joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f280
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov eax, 0x802c
push edi
push esi
push ebx
call fcn.004a7e80
sub esp, eax
mov ebp, dword [esp + 0x804c]
mov ebx, dword [esp + 0x8048]
test ebp, ebp
je 0x41f2c1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00492e10
mov dword [ebp], eax
test ebx, ebx
lea edi, [esp + 0x20]
jne 0x41f31b
jmp 0x41f394
test ebp, ebp
je 0x41f2ee
mov eax, dword [esp + 0x18]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp]
mov dword [esp], eax
call fcn.00492e10
mov dword [ebp], eax
mov eax, dword [esp + 0x8040]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], edi
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp esi, eax
jne 0x41f3a3
sub ebx, dword [esp + 0x18]
je 0x41f394
mov eax, dword [esp + 0x8044]
cmp ebx, 0x7fff
mov ecx, 0x8000
cmovle ecx, ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
call sub.msvcrt.dll_fread
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov esi, eax
je 0x41f2d0
mov eax, dword [esp + 0x18]
mov dword [esp + 8], str.fread__d_bytes_failed_n
mov dword [esp + 4], 0x536208
mov dword [esp], 3
mov dword [esp + 0xc], eax
call fcn.004750f0
add esp, 0x802c
mov eax, 0x80000000
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
add esp, 0x802c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.fwrite__d_bytes_failed_n
mov dword [esp + 4], 0x536208
mov dword [esp], 3
call fcn.004750f0
add esp, 0x802c
mov eax, 0x80000000
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x41fa50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov eax, 0x803c
push edi
push esi
push ebx
call fcn.004a7e80
sub esp, eax
mov edx, dword [esp + 0x8058]
mov ebx, dword [esp + 0x8060]
mov ecx, dword [esp + 0x805c]
mov eax, dword [esp + 0x8054]
mov dword [esp + 0x2c], edx
mov edi, dword [esp + 0x8050]
mov dword [esp + 0x24], ebx
mov ebx, edx
mov esi, dword [esp + 0x8064]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x28], eax
xor edx, eax
mov eax, dword [esp + 0x24]
xor eax, ebx
or edx, eax
je 0x41fb78
test esi, esi
je 0x41fb78
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x2c], eax
jg 0x41fb95
jge 0x41fb87
lea ebp, [esp + 0x30]
mov eax, dword [esp + 0x20]
cmp esi, 0x8000
mov ebx, 0x8000
mov dword [esp + 8], 0
cmovb ebx, esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
test eax, eax
jne 0x41fba0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.msvcrt.dll_fread
cmp ebx, eax
jne 0x41fbd6
mov eax, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
test eax, eax
jne 0x41fc10
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.msvcrt.dll_fwrite
cmp ebx, eax
jne 0x41fc46
xor edx, edx
add dword [esp + 0x20], ebx
adc dword [esp + 0x24], edx
add dword [esp + 0x28], ebx
adc dword [esp + 0x2c], edx
sub esi, ebx
jne 0x41fad0
xor eax, eax
add esp, 0x803c
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x28], eax
jb 0x41facc
mov eax, 0x80000000
jmp 0x41fb7a
mov eax, dword [esp + 0x20]
mov dword [esp + 8], str.filemove_src_seek__ld_failed_n
mov dword [esp + 4], 0x536208
mov dword [esp], 3
mov dword [esp + 0xc], eax
call fcn.004750f0
add esp, 0x803c
mov eax, 0x80000000
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.filemove_read__ld_off_ld_failed_n
mov dword [esp + 4], 0x536208
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.004750f0
add esp, 0x803c
mov eax, 0x80000000
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], str.filemove_dst_seek__ld_failed_n
mov dword [esp + 4], 0x536208
mov dword [esp], 3
mov dword [esp + 0xc], eax
call fcn.004750f0
add esp, 0x803c
mov eax, 0x80000000
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.filemove_write__ld_off_ld_failed_n
mov dword [esp + 4], 0x536208
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.004750f0
add esp, 0x803c
mov eax, 0x80000000
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
Function at 0x420460
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, dword [ebx + 0x44]
mov eax, dword [ebx + 0x40]
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebp, eax
je 0x420550
mov eax, dword [edi]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp + 8], 0
movzx edx, word [ebx + 0x20]
movzx eax, word [ebx + 0x22]
add edx, dword [ebx + 0x58]
lea eax, [edx + eax + 0x1e]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
test eax, eax
jne 0x4204db
movzx eax, word [ebx + 0x36]
test ax, ax
je 0x420520
cmp ax, 8
je 0x4204f0
mov dword [esp], ebp
call sub.msvcrt.dll_free
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp + 0xc], eax
mov eax, dword [edi]
mov dword [esp], eax
call fcn.004530b0
mov edx, eax
mov eax, ebp
test dl, dl
je 0x4204db
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [edi]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], ebp
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fread
cmp esi, eax
jne 0x4204db
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 4
xor eax, eax
jmp 0x4204e5
Function at 0x420e50
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x30
movzx eax, word [ecx + 4]
mov esi, dword [esp + 0x40]
mov byte [esp + 0x1a], 0x50
mov byte [esp + 0x1b], 0x4b
mov byte [esp + 0x1e], al
movsx eax, ah
mov byte [esp + 0x1f], al
movzx eax, word [ecx + 6]
mov byte [esp + 0x1c], 5
mov byte [esp + 0x1d], 6
mov byte [esp + 0x20], al
movsx eax, ah
mov byte [esp + 0x21], al
movzx eax, word [ecx + 8]
mov byte [esp + 0x22], al
movsx eax, ah
mov byte [esp + 0x23], al
movzx eax, word [ecx + 0xa]
mov byte [esp + 0x24], al
movsx eax, ah
mov byte [esp + 0x25], al
mov eax, dword [ecx + 0xc]
mov edx, eax
sar edx, 8
mov byte [esp + 0x26], al
mov byte [esp + 0x27], dl
mov edx, eax
sar eax, 0x18
mov byte [esp + 0x29], al
mov eax, dword [ecx + 0x10]
sar edx, 0x10
mov byte [esp + 0x28], dl
mov edx, eax
sar edx, 8
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], dl
mov edx, eax
sar eax, 0x18
mov byte [esp + 0x2d], al
movzx eax, word [ecx + 0x14]
sar edx, 0x10
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2e], al
movsx eax, ah
mov byte [esp + 0x2f], al
lea eax, [esp + 0x1a]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x16
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 0x16
jne 0x420f59
movzx edx, word [ebx + 0x14]
xor edi, edi
test dx, dx
jne 0x420f36
add esp, 0x30
mov eax, edi
pop ebx
pop esi
pop edi
ret 4
mov eax, dword [ebx + 0x18]
mov dword [esp + 4], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
movzx edx, word [ebx + 0x14]
cmp eax, edx
je 0x420f2b
add esp, 0x30
mov edi, 0x80000000
mov eax, edi
pop ebx
pop esi
pop edi
ret 4
Function at 0x42b100
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x30
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x12]
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 0xc], esi
call sub.msvcrt.dll_fread
cmp eax, 0x1e
jne 0x42b330
movzx eax, byte [esp + 0x13]
movzx edx, byte [esp + 0x14]
shl eax, 8
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0x12]
or eax, edx
movzx edx, byte [esp + 0x15]
shl edx, 0x18
or eax, edx
cmp eax, 0x4034b50
jne 0x42b310
movzx edx, byte [esp + 0x17]
movzx eax, byte [esp + 0x16]
movzx ecx, byte [esp + 0x2f]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x19]
mov word [ebx + 4], ax
movzx eax, byte [esp + 0x18]
shl ecx, 8
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x1b]
mov word [ebx + 6], ax
movzx eax, byte [esp + 0x1a]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x1d]
mov word [ebx + 8], ax
movzx eax, byte [esp + 0x1c]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x1f]
mov word [ebx + 0xa], ax
movzx eax, byte [esp + 0x1e]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x22]
mov word [ebx + 0xc], ax
movzx eax, byte [esp + 0x21]
shl edx, 0x10
shl eax, 8
or eax, edx
movzx edx, byte [esp + 0x20]
or eax, edx
movzx edx, byte [esp + 0x23]
shl edx, 0x18
or eax, edx
movzx edx, byte [esp + 0x26]
mov dword [ebx + 0x10], eax
movzx eax, byte [esp + 0x25]
shl edx, 0x10
shl eax, 8
or eax, edx
movzx edx, byte [esp + 0x24]
or eax, edx
movzx edx, byte [esp + 0x27]
shl edx, 0x18
or eax, edx
movzx edx, byte [esp + 0x2a]
mov dword [ebx + 0x14], eax
movzx eax, byte [esp + 0x29]
shl edx, 0x10
shl eax, 8
or eax, edx
movzx edx, byte [esp + 0x28]
or eax, edx
movzx edx, byte [esp + 0x2b]
shl edx, 0x18
or eax, edx
movzx edx, byte [esp + 0x2d]
mov dword [ebx + 0x18], eax
movzx eax, byte [esp + 0x2c]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x2e]
mov word [ebx + 0x1c], ax
or edx, ecx
test ax, ax
mov word [ebx + 0x1e], dx
jne 0x42b2c4
xor edi, edi
test dx, dx
jne 0x42b271
add esp, 0x30
mov eax, edi
pop ebx
pop esi
pop edi
ret 4
movzx edx, dx
add edx, 1
mov dword [esp], edx
call fcn.00521070
test eax, eax
mov dword [ebx + 0x24], eax
je 0x42b340
movzx edx, word [ebx + 0x1e]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fread
movzx edx, word [ebx + 0x1e]
cmp eax, edx
jne 0x42b330
mov edx, dword [ebx + 0x24]
mov byte [edx + eax], 0
add esp, 0x30
mov eax, edi
pop ebx
pop esi
pop edi
ret 4
movzx eax, ax
add eax, 1
mov dword [esp], eax
call fcn.00521070
test eax, eax
mov dword [ebx + 0x20], eax
je 0x42b340
movzx edx, word [ebx + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fread
movzx edx, word [ebx + 0x1c]
cmp eax, edx
jne 0x42b330
mov edx, dword [ebx + 0x20]
mov byte [edx + eax], 0
movzx edx, word [ebx + 0x1e]
jmp 0x42b25f
mov dword [esp + 8], str.whoops:_didnt_find_expected_signature_n
mov dword [esp + 4], 0x537948
mov dword [esp], 3
call fcn.004750f0
lea esi, [esi]
add esp, 0x30
mov edi, 0x80000000
mov eax, edi
pop ebx
pop esi
pop edi
ret 4
mov edi, 0xfffffff4
jmp 0x42b266
Function at 0x42b350
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x34
movzx eax, word [ecx + 4]
mov esi, dword [esp + 0x40]
mov byte [esp + 0x12], 0x50
mov byte [esp + 0x13], 0x4b
mov byte [esp + 0x16], al
movsx eax, ah
mov byte [esp + 0x17], al
movzx eax, word [ecx + 6]
mov byte [esp + 0x14], 3
mov byte [esp + 0x15], 4
mov byte [esp + 0x18], al
movsx eax, ah
mov byte [esp + 0x19], al
movzx eax, word [ecx + 8]
mov byte [esp + 0x1a], al
movsx eax, ah
mov byte [esp + 0x1b], al
movzx eax, word [ecx + 0xa]
mov byte [esp + 0x1c], al
movsx eax, ah
mov byte [esp + 0x1d], al
movzx eax, word [ecx + 0xc]
mov byte [esp + 0x1e], al
movsx eax, ah
mov byte [esp + 0x1f], al
mov eax, dword [ecx + 0x10]
mov edx, eax
sar edx, 8
mov byte [esp + 0x20], al
mov byte [esp + 0x21], dl
mov edx, eax
sar eax, 0x18
mov byte [esp + 0x23], al
mov eax, dword [ecx + 0x14]
sar edx, 0x10
mov byte [esp + 0x22], dl
mov edx, eax
sar edx, 8
mov byte [esp + 0x24], al
mov byte [esp + 0x25], dl
mov edx, eax
sar eax, 0x18
mov byte [esp + 0x27], al
mov eax, dword [ecx + 0x18]
sar edx, 0x10
mov byte [esp + 0x26], dl
mov edx, eax
sar edx, 8
mov byte [esp + 0x28], al
mov byte [esp + 0x29], dl
mov edx, eax
sar eax, 0x18
mov byte [esp + 0x2b], al
movzx eax, word [ecx + 0x1c]
sar edx, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov byte [esp + 0x2c], al
movsx eax, ah
mov byte [esp + 0x2d], al
movzx eax, word [ecx + 0x1e]
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2e], al
movsx eax, ah
mov byte [esp + 0x2f], al
lea eax, [esp + 0x12]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 0x1e
jne 0x42b4a3
movzx eax, word [ebx + 0x1c]
test ax, ax
jne 0x42b4b0
movzx eax, word [ebx + 0x1e]
test ax, ax
jne 0x42b480
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret 4
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x24]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
movzx edx, word [ebx + 0x1e]
cmp eax, edx
je 0x42b46f
add esp, 0x34
mov eax, 0x80000000
pop ebx
pop esi
ret 4
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
movzx edx, word [ebx + 0x1c]
cmp eax, edx
je 0x42b466
jmp 0x42b4a3
Function at 0x440eb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esp], eax
call fcn.00478830
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call fcn.00478c10
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
sub esp, 4
mov dword [esp], eax
call fcn.00478c10
mov edx, 0x55b0d8
mov eax, 0x55b0dc
lea ecx, [ebp - 0x10]
sub esp, 4
test bl, bl
cmove eax, edx
mov dword [esp], eax
call fcn.00478c10
mov ebx, dword [ebp - 0x10]
mov edx, 0x1505
movzx eax, word [ebx]
lea ecx, [ebx + 2]
sub esp, 4
test ax, ax
je 0x440f35
nop
mov esi, edx
add ecx, 2
shl esi, 5
add eax, esi
add edx, eax
movzx eax, word [ecx - 2]
test ax, ax
jne 0x440f20
mov eax, dword [0x55b0c8]
mov dword [ebp - 0xc], edx
test eax, eax
je 0x440fe0
mov esi, 0x55b0c4
jmp 0x440f59
mov esi, eax
mov eax, dword [eax + 8]
test eax, eax
je 0x440f65
cmp dword [eax + 0x10], edx
jae 0x440f50
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x440f59
cmp esi, 0x55b0c4
je 0x440fe0
cmp edx, dword [esi + 0x10]
jb 0x440fe0
mov eax, dword [esi + 0x14]
mov edx, 0xffffffff
test eax, eax
je 0x440f86
mov edx, dword [eax - 0xc]
shr edx, 1
sub edx, 1
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebx - 0xc]
mov dword [esp], ebx
shr eax, 1
sub eax, 1
mov dword [esp + 4], eax
call fcn.004796f0
test eax, eax
jne 0x440fc1
add dword [0x55b0e8], 1
mov ebx, dword [esi + 0x18]
lea ecx, [ebp - 0x10]
call fcn.004789b0
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp - 0xc]
mov ecx, 0x55b0c0
mov dword [esp], eax
xor ebx, ebx
add dword [0x55b0e0], 1
call fcn.005158c0
sub esp, 4
jmp 0x440fb0
add dword [0x55b0e4], 1
xor ebx, ebx
jmp 0x440fb0
Function at 0x44ee60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x110
mov dword [esp], str.ANDROID_DATA
call sub.msvcrt.dll_getenv
test eax, eax
je 0x44ef22
mov dword [esp], eax
mov ecx, esi
call fcn.00476020
mov ecx, esi
sub esp, 4
mov dword [esp], str.resource_cache
call fcn.00476e40
sub esp, 4
mov dword [esp + 8], 0xff
mov eax, dword [ebx]
lea ebx, [ebp - 0x108]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strncpy
movzx eax, byte [ebp - 0x108]
mov byte [ebp - 9], 0
cmp al, 0x2f
jne 0x44eeda
lea esi, [esi]
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x2f
je 0x44eed0
test al, al
mov edx, ebx
je 0x44eefb
add edx, 1
movzx eax, byte [edx]
test al, al
je 0x44eefb
cmp al, 0x2f
jne 0x44eee0
mov byte [edx], 0x40
add edx, 1
movzx eax, byte [edx]
test al, al
jne 0x44eeea
mov ecx, esi
mov dword [esp], ebx
call fcn.00476e40
mov ecx, esi
sub esp, 4
mov dword [esp], str._idmap
call fcn.004764f0
mov eax, esi
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 8], str.ANDROID_DATA_not_set
mov dword [esp + 4], 0x53cbcd
mov dword [esp], str.root__NULL
call fcn.004751c0
nop
Function at 0x452e80
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov dword [esp], ebx
call sub.msvcrt.dll_getc
cmp eax, 0x1f
je 0x452ea2
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sub.msvcrt.dll_getc
cmp eax, 0x8b
jne 0x452e98
mov dword [esp], ebx
call sub.msvcrt.dll_getc
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_getc
cmp esi, 8
mov edi, eax
jne 0x452e98
cmp eax, 0xffffffff
mov si, 6
je 0x452e98
mov dword [esp], ebx
call sub.msvcrt.dll_getc
sub esi, 1
jne 0x452ed3
test edi, 4
jne 0x453060
test edi, 8
jne 0x453002
test edi, 0x10
jne 0x453030
and edi, 2
jne 0x453096
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
jne 0x452e98
mov dword [esp], ebx
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x452e98
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [esp + 8], 2
mov dword [esp + 4], 0xfffffff8
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov edx, dword [esp + 0x4c]
sub eax, esi
mov dword [edx], eax
lea eax, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 8
jne 0x452e98
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov eax, dword [esp + 0x44]
movzx edx, byte [esp + 0x1a]
mov dword [eax], 8
movzx eax, byte [esp + 0x19]
shl edx, 0x10
shl eax, 8
or eax, edx
movzx edx, byte [esp + 0x18]
or eax, edx
movzx edx, byte [esp + 0x1b]
shl edx, 0x18
or eax, edx
mov edx, dword [esp + 0x50]
mov dword [edx], eax
movzx eax, byte [esp + 0x1d]
movzx edx, byte [esp + 0x1e]
shl eax, 8
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0x1c]
or eax, edx
movzx edx, byte [esp + 0x1f]
shl edx, 0x18
or eax, edx
mov edx, dword [esp + 0x48]
mov dword [edx], eax
mov eax, 1
jmp 0x452e9a
mov dword [esp], ebx
call sub.msvcrt.dll_getc
add eax, 1
cmp eax, 1
jbe 0x452ef8
mov dword [esp], ebx
call sub.msvcrt.dll_getc
add eax, 1
cmp eax, 1
ja 0x453002
jmp 0x452ef8
mov dword [esp], ebx
call sub.msvcrt.dll_getc
lea edx, [eax + 1]
cmp edx, 1
jbe 0x452f04
mov dword [esp], ebx
call sub.msvcrt.dll_getc
lea edx, [eax + 1]
cmp edx, 1
ja 0x453030
jmp 0x452f04
mov dword [esp], ebx
call sub.msvcrt.dll_getc
mov dword [esp], ebx
mov ebp, eax
call sub.msvcrt.dll_getc
mov esi, eax
shl esi, 8
or esi, ebp
test esi, esi
je 0x452eec
mov dword [esp], ebx
sub esi, 1
call sub.msvcrt.dll_getc
cmp eax, 0xffffffff
jne 0x453079
jmp 0x452eec
mov dword [esp], ebx
call sub.msvcrt.dll_getc
mov dword [esp], ebx
call sub.msvcrt.dll_getc
jmp 0x452f0d
Function at 0x454d10
Capabilities:
Read file on windows

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edx, dword [ecx + 0x7c]
mov esi, dword [ecx + 0x78]
cmp edx, esi
jae 0x454d61
sub esi, edx
mov edx, dword [ecx + 0x74]
cmp esi, edx
cmova esi, edx
test esi, esi
je 0x454d61
mov eax, dword [ebx + 0x70]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov edi, eax
je 0x454d70
test eax, eax
js 0x454db3
mov eax, dword [ebx + 0x70]
add dword [ebx + 0x7c], edi
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x14], eax
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.imp.msvcrt.dll__errno]
call ebp
cmp dword [eax], 4
je 0x454d33
call ebp
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], str.Error_reading_asset_data:__s
mov dword [esp + 4], str.szipinf
mov dword [esp], 6
mov dword [esp + 0xc], eax
call fcn.004750f0
add esp, 0x1c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.imp.msvcrt.dll__errno]
jmp 0x454d7d

Function at 0x456dd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
movzx edx, byte [ebx + 0x80]
add ebx, 0x84
movzx ecx, byte [ebx - 1]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x48]
shl edx, 0x18
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 8], eax
movzx eax, byte [ebx - 3]
shl eax, 0x10
add edx, eax
movzx eax, byte [ebx - 2]
add edx, ecx
shl eax, 8
add edx, eax
mov dword [esp + 0x10], edx
jne 0x456e58
jmp 0x456f18
cmp esi, dword [esp + 8]
ja 0x456ef0
mov eax, dword [esp + 8]
sub eax, esi
cmp ebp, eax
ja 0x456ef0
add edi, 1
add ebx, 0xc
cmp edi, dword [esp + 0x10]
je 0x456f18
movzx edx, byte [ebx]
movzx eax, byte [ebx + 1]
movzx ecx, byte [ebx + 3]
movzx esi, byte [ebx + 4]
shl edx, 0x18
movzx ebp, byte [ebx + 8]
shl eax, 0x10
add edx, eax
movzx eax, byte [ebx + 2]
add edx, ecx
shl esi, 0x18
shl ebp, 0x18
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 7]
mov dword [esp + 0xc], eax
movzx eax, byte [ebx + 5]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 6]
add esi, edx
movzx edx, byte [ebx + 0xb]
shl eax, 8
add esi, eax
movzx eax, byte [ebx + 9]
shl eax, 0x10
add ebp, eax
movzx eax, byte [ebx + 0xa]
add ebp, edx
shl eax, 8
add ebp, eax
test esi, 3
je 0x456e30
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], str.ICC_profile_tag_start_not_a_multiple_of_4
mov dword [esp], eax
mov eax, dword [esp + 0x14]
call fcn.004555e0
cmp esi, dword [esp + 8]
jbe 0x456e3a
lea esi, [esi]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x44], str.ICC_profile_tag_outside_profile
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004555e0
add esp, 0x2c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x459aa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
test eax, eax
je 0x459ac7
mov edx, dword [eax + 0x40]
test edx, edx
je 0x459ac7
mov eax, dword [eax + 0x44]
test eax, eax
je 0x459ac7
mov ecx, dword [ebp + 0xc]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]