0x442e43
lea ecx, [eax - 1]
push ecx
call fcn.00442bd0
push esi
call fcn.00444760
add esp, 8
mov eax, dword [esp + 0x1c]
mov byte [ebx + eax - 1], 0
test esi, esi
jne 0x442ecd
mov cl, byte [ebx]
test cl, cl
je 0x442ecd
mov esi, ebx
lea edx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x442e60
sub esi, edx
mov edi, ebx
cmp byte [ebx + 1], 0x3a
jne 0x442e7a
mov cl, byte [ebx + 2]
lea edi, [ebx + 2]
sub esi, 2
movzx eax, cl
push eax
push 0x6ccd04
call fcn.004dc9c0
add esp, 8
test eax, eax
je 0x442e91
inc edi
dec esi
test esi, esi
je 0x442ec0
movzx eax, byte [edi + esi - 1]
push eax
push 0x6ccd04
call fcn.004dc9c0
add esp, 8
test eax, eax
je 0x442ead
dec esi
test esi, esi
je 0x442ec0
cmp ebx, edi
je 0x442ec0
push esi
push edi
push ebx
call fcn.004dbc20
add esp, 0xc
mov eax, dword [esp + 0x18]
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x442ee0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x7be9b8]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
lea edi, [esp + 0x10]
mov ebp, 0x108
mov eax, edi
xor ebx, ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
cmp esi, ebp
jbe 0x442f32
lea eax, [esi + esi]
mov ebp, esi
push eax
call fcn.00470460
add esp, 4
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
xor ecx, ecx
test esi, esi
push 0
setne cl
push ecx
call fcn.00444780
add esp, 8
cmp esi, 2
jb 0x442f71
cmp esi, ebp
jae 0x442f71
cmp word [edi + 2], 0x3a
jne 0x442f71
movzx eax, word [edi]
mov edx, eax
add eax, 0xffffff9f
cmp ax, 0x19
lea ecx, [edx - 0x20]
cmova ecx, edx
xor ebx, ebx
lea eax, [ecx - 0x41]
cmp eax, 0x19
cmovbe ebx, eax
lea eax, [esp + 0x10]
cmp edi, eax
je 0x442f82
push edi
call fcn.00470430
add esp, 4
push 0
call fcn.00444760
add esp, 4
call fcn.0043a0b0
mov ecx, dword [esp + 0x220]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004daa4c
add esp, 0x214
ret

Function at 0x442fb0
Capabilities:
Delete file

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00443a20
add esp, 4
mov edi, eax
call fcn.0043a0b0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00444780
add esp, 8
call fcn.0043a0b0
test edi, edi
je 0x442fef
push edi
call fcn.00470430
add esp, 4
pop edi
mov eax, esi
pop esi
ret

Function at 0x443410
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call fcn.0043a0b0
mov ebx, dword [esp + 0x14]
xor esi, esi
push dword [esp + 0x10]
mov dword [ebx], 0
call fcn.00443a20
add esp, 4
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44344e
push eax
call fcn.004ccc70
add esp, 4
mov dword [ebx], eax
mov esi, 1
push 0
push esi
call fcn.00444780
add esp, 8
test edi, edi
je 0x443466
push edi
call fcn.00470430
add esp, 4
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x443740
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443756
jmp dword [ecx*4 + 0x4437d0]
xor eax, eax
jmp case.default.0x443756
push 0xfffffffffffffff6
jmp 0x44376b
push 0xfffffffffffffff5
jmp 0x44376b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push edi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x443794
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443794
xor esi, esi
jmp 0x443799
mov esi, 1
push 0
push esi
call fcn.00444780
add esp, 8
test esi, esi
je 0x4437b6
mov edx, dword [esp + 8]
xor eax, eax
or eax, edi
pop edi
pop esi
add esp, 8
ret
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret
Function at 0x44375d
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443756
jmp dword [ecx*4 + 0x4437d0]
xor eax, eax
jmp case.default.0x443756
push 0xfffffffffffffff6
jmp 0x44376b
push 0xfffffffffffffff5
jmp 0x44376b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push edi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x443794
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443794
xor esi, esi
jmp 0x443799
mov esi, 1
push 0
push esi
call fcn.00444780
add esp, 8
test esi, esi
je 0x4437b6
mov edx, dword [esp + 8]
xor eax, eax
or eax, edi
pop edi
pop esi
add esp, 8
ret
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret

Function at 0x443761
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443756
jmp dword [ecx*4 + 0x4437d0]
xor eax, eax
jmp case.default.0x443756
push 0xfffffffffffffff6
jmp 0x44376b
push 0xfffffffffffffff5
jmp 0x44376b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push edi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x443794
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443794
xor esi, esi
jmp 0x443799
mov esi, 1
push 0
push esi
call fcn.00444780
add esp, 8
test esi, esi
je 0x4437b6
mov edx, dword [esp + 8]
xor eax, eax
or eax, edi
pop edi
pop esi
add esp, 8
ret
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret

Function at 0x443765
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443756
jmp dword [ecx*4 + 0x4437d0]
xor eax, eax
jmp case.default.0x443756
push 0xfffffffffffffff6
jmp 0x44376b
push 0xfffffffffffffff5
jmp 0x44376b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push edi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x443794
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443794
xor esi, esi
jmp 0x443799
mov esi, 1
push 0
push esi
call fcn.00444780
add esp, 8
test esi, esi
je 0x4437b6
mov edx, dword [esp + 8]
xor eax, eax
or eax, edi
pop edi
pop esi
add esp, 8
ret
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret
Function at 0x443769
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
lea ecx, [eax + 1]
cmp ecx, 3
ja case.default.0x443756
jmp dword [ecx*4 + 0x4437d0]
xor eax, eax
jmp case.default.0x443756
push 0xfffffffffffffff6
jmp 0x44376b
push 0xfffffffffffffff5
jmp 0x44376b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push edi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x443794
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443794
xor esi, esi
jmp 0x443799
mov esi, 1
push 0
push esi
call fcn.00444780
add esp, 8
test esi, esi
je 0x4437b6
mov edx, dword [esp + 8]
xor eax, eax
or eax, edi
pop edi
pop esi
add esp, 8
ret
xorps xmm0, xmm0
movlpd qword [esp + 8], xmm0
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret

Function at 0x4437e0
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
js 0x443817
call fcn.0043a0b0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, esi
shr eax, cl
and al, 1
movzx esi, al
neg esi
sbb esi, esi
neg esi
dec esi
call fcn.0043a0b0
push 0
call fcn.00444760
add esp, 4
mov eax, esi
pop esi
ret
push 0
or esi, 0xffffffff
call fcn.00444760
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x4439d0
Capabilities:
Create directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.00443a20
add esp, 4
mov edi, eax
call fcn.0043a0b0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
push 0
sbb esi, esi
neg esi
push esi
call fcn.00444780
add esp, 8
call fcn.0043a0b0
test edi, edi
je 0x443a11
push edi
call fcn.00470430
add esp, 4
pop edi
mov eax, esi
pop esi
ret
Function at 0x443e10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x443e91
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x443e5a
jmp dword [edi*4 + 0x443f4c]
xor esi, esi
jmp case.default.0x443e5a
push 0xfffffffffffffff6
jmp 0x443e6f
push 0xfffffffffffffff5
jmp 0x443e6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x443f23
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x443e9a
jmp dword [edi*4 + 0x443f5c]
xor eax, eax
jmp 0x443ec5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x443f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443f00
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x443e61
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x443e91
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x443e5a
jmp dword [edi*4 + 0x443f4c]
xor esi, esi
jmp case.default.0x443e5a
push 0xfffffffffffffff6
jmp 0x443e6f
push 0xfffffffffffffff5
jmp 0x443e6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x443f23
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x443e9a
jmp dword [edi*4 + 0x443f5c]
xor eax, eax
jmp 0x443ec5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x443f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443f00
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x443e65
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x443e91
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x443e5a
jmp dword [edi*4 + 0x443f4c]
xor esi, esi
jmp case.default.0x443e5a
push 0xfffffffffffffff6
jmp 0x443e6f
push 0xfffffffffffffff5
jmp 0x443e6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x443f23
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x443e9a
jmp dword [edi*4 + 0x443f5c]
xor eax, eax
jmp 0x443ec5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x443f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443f00
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x443e69
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x443e91
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x443e5a
jmp dword [edi*4 + 0x443f4c]
xor esi, esi
jmp case.default.0x443e5a
push 0xfffffffffffffff6
jmp 0x443e6f
push 0xfffffffffffffff5
jmp 0x443e6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x443f23
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x443e9a
jmp dword [edi*4 + 0x443f5c]
xor eax, eax
jmp 0x443ec5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x443f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443f00
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x443e6d
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.0043a0b0
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
lea edi, [esi + 1]
call fcn.004cc110
test eax, eax
je 0x443e91
mov dword [esp + 0x10], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
cmp edi, 3
ja case.default.0x443e5a
jmp dword [edi*4 + 0x443f4c]
xor esi, esi
jmp case.default.0x443e5a
push 0xfffffffffffffff6
jmp 0x443e6f
push 0xfffffffffffffff5
jmp 0x443e6f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
jmp 0x443f23
mov dword [esp + 0x14], ebx
cmp edi, 3
ja case.default.0x443e9a
jmp dword [edi*4 + 0x443f5c]
xor eax, eax
jmp 0x443ec5
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x443ec5
mov eax, esi
push 0
lea ecx, [esp + 0x18]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x443f00
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x443f00
push 0
push 0
call fcn.00444780
add esp, 8
xor esi, esi
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
push esi
call fcn.004429a0
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
neg eax
push eax
call fcn.00444780
mov esi, dword [esp + 0x18]
add esp, 8
call fcn.0043a0b0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret