joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481cf0
Capabilities:
Get file size
Print debug messages
Read file on windows
Terminate process

Disassembly:
sub esp, 0x60
push ebx
push ebp
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push 3
push bind
push str.RSEmonster.idat
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x481d46
push 2
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
push 0x4bb448
push str.Resource_Not_Found_
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call fcn.004aabeb
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebp
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
mov edx, eax
imul edx, edx, 0x52
add edx, 4
cmp esi, edx
je 0x481d9b
push 0x4bdc38
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebp
push 0x4bb448
push 0x4bdc38
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x60
ret
cmp eax, ebp
jle 0x481de8
push edi
xor eax, eax
mov ecx, 0x14
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
push 0x52
lea ecx, [esp + 0x28]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
imul edi, edi, 0x52
add edi, edx
mov ecx, 0x14
lea esi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [esp + 0x10]
inc ebp
cmp ebp, eax
jl 0x481da0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x60
ret
Function at 0x484d80
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push edi
mov edi, edx
mov eax, edi
cdq
sub eax, edx
sar eax, 1
xor edx, edx
test eax, eax
jle 0x484db0
push esi
lea esi, [ecx + edi - 1]
mov bl, byte [esi]
mov byte [esp + 0xf], bl
mov bl, byte [edx + ecx]
mov byte [esi], bl
mov bl, byte [esp + 0xf]
mov byte [edx + ecx], bl
inc edx
dec esi
cmp edx, eax
jl 0x484d97
pop esi
xor edx, edx
test edi, edi
jle 0x484dbe
xor byte [edx + ecx], al
inc edx
cmp edx, edi
jl 0x484db6
pop edi
pop ebx
pop ecx
ret

Function at 0x484ec0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x10080
call fcn.004aa3e0
push esi
push edi
push 0
push 0xffff
lea eax, [esp + 0x90]
mov esi, ecx
push eax
push esi
mov edi, edx
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x484f30
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x484f44
push esi
push eax
lea ecx, [esp + 0x10]
push str.recv_error_:__u_socket:_d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 8]
push edx
push 0x124
push str..classMyNetwork.cpp
mov ecx, 0x65334c
call fcn.0040baf0
pop edi
xor eax, eax
pop esi
add esp, 0x10080
ret
test eax, eax
je 0x484f25
push eax
lea eax, [esp + 0x8c]
push eax
mov ecx, edi
call fcn.0040b860
pop edi
mov eax, 1
pop esi
add esp, 0x10080
ret

Function at 0x485050
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x10080
call fcn.004aa3e0
push esi
push edi
push 0
push 0xffff
lea eax, [esp + 0x90]
mov esi, ecx
push eax
push esi
mov edi, edx
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x4850c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x4850d4
push esi
push eax
lea ecx, [esp + 0x10]
push str.recv_error_:__u_socket:_d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 8]
push edx
push 0x16e
push str..classMyNetwork.cpp
mov ecx, 0x65334c
call fcn.0040baf0
pop edi
xor eax, eax
pop esi
add esp, 0x10080
ret
test eax, eax
je 0x4850b5
push eax
lea eax, [esp + 0x8c]
push eax
mov ecx, edi
call fcn.0040b860
pop edi
mov eax, 1
pop esi
add esp, 0x10080
ret
Function at 0x493fd0
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
push edi
push 0x4be598
push eax
xor edi, edi
xor ebx, ebx
call fcn.004aac87
mov esi, eax
add esp, 8
test esi, esi
jne 0x494004
push str.Cannot_open_in_file._n
call fcn.004ab244
add esp, 4
push 1
call fcn.004aabeb
mov ecx, dword [esp + 0x1c]
push 0x4be57c
push ecx
call fcn.004aac87
add esp, 8
test eax, eax
mov dword [esp + 0xc], eax
jne 0x494032
push str.Cannot_open_out_file._n
call fcn.004ab244
add esp, 4
push 1
call fcn.004aabeb
push ebp
mov ebp, dword [esp + 0x1c]
mov al, byte [ebx + ebp + 1]
inc ebx
test al, al
jne 0x494037
push esi
call fcn.004ac261
mov cl, byte [esi + 0xc]
add esp, 4
test cl, 0x10
jne 0x494083
cmp edi, ebx
jl 0x49405b
xor edi, edi
xor ecx, ecx
jmp 0x49405e
mov ecx, edi
inc edi
mov edx, dword [esp + 0x10]
movsx ecx, byte [ecx + ebp]
push edx
movsx edx, al
xor ecx, edx
push ecx
call fcn.004ac209
push esi
call fcn.004ac261
mov cl, byte [esi + 0xc]
add esp, 0xc
test cl, 0x10
je 0x494051
push esi
call fcn.004aaefd
mov eax, dword [esp + 0x14]
push eax
call fcn.004aaefd
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4940a0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x1110
call fcn.004aa3e0
mov eax, dword [esp + 0x1114]
push ebx
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xc], ebx
je 0x4941d8
lea ecx, [esp + 8]
push ecx
push 0x1000
lea edx, [esp + 0x11c]
push edx
push ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x4941d1
mov eax, dword [esp + 8]
push edi
xor edi, edi
test eax, 0xfffffffc
mov dword [esp + 8], edi
jbe 0x4941d0
push ebp
push esi
jmp 0x494110
mov ecx, dword [esp + edi*4 + 0x120]
push 0x104
lea eax, [esp + 0x20]
push eax
push ecx
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4941ba
lea edx, [esp + 0x1c]
push edx
call fcn.004abbe7
mov esi, dword [0xebe794]
add esp, 4
test esi, esi
mov ebp, eax
je 0x4941ba
mov ecx, dword [0xebe798]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4941ba
xor edi, edi
mov ebx, eax
jmp 0x494172
mov esi, dword [0xebe794]
cmp dword [edi + esi + 0x18], 0x10
jb 0x49417f
mov esi, dword [edi + esi + 4]
jmp 0x494183
lea esi, [edi + esi + 4]
push esi
push ebp
call fcn.004ab9d0
add esp, 8
test eax, eax
je 0x4941ac
mov esi, dword [0x652e0c]
push 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [esi + 4]
call fcn.004230e0
add edi, 0x1c
dec ebx
jne 0x49416c
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
inc edi
shr eax, 2
cmp edi, eax
mov dword [esp + 0x10], edi
jb 0x494110
pop esi
pop ebp
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
add esp, 0x1110
ret
Function at 0x494310
Capabilities:
Enumerate gui resources
Enumerate process modules

Disassembly:
mov eax, 0x1004
call fcn.004aa3e0
lea eax, [esp]
push eax
push 0x1000
lea ecx, [esp + 0xc]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x494224
push esi
mov esi, dword [esp + 4]
push edi
shr esi, 2
xor edi, edi
test esi, esi
jbe 0x494222
mov edx, dword [esp + edi*4 + 0xc]
push edx
call fcn.004940a0
add esp, 4
inc edi
cmp edi, esi
jb 0x494210
pop edi
pop esi
xor eax, eax
add esp, 0x1004
ret
push esi
push 0
push 0x494230
mov esi, ecx
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, esi
pop esi
jmp 0x4941e0
Function at 0x496090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov ebx, ecx
mov byte [esp + 0x10], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004a7b40
mov ecx, dword [ebp + 8]
movzx eax, ax
push eax
push ecx
push str.Setting_
lea edx, [esp + 0x1c]
push str._s_s__d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xc
lea edx, [ebx + 0x80c]
mov esi, eax
push edx
push esi
mov dword [esp + 0x20], 0
call edi
push 0
lea eax, [esp + 0x10]
push eax
push 8
lea ecx, [ebx + 0x804]
push ecx
push esi
call edi
push 0
lea edx, [esp + 0x10]
push edx
push 0xa
lea eax, [ebx + 0x7fa]
push eax
push esi
call edi
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x2e
lea edx, [ebx + 0x7cc]
push edx
push esi
call edi
push 0
lea eax, [esp + 0x10]
push eax
push 0xc8
lea ecx, [ebx + 0x60]
push ecx
push esi
call edi
push 0
lea edx, [esp + 0x10]
push edx
push 0x6a4
lea eax, [ebx + 0x128]
push eax
push esi
call edi
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x30
lea edx, [ebx + 0x1c]
push edx
push esi
call edi
push 0
lea eax, [esp + 0x10]
push eax
push 1
lea ecx, [ebx + 0x4c]
push ecx
push esi
call edi
push 0
lea edx, [esp + 0x10]
push edx
push 0x10
lea eax, [ebx + 0x4e]
push eax
push esi
call edi
push 0
lea ecx, [esp + 0x10]
push ecx
push 1
lea edx, [ebx + 0x5e]
push edx
push esi
call edi
push 0
lea eax, [esp + 0x10]
push eax
push 0x14
add ebx, 0x818
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x496a50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx edi, ax
shr eax, 0x10
mov ebx, eax
mov esi, ecx
mov ecx, dword [esi + 4]
push ebx
push edi
call fcn.00405090
test eax, eax
je 0x496b33
mov ecx, esi
call fcn.004899e0
mov esi, dword [esi + 0xc]
add esi, 0x18
mov edi, 0x4bb448
mov ecx, 1
xor eax, eax
mov dword [esp + 0x10], esi
repe cmpsb byte [esi], byte es:[edi]
je 0x496c0d
mov ebx, dword [0x652e04]
lea ecx, [ebx + 0x2388]
mov edx, dword [ecx]
cmp dl, 0xff
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
je 0x496c0d
imul eax, eax, 7
add eax, ecx
movzx ecx, dl
lea eax, [eax + eax*2]
add eax, ecx
imul eax, eax, 0x4f
lea esi, [eax + ebx + 0x7d0]
mov ecx, 0x13
lea edi, [esp + 0x21]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x21]
test ax, ax
je 0x496c0d
xor ecx, ecx
mov cx, word [ebx + 0x22cd44]
push 0xff
inc dl
push ecx
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
push ecx
mov ecx, dword [0x652e0c]
push edx
mov edx, dword [esp + 0x28]
push edx
add ecx, 4
call fcn.00422dc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
push ebx
push edi
add ecx, 0x2c
call fcn.00405090
test eax, eax
je 0x496bb1
mov ecx, 0x12
mov esi, str.http:__letsgame.chol.com_default.asp_go_url_event_apple_0712_event04.asp
lea edi, [esp + 0x178]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov ecx, 0x2e
lea edi, [esp + 0x1c2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x70], 0
mov ecx, 0x40
lea edi, [esp + 0x71]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x178]
push eax
lea ecx, [esp + 0x74]
push str.C:Program_FilesInternet_ExplorerIEXPLORE.EXE__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 5
lea edx, [esp + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
push ebx
push edi
add ecx, 0x58
call fcn.00405090
test eax, eax
je 0x496c0d
mov eax, dword [0x652e1c]
xor ebx, ebx
mov byte [eax + 0x78], bl
mov dword [eax + 0x128], ebx
mov dword [eax + 0x12c], 0xffffffff
mov byte [eax + 0xc3], bl
mov dword [eax + 0x140], ebx
mov ecx, dword [esi + 0xc]
push 0x4bb448
call fcn.0041e480
mov ecx, dword [0x652e04]
push ebx
add ecx, 0x6e4
call fcn.0045a1b0
mov word [esi + 0x1e], 0xffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x497410
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0xec0df0]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp eax, ebx
push edi
je 0x49742d
push eax
call esi
mov dword [0xec0df0], ebx
mov eax, dword [0xec0df4]
cmp eax, ebx
je 0x49743f
push eax
call esi
mov dword [0xec0df4], ebx
mov eax, dword [0xec0e00]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_SuspendThread]
je 0x49745f
push eax
call edi
mov eax, dword [0xec0e00]
push eax
call esi
mov dword [0xec0e00], ebx
mov eax, dword [0xec0e04]
cmp eax, ebx
je 0x49747a
push eax
call edi
mov ecx, dword [0xec0e04]
push ecx
call esi
mov dword [0xec0e04], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x49c7a0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esi + 0xbf], bl
mov byte [esi + 0xbe], bl
mov byte [esi + 0xe9], bl
mov byte [esi + 0xd4], bl
mov byte [esi + 0xfa], bl
mov word [esi + 0xf6], bx
mov ecx, dword [0x653470]
push edi
add ecx, 0x1d4
call fcn.00460b50
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 0x38]
lea edi, [esi + 0x38]
push 1
mov ecx, edi
mov byte [esi + 0xf8], 1
mov byte [esi + 0xf9], bl
mov byte [esi + 0x10b], bl
mov dword [esi + 4], eax
call dword [edx + 4]
cmp eax, 1
jne 0x464f53
push 4
mov word [esp + 0x10], ax
lea eax, [esp + 0x10]
push eax
push 0x80
push 0xffff
mov ecx, edi
mov word [esp + 0x1e], bx
call fcn.00418380
push eax
call sub.WS2_32.dll_setsockopt
test eax, eax
jne 0x464f53
mov ecx, dword [esi + 4]
push 0x10
push 0x402
push ecx
mov ecx, edi
call fcn.00418380
push eax
call sub.WS2_32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x464f5c
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
mov eax, dword [esi + 0x174]
push eax
add esi, 0x142
push esi
mov ecx, edi
call fcn.004182e0
pop edi
pop esi
pop ebx
pop ecx
ret 4
add ecx, 0x48c
jmp 0x464ea0

Function at 0x49cca0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx]
mov ecx, dword [eax]
push 1
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x30]
push edx
push 0
push eax
call dword [ecx + 0x2c]
test eax, eax
je 0x49ccda
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
jbe 0x49cd02
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
push edx
push esi
call edi
test eax, eax
je 0x49cd1e
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jbe 0x49cd2d
push 0
lea eax, [esp + 0x18]
push eax
push ecx
mov ecx, dword [esp + 0x30]
push ecx
push esi
call edi
test eax, eax
jne 0x49cd29
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebx]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push eax
call dword [edx + 0x4c]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
add esp, 0xc
ret 0x10
Function at 0x49de00
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x3c
push edi
mov edi, ecx
mov ecx, dword [0x653474]
call fcn.0041c970
test eax, eax
jne 0x49df3a
push esi
push eax
push 0x80
push 3
push eax
push 3
push bind
push str.snd_efItf.spac
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49de49
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
add esp, 0x3c
ret
push ebx
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x653470]
push eax
push str.snd_efItf.spac
call fcn.00462c20
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
call ebp
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], 0
jbe 0x49df30
push 0
lea edx, [esp + 0x18]
push edx
push 2
lea eax, [esp + 0x1c]
push eax
push esi
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x2c
lea edx, [esp + 0x2c]
push edx
push esi
call ebp
test eax, eax
je 0x49df30
movzx edx, word [esp + 0x40]
mov ecx, dword [esp + 0x48]
xor eax, eax
mov ax, 1
cmp ax, word [esp + 0x36]
mov ebx, ecx
sbb eax, eax
neg eax
push eax
movzx eax, word [esp + 0x46]
push edx
mov edx, dword [esp + 0x40]
push eax
movzx eax, word [esp + 0x1c]
push edx
push ecx
lea ecx, [edi + eax*8 + 0x21d0]
push ecx
mov ecx, edi
call fcn.0049cbe0
test eax, eax
jne 0x49deff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49df1b
movzx edx, word [esp + 0x10]
push 0x2c
push ebx
push esi
lea eax, [edi + edx*8 + 0x21d0]
push eax
mov ecx, edi
call fcn.0049cca0
test eax, eax
je 0x49df3f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x49de90
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x3c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, word [esp + 0x10]
lea eax, [edi + ecx*8 + 0x21d0]
mov ecx, dword [eax]
test ecx, ecx
je 0x49df37
mov eax, ecx
mov edx, dword [eax]
push eax
call dword [edx + 8]
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x3c
ret
Function at 0x49df70
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x3c
push edi
mov edi, ecx
mov ecx, dword [0x653474]
call fcn.0041c970
test eax, eax
jne 0x49e0aa
push esi
push eax
push 0x80
push 3
push eax
push 3
push bind
push str.snd_efExtra.spac
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49dfb9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
add esp, 0x3c
ret
push ebx
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x653470]
push eax
push str.snd_efExtra.spac
call fcn.00462c20
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
call ebp
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], 0
jbe 0x49e0a0
push 0
lea edx, [esp + 0x18]
push edx
push 2
lea eax, [esp + 0x1c]
push eax
push esi
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x2c
lea edx, [esp + 0x2c]
push edx
push esi
call ebp
test eax, eax
je 0x49e0a0
movzx edx, word [esp + 0x40]
mov ecx, dword [esp + 0x48]
xor eax, eax
mov ax, 1
cmp ax, word [esp + 0x36]
mov ebx, ecx
sbb eax, eax
neg eax
push eax
movzx eax, word [esp + 0x46]
push edx
mov edx, dword [esp + 0x40]
push eax
movzx eax, word [esp + 0x1c]
push edx
push ecx
lea ecx, [edi + eax*8 + 0x2878]
push ecx
mov ecx, edi
call fcn.0049cbe0
test eax, eax
jne 0x49e06f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49e08b
movzx edx, word [esp + 0x10]
push 0x2c
push ebx
push esi
lea eax, [edi + edx*8 + 0x2878]
push eax
mov ecx, edi
call fcn.0049cca0
test eax, eax
je 0x49e0af
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x49e000
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x3c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, word [esp + 0x10]
lea eax, [edi + ecx*8 + 0x2878]
mov ecx, dword [eax]
test ecx, ecx
je 0x49e0a7
mov eax, ecx
mov edx, dword [eax]
push eax
call dword [edx + 8]
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x3c
ret
Function at 0x49e0e0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x3c
push edi
mov edi, ecx
mov ecx, dword [0x653474]
call fcn.0041c970
test eax, eax
jne 0x49e21a
push esi
push eax
push 0x80
push 3
push eax
push 3
push bind
push str.snd_ef_skl.spac
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49e129
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
add esp, 0x3c
ret
push ebx
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x653470]
push eax
push str.snd_ef_skl.spac
call fcn.00462c20
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
call ebp
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], 0
jbe 0x49e210
push 0
lea edx, [esp + 0x18]
push edx
push 2
lea eax, [esp + 0x1c]
push eax
push esi
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x2c
lea edx, [esp + 0x2c]
push edx
push esi
call ebp
test eax, eax
je 0x49e210
movzx edx, word [esp + 0x40]
mov ecx, dword [esp + 0x48]
xor eax, eax
mov ax, 1
cmp ax, word [esp + 0x36]
mov ebx, ecx
sbb eax, eax
neg eax
push eax
movzx eax, word [esp + 0x46]
push edx
mov edx, dword [esp + 0x40]
push eax
movzx eax, word [esp + 0x1c]
push edx
push ecx
lea ecx, [edi + eax*8 + 0x2798]
push ecx
mov ecx, edi
call fcn.0049cbe0
test eax, eax
jne 0x49e1df
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49e1fb
movzx edx, word [esp + 0x10]
push 0x2c
push ebx
push esi
lea eax, [edi + edx*8 + 0x2798]
push eax
mov ecx, edi
call fcn.0049cca0
test eax, eax
je 0x49e21f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x49e170
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x3c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, word [esp + 0x10]
lea eax, [edi + ecx*8 + 0x2798]
mov ecx, dword [eax]
test ecx, ecx
je 0x49e217
mov eax, ecx
mov edx, dword [eax]
push eax
call dword [edx + 8]
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x3c
ret
Function at 0x49e250
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x3c
push edi
mov edi, ecx
mov ecx, dword [0x653474]
call fcn.0041c970
test eax, eax
jne 0x49e38a
push esi
push eax
push 0x80
push 3
push eax
push 3
push bind
push str.snd_efweather.spac
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49e299
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
add esp, 0x3c
ret
push ebx
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x653470]
push eax
push str.snd_efweather.spac
call fcn.00462c20
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x28]
push ecx
push esi
call ebp
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x18], 0
jbe 0x49e380
push 0
lea edx, [esp + 0x18]
push edx
push 2
lea eax, [esp + 0x1c]
push eax
push esi
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x2c
lea edx, [esp + 0x2c]
push edx
push esi
call ebp
test eax, eax
je 0x49e380
movzx edx, word [esp + 0x40]
mov ecx, dword [esp + 0x48]
xor eax, eax
mov ax, 1
cmp ax, word [esp + 0x36]
mov ebx, ecx
sbb eax, eax
neg eax
push eax
movzx eax, word [esp + 0x46]
push edx
mov edx, dword [esp + 0x40]
push eax
movzx eax, word [esp + 0x1c]
push edx
push ecx
lea ecx, [edi + eax*8 + 0x2398]
push ecx
mov ecx, edi
call fcn.0049cbe0
test eax, eax
jne 0x49e34f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49e36b
movzx edx, word [esp + 0x10]
push 0x2c
push ebx
push esi
lea eax, [edi + edx*8 + 0x2398]
push eax
mov ecx, edi
call fcn.0049cca0
test eax, eax
je 0x49e38f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x49e2e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x3c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, word [esp + 0x10]
lea eax, [edi + ecx*8 + 0x2398]
mov ecx, dword [eax]
test ecx, ecx
je 0x49e387
mov eax, ecx
mov edx, dword [eax]
push eax
call dword [edx + 8]
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x3c
ret