joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4504a4
Capabilities:
Create thread

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], edi
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00450201
test eax, eax
je 0x45053b
mov dword [esp + 0xc], eax
mov ebx, eax
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], str.WARNING:_Found_stale__s___d__image_mounted_on__s___Attempting_to_unmount_it...
call fcn.0043efa9
xor eax, eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], 0x52ae40
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
xor eax, eax
mov word [0x52ac20], 0
sub esp, 0x18
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00450144
xor ecx, ecx
lea eax, [ebp - 0x28]
xor ebx, ebx
mov dword [esp + 8], 0x44eca6
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x52a8e0], eax
sub esp, 0x18
test eax, eax
jne 0x45057d
mov dword [esp], str.Unable_to_start_mount_image_thread
call fcn.0043efa9
jmp 0x4505d8
mov edx, dword [0x4929fc]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push eax
push eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [0x52a8e0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push eax
push eax
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [0x52a8e0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
push edx
push edx
test eax, eax
jne 0x4505ca
xor edi, edi
mov dword [ebp - 0x2c], edi
xor esi, esi
cmp dword [ebp - 0x2c], 0
mov dword [0x52a8e0], esi
jne 0x4505df
xor edx, edx
jmp 0x4506a9
cmp word [0x52ae40], 0
jne 0x450603
mov dword [ebp + 0xc], 1
mov dword [ebp + 8], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp sub.msvcrt.dll_calloc
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0xc], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0x52ae40
mov dword [esp + 4], ebx
mov dword [esp], 0xfde9
call esi
sub esp, 0x20
mov edi, eax
cmp eax, 1
jle 0x4505d8
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_calloc
mov dword [ebp - 0x3c], eax
mov ebx, eax
test eax, eax
je 0x4505d8
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], edi
mov dword [esp + 4], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x52ae40
mov dword [esp], 0xfde9
call esi
mov edx, dword [ebp - 0x3c]
sub esp, 0x20
cmp edi, eax
je 0x4506a9
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x4505d8
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45139b
Capabilities:
Create thread

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0x44f35e
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x52a8e0], eax
sub esp, 0x18
test eax, eax
jne 0x4513ff
mov dword [esp], str.Unable_to_start_apply_image_thread
call fcn.0043efa9
xor eax, eax
jmp 0x451456
mov edx, dword [0x4929fc]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov eax, dword [0x52a8e0]
push ecx
push ecx
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push eax
push eax
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [0x52a8e0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
push edx
push edx
test eax, eax
jne 0x45144c
xor edx, edx
mov dword [ebp - 0x1c], edx
xor eax, eax
mov dword [0x52a8e0], eax
mov eax, dword [ebp - 0x1c]
leave
ret
Function at 0x4523fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x28], eax
mov eax, 0x5267e0
call fcn.00452330
mov dword [ebp - 0x1c], eax
mov eax, 0x4b4cb0
call fcn.00452330
mov dword [esp + 4], 2
mov dword [esp], 0x104
mov edi, eax
call sub.msvcrt.dll_calloc
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov esi, eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
sub esp, 0x10
mov dword [ebp - 0x24], eax
call eax
test ebx, ebx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
je 0x4524ae
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 4], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0x104
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], esi
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
sub esp, 0x20
mov ebx, eax
test eax, eax
jne 0x4524ae
mov eax, dword [ebp - 0x24]
call eax
mov dword [ebp - 0x20], eax
test esi, esi
je 0x4524ba
mov dword [esp], esi
call sub.msvcrt.dll_free
test edi, edi
je 0x4524c6
mov dword [esp], edi
call sub.msvcrt.dll_free
cmp dword [ebp - 0x1c], 0
je 0x4524d7
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x452559
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ecx, 0x41
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x11c]
push ebx
sub esp, 0x16c
mov dword [ebp - 0x13c], edx
xor edx, edx
mov dword [ebp - 0x140], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [ebp - 0x130], edx
mov ecx, 0x1ff
mov dword [ebp - 0x12c], edx
mov edx, 0x52b160
mov dword [ebp - 0x124], 0xffffffff
mov edi, edx
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x120], 0x1ff
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x11c]
mov ecx, eax
mov ebx, eax
test ebx, ebx
je 0x452679
mov eax, dword [ebp - 0x13c]
cmp byte [eax + ebx], 0x5c
je 0x4525df
dec ebx
jmp 0x4525c8
cmp ebx, 0x103
ja 0x452776
mov eax, 0x104
inc ecx
mov esi, dword [ebp - 0x13c]
mov edi, edx
cmp ecx, eax
cmova ecx, eax
mov eax, dword [ebp - 0x13c]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edx, [ebp - 0x11c]
lea ecx, [eax + 1]
cmp ecx, 0x104
mov ecx, 0x103
cmovae eax, ecx
mov byte [ebp + eax - 0x11c], 0
lea eax, [ebp - 0x12c]
mov byte [ebp + ebx - 0x11c], 0
inc ebx
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x140]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x45270e
xor eax, eax
mov dword [ebp - 0x12c], eax
jmp 0x45274e
lea eax, [ebp - 0x130]
mov dword [esp + 0xc], 0x2001d
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.SOFTWARE
mov eax, dword [ebp - 0x140]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x4526bc
xor eax, eax
mov dword [ebp - 0x130], eax
jmp 0x45274e
lea eax, [ebp - 0x128]
xor edi, edi
xor esi, esi
mov dword [esp + 0x14], 7
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x12c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], str.Akeo_ConsultingRufus
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne 0x45266c
lea eax, [ebp - 0x120]
xor ecx, ecx
mov dword [esp + 0x10], 0x52b160
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x124]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov eax, dword [ebp - 0x13c]
add eax, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x452762
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x452776
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45374f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x41
mov ebp, esp
push edi
push ebx
lea edi, [ebp - 0x10c]
sub esp, 0x1b0
rep stosd dword es:[edi], eax
xor ecx, ecx
cmp dword [0x5275c0], 0x61
mov dword [0x513314], ecx
mov dword [0x513318], ecx
jbe 0x4537bc
mov dword [esp], 1
call fcn.0044fdf9
test al, 4
je 0x4537bc
cmp byte [0x5132f7], 0
lea ebx, [ebp - 0x10c]
jne 0x4537f5
mov eax, dword [0x525a68]
mov dword [esp], eax
call fcn.00451503
test eax, eax
jne 0x4537c3
mov dword [esp], str.Could_not_mount_Windows_ISO_for_build_number_detection
call fcn.0043efa9
xor eax, eax
jmp 0x4538bc
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x18c]
mov dword [esp + 0x10], 0x513022
mov dword [esp + 8], 0x4b62ba
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__snprintf]
mov byte [ebp - 0x10d], 0
mov eax, ebx
call fcn.004523fa
test eax, eax
je 0x453809
cmp byte [ebp - 0x10c], 0
jne 0x453831
mov dword [ebp - 0x108], 0x6d585666
mov dword [ebp - 0x10c], 0x75525c2e
mov dword [ebp - 0x106], 0x2e6c6d58
mov dword [ebp - 0x102], 0x706d74
mov eax, ebx
call fcn.0045277e
cmp byte [0x5132f7], 0
lea eax, [ebp - 0x18c]
je 0x45384c
mov eax, dword [0x525a68]
xor edx, edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._1_.xml
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004506b3
test eax, eax
jne 0x453880
mov dword [esp], str.Could_not_acquire_WIM_index
call fcn.0043efa9
jmp 0x45388c
mov edx, 1
mov eax, ebx
call fcn.004521cc
mov eax, ebx
call fcn.0045277e
cmp byte [0x5132f7], 0
jne 0x4538a1
call fcn.00451458
cmp word [0x513314], 0
je 0x4537bc
xor eax, eax
cmp word [0x513318], 0
setne al
add esp, 0x1b0
pop ebx
pop edi
pop ebp
ret
Function at 0x45577a
Capabilities:
Encode data using xor
Hash data using crc32b
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4557a6
mov dword [esp + 4], 4
mov dword [esp], 0x100
call sub.msvcrt.dll_calloc
test eax, eax
je 0x455840
cmp dword [ebp + 0xc], 0
je 0x4557e8
mov dword [ebp - 0x1c], 8
mov ecx, 1
mov edx, 0x80000000
lea ebx, [edx + edx]
sar edx, 0x1f
lea edi, [eax + ecx*4]
and edx, 0x4c11db7
xor edx, ebx
xor ebx, ebx
cmp ebx, ecx
je 0x4557df
mov esi, dword [eax + ebx*4]
xor esi, edx
mov dword [edi + ebx*4], esi
inc ebx
jmp 0x4557d0
add ecx, ecx
dec dword [ebp - 0x1c]
jne 0x4557bd
jmp 0x455840
mov dword [ebp - 0x1c], 8
xor edx, edx
mov esi, 1
mov dword [eax], edx
mov edx, pe_nt_image_headers32
mov ebx, esi
shr ebx, 1
and esi, 1
mov ecx, esi
je 0x45580d
mov ecx, 0xedb88320
mov esi, ebx
xor esi, ecx
lea ecx, [edx + edx]
mov dword [ebp - 0x24], ecx
lea ecx, [eax + edx*4]
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov ebx, dword [eax + ecx*4]
xor ebx, esi
mov edi, ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx + ecx*4], edi
mov edi, dword [ebp - 0x24]
add ecx, edi
cmp ecx, 0xff
jbe 0x45581f
shr edx, 1
dec dword [ebp - 0x1c]
jne 0x4557fd
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x45586a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test eax, eax
jns 0x45588a
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x45596a
test edx, edx
jne 0x45589f
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x45596a
mov eax, ecx
cmp dword [0x492b64], ecx
jae 0x4558ba
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x45596a
mov ecx, dword [0x52b4e0]
test ecx, ecx
je 0x4558da
cmp dword [ecx], 0
je 0x4558da
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x45596a
cmp dword [0x492b68], esi
jne 0x45590d
mov esi, dword [0x52b480]
mov ecx, dword [0x52b484]
lea ebx, [esi + eax]
cmp ecx, ebx
jae 0x4558f9
mov eax, ecx
sub eax, esi
add esi, dword [0x52b488]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x52b480], eax
jmp 0x45592c
mov ecx, dword [0x52b4f0]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x455926
call ecx
jmp 0x45592c
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x45596d
mov ebx, eax
mov edx, dword [0x52b4e8]
mov ecx, eax
sar ebx, 0x1f
add ecx, dword [0x52b4f8]
adc ebx, dword [0x52b4fc]
mov dword [0x52b4f8], ecx
mov dword [0x52b4fc], ebx
test edx, edx
je 0x45596d
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [esp + 4], ebx
call edx
mov eax, dword [ebp - 0x1c]
jmp 0x45596d
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4565e1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test eax, eax
jns 0x456601
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x4566e1
test edx, edx
jne 0x456616
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x4566e1
mov eax, ecx
cmp dword [0x492b64], ecx
jae 0x456631
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x4566e1
mov ecx, dword [0x52b4e0]
test ecx, ecx
je 0x456651
cmp dword [ecx], 0
je 0x456651
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x4566e1
cmp dword [0x492b68], esi
jne 0x456684
mov esi, dword [0x52b480]
mov ecx, dword [0x52b484]
lea ebx, [esi + eax]
cmp ecx, ebx
jae 0x456670
mov eax, ecx
sub eax, esi
add esi, dword [0x52b488]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x52b480], eax
jmp 0x4566a3
mov ecx, dword [0x52b4f0]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x45669d
call ecx
jmp 0x4566a3
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x4566e4
mov ebx, eax
mov edx, dword [0x52b4e8]
mov ecx, eax
sar ebx, 0x1f
add ecx, dword [0x52b4f8]
adc ebx, dword [0x52b4fc]
mov dword [0x52b4f8], ecx
mov dword [0x52b4fc], ebx
test edx, edx
je 0x4566e4
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [esp + 4], ebx
call edx
mov eax, dword [ebp - 0x1c]
jmp 0x4566e4
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x457c44
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test eax, eax
jns 0x457c64
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x457d44
test edx, edx
jne 0x457c79
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x457d44
mov eax, ecx
cmp dword [0x492b64], ecx
jae 0x457c94
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x457d44
mov ecx, dword [0x52b4e0]
test ecx, ecx
je 0x457cb4
cmp dword [ecx], 0
je 0x457cb4
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x457d44
cmp dword [0x492b68], esi
jne 0x457ce7
mov esi, dword [0x52b480]
mov ecx, dword [0x52b484]
lea ebx, [esi + eax]
cmp ecx, ebx
jae 0x457cd3
mov eax, ecx
sub eax, esi
add esi, dword [0x52b488]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x52b480], eax
jmp 0x457d06
mov ecx, dword [0x52b4f0]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x457d00
call ecx
jmp 0x457d06
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x457d47
mov ebx, eax
mov edx, dword [0x52b4e8]
mov ecx, eax
sar ebx, 0x1f
add ecx, dword [0x52b4f8]
adc ebx, dword [0x52b4fc]
mov dword [0x52b4f8], ecx
mov dword [0x52b4fc], ebx
test edx, edx
je 0x457d47
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [esp + 4], ebx
call edx
mov eax, dword [ebp - 0x1c]
jmp 0x457d47
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4582c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test eax, eax
jns 0x4582e0
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x4583c0
test edx, edx
jne 0x4582f5
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x4583c0
mov eax, ecx
cmp dword [0x492b64], ecx
jae 0x458310
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x4583c0
mov ecx, dword [0x52b4e0]
test ecx, ecx
je 0x458330
cmp dword [ecx], 0
je 0x458330
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x4583c0
cmp dword [0x492b68], esi
jne 0x458363
mov esi, dword [0x52b480]
mov ecx, dword [0x52b484]
lea ebx, [esi + eax]
cmp ecx, ebx
jae 0x45834f
mov eax, ecx
sub eax, esi
add esi, dword [0x52b488]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x52b480], eax
jmp 0x458382
mov ecx, dword [0x52b4f0]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x45837c
call ecx
jmp 0x458382
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x4583c3
mov ebx, eax
mov edx, dword [0x52b4e8]
mov ecx, eax
sar ebx, 0x1f
add ecx, dword [0x52b4f8]
adc ebx, dword [0x52b4fc]
mov dword [0x52b4f8], ecx
mov dword [0x52b4fc], ebx
test edx, edx
je 0x4583c3
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [esp + 4], ebx
call edx
mov eax, dword [ebp - 0x1c]
jmp 0x4583c3
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45ae9c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
test eax, eax
jns 0x45aebc
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x45af9c
test edx, edx
jne 0x45aed1
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x45af9c
mov eax, ecx
cmp dword [0x492b64], ecx
jae 0x45aeec
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x45af9c
mov ecx, dword [0x52b4e0]
test ecx, ecx
je 0x45af0c
cmp dword [ecx], 0
je 0x45af0c
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x45af9c
cmp dword [0x492b68], esi
jne 0x45af3f
mov esi, dword [0x52b480]
mov ecx, dword [0x52b484]
lea ebx, [esi + eax]
cmp ecx, ebx
jae 0x45af2b
mov eax, ecx
sub eax, esi
add esi, dword [0x52b488]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x52b480], eax
jmp 0x45af5e
mov ecx, dword [0x52b4f0]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x45af58
call ecx
jmp 0x45af5e
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x45af9f
mov ebx, eax
mov edx, dword [0x52b4e8]
mov ecx, eax
sar ebx, 0x1f
add ecx, dword [0x52b4f8]
adc ebx, dword [0x52b4fc]
mov dword [0x52b4f8], ecx
mov dword [0x52b4fc], ebx
test edx, edx
je 0x45af9f
mov dword [ebp - 0x1c], eax
mov dword [esp], ecx
mov dword [esp + 4], ebx
call edx
mov eax, dword [ebp - 0x1c]
jmp 0x45af9f
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x45bba4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
test eax, eax
jns 0x45bbc4
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x45bc95
test edx, edx
jne 0x45bbd9
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0xe
jmp 0x45bc95
mov eax, ecx
cmp dword [0x492b64], ecx
jae 0x45bbf4
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x45bc95
mov ecx, dword [0x52b4e0]
test ecx, ecx
je 0x45bc14
cmp dword [ecx], 0
je 0x45bc14
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x45bc95
cmp esi, dword [0x492b68]
jne 0x45bc47
mov esi, dword [0x52b480]
mov ecx, dword [0x52b484]
lea ebx, [eax + esi]
cmp ecx, ebx
jae 0x45bc33
mov eax, ecx
sub eax, esi
add esi, dword [0x52b488]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add dword [0x52b480], eax
jmp 0x45bc66
mov ecx, dword [0x52b4f0]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
test ecx, ecx
je 0x45bc60
call ecx
jmp 0x45bc66
call dword [sym.imp.msvcrt.dll__read]
test eax, eax
jle 0x45bc95
mov ecx, dword [0x52b4e8]
cdq
add eax, dword [0x52b4f8]
adc edx, dword [0x52b4fc]
mov dword [0x52b4f8], eax
mov dword [0x52b4fc], edx
test ecx, ecx
je 0x45bc95
mov dword [esp], eax
mov dword [esp + 4], edx
call ecx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45c09f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x45c0b7
xor eax, eax
jmp 0x45c1d8
mov eax, dword [eax + 8]
test eax, eax
jns 0x45c0cf
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
jmp 0x45c1b0
cmp dword [0x492b64], 1
ja 0x45c0e9
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 7
jmp 0x45c1b0
mov edx, dword [0x52b4e0]
test edx, edx
je 0x45c109
cmp dword [edx], 0
je 0x45c109
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
jmp 0x45c1b0
cmp eax, dword [0x492b68]
lea ebx, [ebp - 0x1a]
jne 0x45c148
mov eax, dword [0x52b480]
mov ecx, dword [0x52b484]
mov edx, 2
lea esi, [eax + 2]
cmp ecx, esi
jae 0x45c12f
sub ecx, eax
mov edx, ecx
mov esi, dword [0x52b488]
mov edi, ebx
mov ecx, edx
mov ebx, edx
add esi, eax
add eax, edx
rep movsb byte es:[edi], byte [esi]
mov dword [0x52b480], eax
jmp 0x45c16d
mov edx, dword [0x52b4f0]
mov dword [esp + 8], 2
mov dword [esp + 4], ebx
mov dword [esp], eax
test edx, edx
je 0x45c165
call edx
jmp 0x45c16b
call dword [sym.imp.msvcrt.dll__read]
mov ebx, eax
test ebx, ebx
jle 0x45c1b0
mov eax, ebx
mov ecx, dword [0x52b4e8]
cdq
add eax, dword [0x52b4f8]
adc edx, dword [0x52b4fc]
mov dword [0x52b4f8], eax
mov dword [0x52b4fc], edx
test ecx, ecx
je 0x45c19e
mov dword [esp], eax
mov dword [esp + 4], edx
call ecx
cmp ebx, 2
jne 0x45c1b0
movzx eax, word [ebp - 0x1a]
cmp eax, dword [ebp + 0xc]
je 0x45c0b0
mov eax, dword [0x52b4f4]
mov dword [esp], str._nError:_invalid_magic
test eax, eax
je 0x45c1c4
call eax
jmp 0x45c1d5
call sub.msvcrt.dll_printf
mov dword [esp], 0xa
call sub.msvcrt.dll_putchar
or eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret