joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425370
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x47ddb0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x498e04]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x60]
xor ebx, ebx
cmp esi, ebx
jne 0x4253ce
push str.NMisc::LoadLibraryA_____DLL
push 3
call fcn.00414a20
add esp, 8
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
push 0x48350c
lea ecx, [esp + 0x18]
call fcn.0042bd90
mov dword [esp + 0x58], ebx
call fcn.0041ae90
test al, al
je 0x4254c7
call fcn.0041b210
test eax, eax
je 0x4254c7
call fcn.0041af60
test eax, eax
je 0x425419
call fcn.0041af00
test eax, eax
jne 0x425419
call fcn.0041b210
test eax, eax
jne 0x4254c7
lea ecx, [esp + 0x38]
call fcn.00418580
push esi
lea ecx, [esp + 0x3c]
mov byte [esp + 0x5c], 3
mov dword [esp + 0x38], ebx
call fcn.00418b10
push ebx
push ebx
lea eax, [esp + 0x3c]
push eax
push 0x425220
push ebx
push ebx
call fcn.0044bda1
mov esi, eax
or edi, 0xffffffff
add esp, 0x18
cmp esi, edi
jne 0x425484
lea ecx, [esp + 0x38]
mov byte [esp + 0x58], bl
call fcn.004186d0
lea ecx, [esp + 0x14]
mov dword [esp + 0x58], edi
call fcn.0042bef0
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x38]
mov byte [esp + 0x58], bl
call fcn.004186d0
lea ecx, [esp + 0x14]
mov dword [esp + 0x58], edi
call fcn.0042bef0
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebp, ebx
mov edi, eax
jne 0x42554d
push str.NMisc::LoadLibraryA______DLL
push 3
call fcn.00414a20
push 0x1000
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.00424770
add esp, 0x14
mov ecx, eax
mov byte [esp + 0x58], 1
call fcn.0042c070
push eax
lea ecx, [esp + 0x18]
call fcn.0042c3f0
lea ecx, [esp + 0x24]
mov byte [esp + 0x58], bl
call fcn.0042bef0
lea ecx, [esp + 0x14]
call fcn.0042c070
push eax
push str.NMisc::LoadLibraryA_____DLL_Path:__s_r_n
push 3
call fcn.00414a20
push edi
push str.NMisc::LoadLibraryA____
push 3
call fcn.00414a20
add esp, 0x18
jmp 0x42559c
push 0x1000
lea edx, [esp + 0x28]
push esi
push edx
call fcn.00424770
add esp, 0xc
mov ecx, eax
mov byte [esp + 0x58], 2
call fcn.0042c070
push eax
lea ecx, [esp + 0x18]
call fcn.0042c3f0
lea ecx, [esp + 0x24]
mov byte [esp + 0x58], bl
call fcn.0042bef0
lea ecx, [esp + 0x14]
call fcn.0042c8c0
push eax
push 0x485fc8
push 3
call fcn.00414a20
add esp, 0xc
lea ecx, [esp + 0x14]
mov dword [esp + 0x58], 0xffffffff
call fcn.0042bef0
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
Function at 0x425ec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47df11
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x498e04]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0xc], 0
call fcn.0041e6d0
add esp, 4
push 0x1000
mov ecx, eax
mov dword [esp + 0x30], 1
call fcn.00418800
mov esi, dword [esp + 0x38]
push eax
push esi
call fcn.00424770
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x2c], 0
call fcn.004186d0
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret

Function at 0x426520
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x47e022
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x498e04]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push esi
push edi
mov eax, dword [0x498e04]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov esi, dword [esp + 0x130]
mov edi, dword [esp + 0x138]
xor ebx, ebx
push 0x48e349
mov ecx, esi
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
call fcn.004185b0
push 0x103
lea eax, [esp + 0x1d]
push ebx
push eax
mov dword [esp + 0x134], ebx
mov dword [esp + 0x1c], 1
mov byte [esp + 0x24], bl
call fcn.00449d00
add esp, 0xc
cmp dword [esp + 0x134], ebx
je 0x4265db
call fcn.0041b210
test eax, eax
je 0x4265db
push edi
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.00426460
add esp, 0xc
test eax, eax
je 0x4265fb
lea edx, [esp + 0x18]
push edx
jmp 0x4265f4
push 0x104
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4265fb
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00418b10
mov eax, esi
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.00449ce2
add esp, 0x11c
ret
Function at 0x42a0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x47e7ab
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x498e04]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x498e04]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
push str.kernel32.dll
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x429ce7
xor eax, eax
jmp 0x429e01
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push esi
call edi
mov ebp, eax
test ebp, ebp
je 0x429ce0
push str.Process32First
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x429ce0
push str.Process32Next
push esi
call edi
mov edi, eax
test edi, edi
je 0x429ce0
push 0
push 2
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x429ce0
lea eax, [esp + 0x30]
push eax
push esi
mov dword [esp + 0x38], 0x128
call ebx
test eax, eax
je 0x429df5
mov ebx, dword [esp + 0x14]
lea ebp, [ebx + 0x14]
mov ecx, ebx
call fcn.004293f0
test eax, eax
je 0x429daf
mov ecx, dword [esp + 0x38]
push 0
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, ebx
call fcn.00429410
lea ecx, [esp + 0x18]
mov dword [esp + 0x184], 0
call fcn.00418710
test eax, eax
jg 0x429d87
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
call fcn.00418b10
lea ecx, [esp + 0x18]
call fcn.00418810
push eax
lea ecx, [ebx + 4]
call fcn.00419770
lea ecx, [esp + 0x18]
mov dword [esp + 0x184], 0xffffffff
call fcn.004186d0
jmp 0x429dbc
lea ecx, [esp + 0x54]
push ecx
lea ecx, [ebx + 4]
call fcn.00419770
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0x15c]
push 0x486788
push eax
call fcn.00411810
add esp, 0xc
lea ecx, [esp + 0x158]
push ecx
mov ecx, ebp
call fcn.00419770
lea edx, [esp + 0x30]
push edx
push esi
call edi
test eax, eax
jne 0x429d43
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.00449ce2
add esp, 0x174
ret
push esi
mov esi, ecx
call fcn.00428cb0
mov ecx, esi
call fcn.004293e0
test eax, eax
mov ecx, esi
pop esi
je 0x42a0fb
jmp fcn.00429890
jmp 0x429c90
Function at 0x42a8f0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x80
mov eax, dword [0x498e04]
xor eax, esp
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x84]
push ebx
push esi
push edi
mov edi, dword [esp + 0x94]
xor ebx, ebx
push 0x63
lea ecx, [esp + 0x29]
push ebx
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x30], bl
call fcn.00449d00
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
call fcn.0041b260
add esp, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x42a979
push 0x63
push 0x48e349
lea ecx, [esp + 0x2c]
push 0x64
push ecx
call fcn.0044ac36
add esp, 0x10
mov byte [esp + 0x24], bl
mov byte [esp + 0x87], bl
jmp 0x42aa2c
lea edx, [esi + 0xfde8]
push ebp
push edx
call fcn.0044c06b
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x42a9b2
push 0x63
push 0x48e349
lea eax, [esp + 0x30]
push 0x64
push eax
call fcn.0044ac36
add esp, 0x10
mov byte [esp + 0x28], bl
mov byte [esp + 0x8b], bl
jmp 0x42aa1e
push ebp
push esi
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x42a9d7
push 0x48e349
mov esi, 0x64
lea edi, [esp + 0x2c]
call fcn.0042a890
add esp, 4
jmp 0x42aa1e
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x48e1f4
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x42a9bf
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
movzx edx, ax
push edx
shr eax, 0x10
push eax
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._d._d._d._d
lea ecx, [esp + 0x3c]
push 0x64
push ecx
call fcn.0044e727
add esp, 0x1c
cmp ebp, ebx
je 0x42aa2b
push ebp
call fcn.0044c12e
add esp, 4
pop ebp
cmp dword [esp + 0x10], ebx
je 0x42aa3f
mov edx, dword [esp + 0xc]
push edx
call fcn.0041b2b0
add esp, 4
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.00418640
mov ecx, dword [esp + 0x88]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00449ce2
add esp, 0x80
ret
Function at 0x42adf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x90
mov eax, dword [0x498e04]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebp
push esi
push edi
push 0x100
mov esi, ecx
mov dword [esp + 0x14], 0
call fcn.00448fa1
mov ebp, eax
mov eax, dword [esi + 0x18]
add esp, 4
cmp eax, 1
jne 0x42ae6a
lea eax, [esp + 0x14]
push eax
call fcn.0043c8f0
mov edx, dword [esi + 8]
mov eax, edx
add esp, 4
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42ae40
sub eax, edi
push eax
push edx
lea ecx, [esp + 0x1c]
push ecx
call fcn.0043cad0
lea edx, [esp + 0x20]
push ebp
push edx
call fcn.0043cb70
add esp, 0x14
jmp 0x42af1e
cmp eax, 2
jne 0x42af9f
mov eax, dword [esi + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42ae80
sub eax, edx
cmp eax, 1
jb 0x42afa8
lea eax, [esp + 0x14]
push eax
call fcn.0043c8f0
mov ecx, dword [esi + 8]
push 0x486954
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0044e27b
add esp, 0x10
test eax, eax
jne 0x42af9f
lea esp, [esp]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0xe8]
push eax
push 0x80000
push 1
push ecx
call fcn.00450343
mov edi, eax
add esp, 0x10
test edi, edi
je 0x42aef6
mov edx, dword [esi + 0xe8]
push edi
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0043cad0
add esp, 0xc
cmp edi, 0x80000
je 0x42aec0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0044dfdc
lea edx, [esp + 0x18]
push ebp
push edx
mov dword [esp + 0x1c], 0
call fcn.0043cb70
add esp, 0xc
xor edi, edi
add esi, 0x20
movzx ecx, byte [edi + ebp]
push 0x10
push 3
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0044e901
lea eax, [esp + 0x1c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42af40
sub eax, edx
cmp eax, 1
jne 0x42af61
mov dl, byte [esp + 0xc]
mov byte [esp + 0xd], dl
mov byte [esp + 0xc], 0x30
mov byte [esp + 0xe], cl
lea eax, [esp + 0xc]
push eax
push 0xc8
push esi
call fcn.0044b56d
add edi, 1
add esp, 0xc
cmp edi, 0x20
jl 0x42af23
push ebp
call fcn.0044a9ac
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.00449ce2
add esp, 0x90
ret
push ebp
call fcn.0044a9ac
add esp, 4
mov ecx, dword [esp + 0x98]
pop edi
lea eax, [esi + 0x20]
pop esi
pop ebp
xor ecx, esp
call fcn.00449ce2
add esp, 0x90
ret
Function at 0x42afd0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x47e8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x498e04]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x498e04]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
push 0x100
mov esi, ecx
mov dword [esp + 0x1c], ebx
call fcn.00448fa1
add esp, 4
lea ecx, [esp + 0x1c]
mov ebp, eax
call fcn.0043cea0
mov eax, dword [esi + 0x18]
cmp eax, 1
mov dword [esp + 0x80], ebx
jne 0x42b05d
lea ecx, [esp + 0x1c]
call fcn.0043ccb0
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b042
sub eax, edi
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.0043ccf0
jmp 0x42b0f6
cmp eax, 2
jne 0x42b17a
mov eax, dword [esi + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b070
sub eax, edx
cmp eax, 1
lea ecx, [esp + 0x1c]
jb 0x42b187
call fcn.0043ccb0
mov eax, dword [esi + 8]
push 0x486954
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0044e27b
add esp, 0xc
test eax, eax
jne 0x42b17a
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0xe8]
push edx
push 0x80000
push 1
push eax
call fcn.00450343
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x42b0dd
mov ecx, dword [esi + 0xe8]
push edi
push ecx
lea ecx, [esp + 0x24]
call fcn.0043ccf0
cmp edi, 0x80000
je 0x42b0ab
mov edx, dword [esp + 0x18]
push edx
call fcn.0044dfdc
add esp, 4
mov dword [esp + 0x18], ebx
push 0x10
push ebp
lea ecx, [esp + 0x24]
call fcn.0043ce20
xor edi, edi
add esi, 0x20
mov bl, 0x30
lea esp, [esp]
movzx eax, byte [edi + ebp]
push 0x10
push 3
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0044e901
lea eax, [esp + 0x24]
add esp, 0x10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b130
sub eax, edx
cmp eax, 1
jne 0x42b150
mov dl, byte [esp + 0x14]
mov byte [esp + 0x15], dl
mov byte [esp + 0x14], bl
mov byte [esp + 0x16], cl
lea eax, [esp + 0x14]
push eax
push 0xc8
push esi
call fcn.0044b56d
add edi, 1
add esp, 0xc
cmp edi, 0x10
jl 0x42b110
push ebp
call fcn.0044a9ac
add esp, 4
lea ecx, [esp + 0x1c]
jmp 0x42b18a
push ebp
call fcn.0044a9ac
lea ecx, [esp + 0x20]
add esp, 4
add esi, 0x20
mov dword [esp + 0x80], 0xffffffff
call fcn.0043cec0
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00449ce2
add esp, 0x70
ret
Function at 0x42b1c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x64
mov eax, dword [0x498e04]
xor eax, esp
mov dword [esp + 0x60], eax
push ebp
push esi
push edi
push 0x100
mov esi, ecx
mov dword [esp + 0x14], 0
call fcn.00448fa1
mov ebp, eax
mov eax, dword [esi + 0x18]
add esp, 4
cmp eax, 1
jne 0x42b231
lea eax, [esp + 0x14]
push eax
call fcn.0043cef0
mov edx, dword [esi + 8]
mov eax, edx
add esp, 4
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b207
sub eax, edi
push eax
push edx
lea ecx, [esp + 0x1c]
push ecx
call fcn.0043d430
lea edx, [esp + 0x20]
push edx
push ebp
call fcn.0043d4e0
add esp, 0x14
jmp 0x42b2de
cmp eax, 2
jne 0x42b359
mov eax, dword [esi + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b240
sub eax, edx
cmp eax, 1
jb 0x42b362
lea eax, [esp + 0x14]
push eax
call fcn.0043cef0
mov ecx, dword [esi + 8]
push 0x486954
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0044e27b
add esp, 0x10
test eax, eax
jne 0x42b359
lea esp, [esp]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0xe8]
push eax
push 0x80000
push 1
push ecx
call fcn.00450343
mov edi, eax
add esp, 0x10
test edi, edi
je 0x42b2b6
mov edx, dword [esi + 0xe8]
push edi
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0043d430
add esp, 0xc
cmp edi, 0x80000
je 0x42b280
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0044dfdc
lea edx, [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x1c], 0
call fcn.0043d4e0
add esp, 0xc
xor edi, edi
add esi, 0x20
movzx ecx, byte [edi + ebp]
push 0x10
push 3
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0044e901
lea eax, [esp + 0x1c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b300
sub eax, edx
cmp eax, 1
jne 0x42b321
mov dl, byte [esp + 0xc]
mov byte [esp + 0xd], dl
mov byte [esp + 0xc], 0x30
mov byte [esp + 0xe], cl
lea eax, [esp + 0xc]
push eax
push 0xc8
push esi
call fcn.0044b56d
add edi, 1
add esp, 0xc
cmp edi, 0x10
jl 0x42b2e3
push ebp
call fcn.0044a9ac
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00449ce2
add esp, 0x64
ret
push ebp
call fcn.0044a9ac
add esp, 4
mov ecx, dword [esp + 0x6c]
pop edi
lea eax, [esi + 0x20]
pop esi
pop ebp
xor ecx, esp
call fcn.00449ce2
add esp, 0x64
ret
Function at 0x42b560
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x64
push ebp
push esi
push edi
push 0x100
mov edi, ecx
mov dword [esp + 0x14], 0
call fcn.00448fa1
mov ebp, eax
mov eax, dword [edi + 0x18]
add esp, 4
cmp eax, 1
jne 0x42b5ca
lea eax, [esp + 0x14]
push eax
call fcn.0043e5c0
mov edx, dword [edi + 8]
mov eax, edx
add esp, 4
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b5a0
lea ecx, [esp + 0x14]
push ecx
sub eax, esi
push eax
push edx
call fcn.0043e600
lea edx, [esp + 0x20]
push edx
push ebp
call fcn.0043e680
add esp, 0x14
jmp 0x42b67e
cmp eax, 2
jne 0x42b6ee
mov eax, dword [edi + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b5e0
sub eax, edx
cmp eax, 1
jb 0x42b6f7
lea eax, [esp + 0x14]
push eax
call fcn.0043e5c0
mov ecx, dword [edi + 8]
push 0x486954
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0044e27b
add esp, 0x10
test eax, eax
jne 0x42b6ee
lea esp, [esp]
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0xe8]
push eax
push 0x80000
push 1
push ecx
call fcn.00450343
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b656
mov eax, dword [edi + 0xe8]
lea edx, [esp + 0x14]
push edx
push esi
push eax
call fcn.0043e600
add esp, 0xc
cmp esi, 0x80000
je 0x42b620
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0044dfdc
lea edx, [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x1c], 0
call fcn.0043e680
add esp, 0xc
xor esi, esi
add edi, 0x20
movzx ecx, byte [esi + ebp]
push 0x10
push 3
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0044e901
lea eax, [esp + 0x1c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b6a0
sub eax, edx
cmp eax, 1
jne 0x42b6c1
mov dl, byte [esp + 0xc]
mov byte [esp + 0xd], dl
mov byte [esp + 0xc], 0x30
mov byte [esp + 0xe], cl
lea eax, [esp + 0xc]
push eax
push 0xc8
push edi
call fcn.0044b56d
add esi, 1
add esp, 0xc
cmp esi, 0x14
jl 0x42b683
push ebp
call fcn.0044a9ac
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x64
ret
push ebp
call fcn.0044a9ac
add esp, 4
lea eax, [edi + 0x20]
pop edi
pop esi
pop ebp
add esp, 0x64
ret
Function at 0x42b710
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push 0x100
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.00448fa1
mov ebx, eax
mov eax, dword [edi + 0x1c]
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [edi + 0x18]
sar ebp, 3
add esp, 4
cmp eax, 1
mov dword [esp + 0x18], ebp
jne 0x42b78a
lea eax, [esp + 0x1c]
push eax
call fcn.0043e7d0
mov edx, dword [edi + 8]
mov eax, edx
add esp, 4
lea esi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b760
lea ecx, [esp + 0x1c]
push ecx
sub eax, esi
push eax
push edx
call fcn.0043f290
lea edx, [esp + 0x28]
push edx
push ebx
call fcn.0043f340
add esp, 0x14
jmp 0x42b83e
cmp eax, 2
jne 0x42b8a1
mov eax, dword [edi + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b7a0
sub eax, edx
cmp eax, 1
jb 0x42b8aa
lea eax, [esp + 0x1c]
push eax
call fcn.0043e7d0
mov ecx, dword [edi + 8]
push 0x486954
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.0044e27b
add esp, 0x10
test eax, eax
jne 0x42b8a1
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0xe8]
push eax
push 0x80000
push 1
push ecx
call fcn.00450343
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b816
mov eax, dword [edi + 0xe8]
lea edx, [esp + 0x1c]
push edx
push esi
push eax
call fcn.0043f290
add esp, 0xc
cmp esi, 0x80000
je 0x42b7e0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0044dfdc
lea edx, [esp + 0x20]
push edx
push ebx
mov dword [esp + 0x20], 0
call fcn.0043f340
add esp, 0xc
xor esi, esi
test ebp, ebp
jle 0x42b8a1
lea ebp, [edi + 0x20]
movzx ecx, byte [esi + ebx]
push 0x10
push 3
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.0044e901
lea eax, [esp + 0x20]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b864
sub eax, edx
cmp eax, 1
jne 0x42b885
mov dl, byte [esp + 0x10]
mov byte [esp + 0x11], dl
mov byte [esp + 0x10], 0x30
mov byte [esp + 0x12], cl
lea eax, [esp + 0x10]
push eax
push 0xc8
push ebp
call fcn.0044b56d
add esi, 1
add esp, 0xc
cmp esi, dword [esp + 0x18]
jl 0x42b847
push ebx
call fcn.0044a9ac
add esp, 4
lea eax, [edi + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x42b8c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xe4
push ebx
push ebp
push esi
push edi
push 0x100
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.00448fa1
mov ecx, dword [edi + 0x1c]
mov ebx, eax
mov eax, ecx
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [edi + 0x18]
sar ebp, 3
add esp, 4
cmp eax, 1
mov dword [esp + 0x18], ebp
jne 0x42b93f
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.00441f50
mov edx, dword [edi + 8]
mov eax, edx
add esp, 8
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42b915
lea ecx, [esp + 0x1c]
push ecx
sub eax, esi
push eax
push edx
call fcn.00442000
lea edx, [esp + 0x28]
push edx
push ebx
call fcn.00442040
add esp, 0x14
jmp 0x42b9ee
cmp eax, 2
jne 0x42ba51
mov eax, dword [edi + 8]
lea esi, [eax + 1]
mov edi, edi
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x42b950
sub eax, esi
cmp eax, 1
jb 0x42ba5a
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.00441f50
mov ecx, dword [edi + 8]
push 0x486954
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.0044e27b
add esp, 0x14
test eax, eax
jne 0x42ba51
lea ecx, [ecx]
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0xe8]
push eax
push 0x80000
push 1
push ecx
call fcn.00450343
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42b9c6
mov eax, dword [edi + 0xe8]
lea edx, [esp + 0x1c]
push edx
push esi
push eax
call fcn.00442000
add esp, 0xc
cmp esi, 0x80000
je 0x42b990
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0044dfdc
lea edx, [esp + 0x20]
push edx
push ebx
mov dword [esp + 0x20], 0
call fcn.00442040
add esp, 0xc
xor esi, esi
test ebp, ebp
jle 0x42ba51
lea ebp, [edi + 0x20]
movzx ecx, byte [esi + ebx]
push 0x10
push 3
lea eax, [esp + 0x18]
push eax
push ecx
call fcn.0044e901
lea eax, [esp + 0x20]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x42ba14
sub eax, edx
cmp eax, 1
jne 0x42ba35
mov dl, byte [esp + 0x10]
mov byte [esp + 0x11], dl
mov byte [esp + 0x10], 0x30
mov byte [esp + 0x12], cl
lea eax, [esp + 0x10]
push eax
push 0xc8
push ebp
call fcn.0044b56d
add esi, 1
add esp, 0xc
cmp esi, dword [esp + 0x18]
jl 0x42b9f7
push ebx
call fcn.0044a9ac
add esp, 4
lea eax, [edi + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe4
ret