joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ea200
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x1c], 0x135
push ebx
push ebp
push esi
push edi
jne 0x4ea225
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
mov dword [esp + 0xc], 0x135
jmp 0x4eb750
mov ebx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, ebx
mov edi, ecx
call fcn.004f0730
xor edx, edx
cmp eax, edx
jne 0x4ea3f0
mov ebp, dword [ebx + 4]
xor edi, edi
cmp ebp, 0xfffffff
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edx
ja 0x4ea2f7
cmp ebp, edx
je 0x4ea2f7
lea esi, [edx + 1]
cmp ebp, esi
jb 0x4ea276
lea ebx, [ebx]
add esi, esi
cmp esi, ebp
jbe 0x4ea270
fldz
fstp dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
shr ecx, 0x17
and ecx, 0xff
sub ecx, 0x7f
js 0x4ea297
mov eax, 1
shl eax, cl
jmp 0x4ea299
xor eax, eax
cmp eax, esi
je 0x4ea2e2
xor eax, eax
test esi, esi
je 0x4ea2d6
xor ecx, ecx
mov eax, esi
mov edx, 8
mul edx
seto cl
neg ecx
or eax, ecx
call fcn.00457920
mov edi, eax
test edi, edi
je 0x4ea2f7
push 8
mov ebx, 0x4e73e0
mov eax, esi
mov ecx, edi
call fcn.00401380
mov ebx, dword [esp + 0x28]
mov eax, edi
test eax, eax
mov dword [esp + 0x18], eax
mov edx, eax
je 0x4ea2f7
mov edi, eax
add ebp, ebp
test edx, edx
mov dword [esp + 0x1c], ebp
jne 0x4ea306
test edi, edi
je 0x4ea2f7
mov eax, edi
call fcn.00457930
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
xor esi, esi
cmp dword [ebx + 4], esi
jbe 0x4ea398
mov ebx, edi
mov eax, dword [esp + 0x24]
mov edi, dword [eax + 0x10]
cmp dword [edi + 0x14], 0
je 0x4ea34d
mov eax, 8
call fcn.00410220
cmp eax, 8
je 0x4ea37e
mov edi, 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4ea341
call fcn.00457930
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x4ea36a
push eax
push 1
push 8
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ea36a
xor edi, edi
jmp 0x4ea37a
cmp dword [edi + 4], 0
je 0x4ea377
mov edi, 2
jmp 0x4ea37a
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ea334
mov edx, ebx
call fcn.004dc440
mov ecx, dword [esp + 0x28]
add esi, 1
add ebx, 8
cmp esi, dword [ecx + 4]
jb 0x4ea313
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 0x14]
mov esi, dword [eax]
mov edi, dword [esp + 0x2c]
call fcn.004dabf0
test al, al
jne 0x4ea3e1
test ebp, 0xfffffffe
je 0x4ea3e1
lea eax, [esp + 0x18]
push eax
push edi
push esi
call fcn.004eed10
mov esi, eax
test esi, esi
je 0x4ea3e1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4ea3d5
call fcn.00457930
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4ea3ee
call fcn.00457930
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x4eba70
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov eax, ebp
mov esi, edi
call fcn.004efb00
test eax, eax
jne 0x4ebba1
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4ebafc
mov edx, dword [edi]
mov dword [esp + 0x18], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x18]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
add eax, 8
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4ebb96
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4ebb08
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [ebp]
mov eax, dword [esp + 0x14]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov edi, dword [eax + 0x10]
mov ebp, dword [ebp + 4]
add ebx, 8
cmp dword [edi + 0x14], 0
je 0x4ebb48
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4ebb78
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x4ebb64
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ebb64
xor edi, edi
jmp 0x4ebb74
cmp dword [edi + 4], 0
je 0x4ebb71
mov edi, 2
jmp 0x4ebb74
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ebb96
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [eax]
push edx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], esi
call fcn.004f07b0
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x4ebe40
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov eax, ebp
call fcn.004ef410
test eax, eax
jne 0x4ebf6f
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4ebeca
mov edx, dword [edi]
mov dword [esp + 0x18], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x18]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
add eax, 8
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4ebf64
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4ebed6
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [ebp]
mov eax, dword [esp + 0x14]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov edi, dword [eax + 0x10]
mov ebp, dword [ebp + 4]
add ebx, 8
cmp dword [edi + 0x14], 0
je 0x4ebf16
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4ebf46
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [edi + 4]
test eax, eax
je 0x4ebf32
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ebf32
xor edi, edi
jmp 0x4ebf42
cmp dword [edi + 4], 0
je 0x4ebf3f
mov edi, 2
jmp 0x4ebf42
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ebf64
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [eax]
push edx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], esi
call fcn.004f07b0
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x4eefa0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
call fcn.004ef410
test eax, eax
jne 0x4ef0d9
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4ef02d
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
add eax, 8
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4ef0ce
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4ef03a
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov edi, dword [eax + 0x10]
mov ebp, dword [ebp + 4]
add ebx, 8
cmp dword [edi + 0x14], 0
je 0x4ef07b
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4ef0ab
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4ef097
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ef097
xor edi, edi
jmp 0x4ef0a7
cmp dword [edi + 4], 0
je 0x4ef0a4
mov edi, 2
jmp 0x4ef0a7
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ef0ce
mov edx, dword [esi + 0xc]
call fcn.004dc4b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
push esi
push edx
mov edx, dword [esp + 0x2c]
push ecx
call fcn.004f0950
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4ef170
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
call fcn.004f0410
test eax, eax
jne 0x4ef2b1
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4ef201
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax*4 + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4ef2a6
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4ef20e
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebp, ebp
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4ef253
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4ef283
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4ef26f
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ef26f
xor edi, edi
jmp 0x4ef27f
cmp dword [edi + 4], 0
je 0x4ef27c
mov edi, 2
jmp 0x4ef27f
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ef2a6
mov edx, dword [esi + 0xc]
call fcn.004dc4b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
push esi
push edx
mov edx, dword [esp + 0x2c]
push ecx
call fcn.004f0950
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4ef2c0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
call fcn.004f0730
test eax, eax
jne 0x4ef403
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4ef351
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax*8 + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4ef3f8
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4ef35e
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebp, ebp
add ebp, ebp
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4ef3a5
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4ef3d5
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4ef3c1
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ef3c1
xor edi, edi
jmp 0x4ef3d1
cmp dword [edi + 4], 0
je 0x4ef3ce
mov edi, 2
jmp 0x4ef3d1
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ef3f8
mov edx, dword [esi + 0xc]
call fcn.004dc4b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
push esi
push edx
mov edx, dword [esp + 0x2c]
push ecx
call fcn.004f0950
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4ef490
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
call fcn.004ef0f0
test eax, eax
jne 0x4ef5cc
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4ef51e
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax + eax + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4ef5c1
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4ef52b
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4ef56e
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4ef59e
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4ef58a
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ef58a
xor edi, edi
jmp 0x4ef59a
cmp dword [edi + 4], 0
je 0x4ef597
mov edi, 2
jmp 0x4ef59a
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ef5c1
mov edx, dword [esi + 0xc]
call fcn.004dc4b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
push esi
push edx
mov edx, dword [esp + 0x2c]
push ecx
call fcn.004f0950
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4ef5e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
mov esi, edi
call fcn.004efb70
test eax, eax
jne 0x4ef716
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4ef670
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax + eax + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4ef70b
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4ef67d
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4ef6c0
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4ef6f0
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4ef6dc
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ef6dc
xor edi, edi
jmp 0x4ef6ec
cmp dword [edi + 4], 0
je 0x4ef6e9
mov edi, 2
jmp 0x4ef6ec
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ef70b
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
push esi
push edx
mov edx, dword [esp + 0x2c]
push ecx
call fcn.004f0950
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4ef720
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
mov esi, edi
call fcn.004f0100
test eax, eax
jne 0x4ef85b
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4ef7b3
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax*4 + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4ef850
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4ef7c0
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebp, ebp
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4ef805
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4ef835
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4ef821
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ef821
xor edi, edi
jmp 0x4ef831
cmp dword [edi + 4], 0
je 0x4ef82e
mov edi, 2
jmp 0x4ef831
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ef850
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
push esi
push edx
mov edx, dword [esp + 0x2c]
push ecx
call fcn.004f0950
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4ef870
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
mov esi, edi
call fcn.004eb8c0
test eax, eax
jne 0x4ef9ad
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4ef903
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax*8 + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4ef9a2
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4ef910
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebp, ebp
add ebp, ebp
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4ef957
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4ef987
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4ef973
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4ef973
xor edi, edi
jmp 0x4ef983
cmp dword [edi + 4], 0
je 0x4ef980
mov edi, 2
jmp 0x4ef983
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4ef9a2
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
push esi
push edx
mov edx, dword [esp + 0x2c]
push ecx
call fcn.004f0950
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4ef9c0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
mov esi, edi
call fcn.004efb00
test eax, eax
jne 0x4efaf3
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4efa4f
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
add eax, 8
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4efae8
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4efa5c
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov edi, dword [eax + 0x10]
mov ebp, dword [ebp + 4]
add ebx, 8
cmp dword [edi + 0x14], 0
je 0x4efa9d
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4efacd
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4efab9
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4efab9
xor edi, edi
jmp 0x4efac9
cmp dword [edi + 4], 0
je 0x4efac6
mov edi, 2
jmp 0x4efac9
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4efae8
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
push esi
push edx
mov edx, dword [esp + 0x2c]
push ecx
call fcn.004f0950
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10