joyce8/EMBER2024-capa huggingface dataset:
Function at 0x635530
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x635542
jmp dword [eax*4 + 0x635738]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x63561f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x635720
cmp esi, 0xffffffff
jne 0x635636
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x635646
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x63566b
mov al, byte [ecx - 1]
test al, al
je 0x63566b
cmp al, 0xff
je 0x63566b
test esi, esi
jne 0x63568f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x6356b9
test esi, esi
jne 0x63567a
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x6356b9
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x635686
cmp eax, esi
jae 0x635697
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x6356e8
mov al, byte [eax - 1]
test al, al
je 0x6356d8
cmp al, 0xff
je 0x6356d8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x6356e3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x6356ed
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x635715
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x635710
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x6359b0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x6359c2
jmp dword [eax*4 + 0x635bb8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x635a9f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x635ba0
cmp esi, 0xffffffff
jne 0x635ab6
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x635ac6
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x635aeb
mov al, byte [ecx - 1]
test al, al
je 0x635aeb
cmp al, 0xff
je 0x635aeb
test esi, esi
jne 0x635b0f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x635b39
test esi, esi
jne 0x635afa
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x635b39
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x635b06
cmp eax, esi
jae 0x635b17
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x635b68
mov al, byte [eax - 1]
test al, al
je 0x635b58
cmp al, 0xff
je 0x635b58
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x635b63
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x635b6d
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x635b95
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x635b90
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x635e30
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x635e42
jmp dword [eax*4 + 0x636038]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x635f1f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x636020
cmp esi, 0xffffffff
jne 0x635f36
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x635f46
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x635f6b
mov al, byte [ecx - 1]
test al, al
je 0x635f6b
cmp al, 0xff
je 0x635f6b
test esi, esi
jne 0x635f8f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x635fb9
test esi, esi
jne 0x635f7a
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x635fb9
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x635f86
cmp eax, esi
jae 0x635f97
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x635fe8
mov al, byte [eax - 1]
test al, al
je 0x635fd8
cmp al, 0xff
je 0x635fd8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x635fe3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x635fed
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x636015
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x636010
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x6362b0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x6362c2
jmp dword [eax*4 + 0x6364b8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x63639f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x6364a0
cmp esi, 0xffffffff
jne 0x6363b6
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x6363c6
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x6363eb
mov al, byte [ecx - 1]
test al, al
je 0x6363eb
cmp al, 0xff
je 0x6363eb
test esi, esi
jne 0x63640f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x636439
test esi, esi
jne 0x6363fa
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x636439
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x636406
cmp eax, esi
jae 0x636417
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x636468
mov al, byte [eax - 1]
test al, al
je 0x636458
cmp al, 0xff
je 0x636458
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x636463
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x63646d
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x636495
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x636490
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x636730
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x636742
jmp dword [eax*4 + 0x636938]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x63681f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x636920
cmp esi, 0xffffffff
jne 0x636836
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x636846
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x63686b
mov al, byte [ecx - 1]
test al, al
je 0x63686b
cmp al, 0xff
je 0x63686b
test esi, esi
jne 0x63688f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x6368b9
test esi, esi
jne 0x63687a
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x6368b9
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x636886
cmp eax, esi
jae 0x636897
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x6368e8
mov al, byte [eax - 1]
test al, al
je 0x6368d8
cmp al, 0xff
je 0x6368d8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x6368e3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x6368ed
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x636915
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x636910
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x636bb0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x636bc2
jmp dword [eax*4 + 0x636db8]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x636c9f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x636da0
cmp esi, 0xffffffff
jne 0x636cb6
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x636cc6
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x636ceb
mov al, byte [ecx - 1]
test al, al
je 0x636ceb
cmp al, 0xff
je 0x636ceb
test esi, esi
jne 0x636d0f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x636d39
test esi, esi
jne 0x636cfa
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x636d39
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x636d06
cmp eax, esi
jae 0x636d17
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x636d68
mov al, byte [eax - 1]
test al, al
je 0x636d58
cmp al, 0xff
je 0x636d58
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x636d63
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x636d6d
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x636d95
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x636d90
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x637030
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x637042
jmp dword [eax*4 + 0x637238]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x6dfe28
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00403350
test al, al
je 0x63711f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x6dfe28
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x637220
cmp esi, 0xffffffff
jne 0x637136
call fcn.006713ab
mov ecx, ebx
call fcn.00403470
cmp eax, esi
jae 0x637146
call fcn.006713ab
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x63716b
mov al, byte [ecx - 1]
test al, al
je 0x63716b
cmp al, 0xff
je 0x63716b
test esi, esi
jne 0x63718f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.004031c0
jmp 0x6371b9
test esi, esi
jne 0x63717a
push 1
mov ecx, ebx
call fcn.004031c0
jmp 0x6371b9
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x637186
cmp eax, esi
jae 0x637197
push 1
mov ecx, ebx
call fcn.004031c0
push esi
mov ecx, ebx
call fcn.00403480
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x6371e8
mov al, byte [eax - 1]
test al, al
je 0x6371d8
cmp al, 0xff
je 0x6371d8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00403350
mov eax, dword [ebx + 4]
test eax, eax
je 0x6371e3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x6371ed
mov ebx, 0x6a3560
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x637215
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x637210
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc