joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496ff4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov eax, dword [edi]
call fcn.00497ccc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push ebp
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00496f14
pop ecx
call fcn.004ad868
test al, al
je 0x49709c
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x60], 0
je 0x49709c
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.00443270
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.00443270
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x61], 0
je 0x497085
mov eax, dword [edi]
call fcn.00443270
xor edx, edx
call fcn.004ad8a4
jmp 0x49709c
mov eax, dword [edi]
call fcn.00443270
mov edx, dword [edi]
mov edx, dword [edx + 0x220]
mov dl, byte [edx + 0x62]
call fcn.004ad8a4
push 0x51
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [edi]
call fcn.00443270
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [edi]
call fcn.0043c9a8
mov eax, dword [edi]
mov ebx, dword [eax + 0x220]
cmp byte [ebx + 0x61], 0
je 0x497135
cmp byte [ebx + 0x60], 0
je 0x497135
call fcn.004ad868
test al, al
je 0x497135
mov eax, dword [0x4ef948]
mov eax, dword [eax]
call fcn.0045c390
xor ebx, ebx
xor esi, esi
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 5
jbe 0x497125
call sub.kernel32.dll_GetTickCount
mov esi, eax
add ebx, 0xa
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jle 0x497117
mov ebx, eax
mov eax, dword [edi]
call fcn.00443270
mov edx, ebx
call fcn.004ad8a4
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jl 0x4970ef
mov eax, dword [edi]
call fcn.00498200
mov eax, dword [edi]
call fcn.00443270
push eax
call sub.user32.dll_SetCapture
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c7b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor ebx, ebx
call fcn.004ad868
test al, al
je 0x49c8bf
mov eax, dword [esi + 4]
mov edx, dword [0x49a94c]
call fcn.0040349c
test al, al
je 0x49c8bf
mov ebx, dword [esi + 4]
cmp byte [ebx + 0x2f9], 0
je 0x49c828
cmp byte [esi + 0x540], 0
jne 0x49c828
push 0xffffffffffffffec
mov eax, esi
call fcn.00443270
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00443270
push eax
call sub.user32.dll_SetWindowLongA
jmp 0x49c85e
cmp byte [ebx + 0x2f9], 0
jne 0x49c85e
cmp byte [esi + 0x540], 0
je 0x49c85e
push 0xffffffffffffffec
mov eax, esi
call fcn.00443270
push eax
call sub.user32.dll_GetWindowLongA
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00443270
push eax
call sub.user32.dll_SetWindowLongA
mov al, byte [ebx + 0x2f9]
mov byte [esi + 0x540], al
mov al, byte [esi + 0x541]
cmp al, byte [ebx + 0x2fb]
je 0x49c8bf
cmp byte [ebx + 0x2f9], 0
je 0x49c8bf
cmp byte [ebx + 0x2fa], 0
je 0x49c8a1
mov eax, esi
call fcn.00443270
xor edx, edx
call fcn.004ad8a4
mov byte [esi + 0x541], 0
jmp 0x49c8bf
mov eax, esi
call fcn.00443270
mov dl, byte [ebx + 0x2fb]
call fcn.004ad8a4
mov al, byte [ebx + 0x2fb]
mov byte [esi + 0x541], al
push 0x51
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov eax, esi
call fcn.00443270
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, esi
call fcn.0043c9a8
call fcn.004ad868
test al, al
je 0x49c97f
test ebx, ebx
je 0x49c97f
cmp byte [ebx + 0x2fa], 0
je 0x49c97f
cmp byte [ebx + 0x2f9], 0
je 0x49c97f
mov eax, dword [0x4ef948]
mov eax, dword [eax]
call fcn.0045c390
xor edi, edi
xor ebp, ebp
Function at 0x4a5af0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a5c40
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x4a5c18
cmp dword [eax + 0x3f8], 0
je 0x4a5c18
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x2f0]
cmp eax, 0xc8
jbe 0x4a5c18
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x2f0], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0043ca88
mov eax, dword [ebp - 0xc]
call fcn.004043c4
dec eax
jne 0x4a5b98
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0043ca88
mov eax, dword [ebp - 0x10]
call fcn.004045c4
push eax
mov eax, ebx
call fcn.004a6740
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00443270
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x4a5bcb
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0043ca88
mov eax, dword [ebp - 0x14]
call fcn.004045c4
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00443270
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x4a5c18
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0043ca88
mov edx, esi
mov eax, ebx
call fcn.004a674c
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0043ca88
mov eax, dword [ebp - 4]
call fcn.004043c4
mov edx, eax
mov eax, ebx
call fcn.004a5dd0
mov eax, dword [ebp - 8]
call fcn.004043c4
push eax
mov eax, dword [ebp - 4]
call fcn.004043c4
pop edx
sub edx, eax
mov eax, ebx
call fcn.004a5dec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5c47
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404128
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404128
ret
Function at 0x4a5c50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004045b4
xor eax, eax
push ebp
push 0x4a5d6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x4a5d57
cmp dword [eax + 0x3f8], 0
je 0x4a5d57
cmp byte [ebx + 0x2f8], 0
je 0x4a5cd8
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x2f0]
cmp eax, 0x1f4
jb 0x4a5cb1
lea eax, [ebx + 0x2f4]
call fcn.00404104
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x2f0], eax
lea eax, [ebx + 0x2f4]
mov edx, dword [ebp - 4]
call fcn.004043cc
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x2f4]
call fcn.0040419c
mov eax, dword [ebp - 4]
call fcn.004043c4
test eax, eax
jle 0x4a5d47
mov eax, dword [ebp - 4]
call fcn.004043c4
dec eax
jne 0x4a5d1e
mov eax, dword [ebp - 4]
call fcn.004045c4
push eax
mov eax, ebx
call fcn.004a6740
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00443270
push eax
call sub.user32.dll_SendMessageA
jmp 0x4a5d4a
mov eax, dword [ebp - 4]
call fcn.004045c4
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00443270
push eax
call sub.user32.dll_SendMessageA
jmp 0x4a5d4a
or eax, 0xffffffff
test eax, eax
jl 0x4a5d57
mov edx, eax
mov eax, ebx
call fcn.004a674c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5d74
lea eax, [ebp - 4]
call fcn.00404104
ret
Function at 0x4b9f4c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x4b9f61
add esp, 0xfffffff0
call fcn.00403634
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004045b4
xor eax, eax
push ebp
push 0x4ba03c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004b5128
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.004163a4
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.004163a4
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.004163a4
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.004163a4
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004163cc
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x52], 0
mov byte [esi + 0x53], 0
mov byte [esi + 0x54], 0
mov byte [esi + 0x55], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x51], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba043
lea eax, [ebp - 4]
call fcn.00404104
ret
Function at 0x4bfe98
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c000f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4c0028
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.00404158
push 0xffffffffffffffff
mov ecx, 0x4c0038
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x4c0054
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x34], eax
mov ecx, 0x4c0074
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004addfc
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4c0090
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004adce8
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4c00a4
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004adce8
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4c00bc
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004adce8
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x4c00d8
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004addfc
mov byte [ebx + 0x48], al
mov ecx, 0x4c00ec
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004b4c74
mov byte [ebx + 0x49], al
push 0xffffffffffffffff
mov ecx, 0x4c0100
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x4c], eax
push 0xffffffffffffffff
mov ecx, 0x4c0120
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x50], eax
push 0
mov ecx, 0x4c0144
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x54], eax
push 0
mov ecx, 0x4c0160
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x58], eax
push 0xff
mov ecx, 0x4c017c
mov edx, dword [ebx + 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 8]
mov dword [ebx + 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0016
lea eax, [ebp - 4]
call fcn.00404104
ret
Function at 0x4e438c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4e43f5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4eee98]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4e43df
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004e437c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4e3e24]
call fcn.004e441c
mov dword [0x4eeefc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e43fc
lea eax, [ebp - 8]
call fcn.00405bc8
ret

Function at 0x4eadd4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4eaec3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, edi
call fcn.00404104
xor edx, edx
push ebp
push 0x4eaea3
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4eae3d
call fcn.00403b48
jmp 0x4eaeaa
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4eae8a
test ebx, ebx
jne 0x4eae5b
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, edi
call fcn.00408f70
jmp 0x4eae89
push dword [edi]
push 0x4eaedc
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x1d4]
call fcn.00408f70
push dword [ebp - 0x1d4]
mov eax, edi
mov edx, 3
call fcn.00404484
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x4eae44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eaeaa
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eaeca
lea eax, [ebp - 0x1d4]
call fcn.00404104
ret
Function at 0x4eaee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004045b4
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4eb052
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 2
call fcn.004e6008
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004e6028
jmp 0x4eb01e
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404374
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408c54
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408238
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408238
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404510
je 0x4eaffa
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404374
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408238
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408238
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404510
jne 0x4eb015
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
mov edx, edi
mov eax, esi
call fcn.004e6048
test eax, eax
jne 0x4eaf5b
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb059
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404128
lea eax, [ebp - 4]
call fcn.00404104
ret
Function at 0x10001a10
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCR80.dll_fread]
push esi
push edi
mov ebx, eax
xor eax, eax
push ebx
push 1
mov word [esp + 0x19], ax
mov byte [esp + 0x1b], al
lea eax, [esp + 0x18]
push 4
push eax
mov byte [esp + 0x20], 0
call ebp
movzx edx, byte [esp + 0x21]
movzx eax, byte [esp + 0x22]
xor ecx, ecx
mov ch, byte [esp + 0x20]
or ecx, edx
movzx edx, byte [esp + 0x23]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, edx
mov edi, ecx
push edi
call fcn.1002fcf0
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x10001a7c
push eax
call fcn.1002fd10
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push ebx
push 1
push edi
push esi
call ebp
push 8
call fcn.1002fcf0
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x10001aa4
push esi
call fcn.1002fd10
add esp, 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10001ab0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1fc
mov eax, dword [0x1005b460]
xor eax, esp
mov dword [esp + 0x1f8], eax
push ebx
push ebp
mov ebx, ecx
push ebx
push 1
lea eax, [edi + 1]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x18], ebx
xor ebp, ebp
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
xor eax, eax
test edi, edi
jle 0x10001b0e
lea ebx, [esp + 0xc]
sub ebx, esi
nop
lea ecx, [esi + eax]
mov dl, byte [ebx + ecx]
test dl, dl
mov ebp, eax
je 0x10001b0a
mov byte [esi + eax + 1], 0
add eax, 1
cmp eax, edi
mov byte [ecx], dl
jl 0x10001af0
mov ebx, dword [esp + 8]
push 0
add ebp, 1
push ebp
push ebx
call dword [sym.imp.MSVCR80.dll_fseek]
mov ecx, dword [esp + 0x20c]
add esp, 0xc
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1003ed2b
add esp, 0x1fc
ret
Function at 0x10001b40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
push 0x1f4
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x20], 1
call fcn.1002fcf0
mov ebx, eax
add esp, 4
cmp ebx, edi
jne 0x10001b79
mov esi, 0x2715
jmp 0x10001d1c
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
push 0x74
push edi
push ecx
call fcn.10029bd0
mov esi, eax
add esp, 0x10
cmp esi, edi
jne 0x10001d13
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push 0x74
push 1
push eax
call fcn.10029b80
mov esi, eax
add esp, 0x1c
cmp esi, edi
jne 0x10001d13
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push ecx
push 4
push 0x71
push 6
push edx
call fcn.10006110
mov esi, eax
add esp, 0x14
cmp esi, edi
jne 0x10001d13
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call fcn.10006430
mov esi, eax
add esp, 8
cmp esi, edi
jne 0x10001d13
mov edx, dword [esp + 0x38]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10001c10
sub eax, esi
push eax
push edx
mov edx, dword [esp + 0x14]
push edx
call fcn.10006460
mov esi, eax
add esp, 0xc
cmp esi, edi
jne 0x10001d13
mov esi, dword [sym.imp.MSVCR80.dll_fseek]
push ebp
mov ebp, dword [esp + 0x44]
push 2
push edi
push ebp
call esi
push ebp
call dword [sym.imp.MSVCR80.dll_ftell]
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, edi
imul eax, eax, 0x1f4
push 0
sub ecx, eax
push 0
push ebp
mov dword [esp + 0x40], ecx
call esi
add esp, 0x1c
test edi, edi
mov dword [esp + 0x1c], 0
jle 0x10001cba
push ebp
push 1
push 0x1f4
push ebx
call dword [sym.imp.MSVCR80.dll_fread]
mov ecx, dword [esp + 0x20]
push 0x1f4
push ebx
push ecx
call fcn.10006460
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x10001d10
mov eax, dword [esp + 0x1c]
add eax, 1
cmp eax, edi
mov dword [esp + 0x1c], eax
jl 0x10001c83
mov esi, dword [esp + 0x24]
test esi, esi
je 0x10001ce2
push ebp
push 1
push esi
push ebx
call dword [sym.imp.MSVCR80.dll_fread]
mov edx, dword [esp + 0x20]
push esi
push ebx
push edx
call fcn.10006460
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x10001d10
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call fcn.10006490
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x10001d10
cmp dword [esp + 0x20], eax
je 0x10001d10
mov esi, 0x2711
xor edi, edi
pop ebp
push ebx
call fcn.1002fd10
add esp, 4
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x10001d31
push eax
call fcn.10006140
add esp, 4
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x10001d46
push eax
call fcn.10029ab0
add esp, 4
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x10001d57
push eax
call fcn.10029bb0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x10002370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov eax, dword [0x1005b460]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x78]
push ebx
push ebp
mov ebp, dword [esp + 0x70]
push esi
push edi
mov edi, dword [esp + 0x74]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x80]
push 4
push eax
xor ebx, ebx
push 7
push edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.10006110
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x100024b1
mov ecx, dword [0x1004c638]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], ecx
mov ecx, dword [edi + 4]
push 1
push ecx
mov dword [esp + 0x2c], 0x1004c440
call fcn.100268e0
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x100024b1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [edx + 0xc], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [ecx + 8], edx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call fcn.10006640
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x100024b1
push 0x40
lea edx, [esp + 0x30]
push edx
push ebp
call fcn.1000eb90
add esp, 0xc
cmp eax, ebx
jle 0x1000247d
lea ebx, [ebx]
mov ecx, dword [esp + 0x14]
push eax
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.10006680
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x100024b1
push 0x40
lea edx, [esp + 0x30]
push edx
push ebp
call fcn.1000eb90
add esp, 0xc
cmp eax, ebx
jg 0x10002450
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call fcn.100066c0
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x100024b1
mov edx, dword [esp + 0x28]
xor ecx, ecx
cmp dword [esp + 0x20], ebx
sete cl
mov dword [edx], ecx
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x100024c2
push eax
call fcn.10006140
add esp, 4
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x100024d3
push eax
call fcn.10026980
add esp, 4
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003ed2b
add esp, 0x60
ret