joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15014f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x15049cf8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x15014f30
sub eax, edx
mov edi, eax
lea eax, [edi + edi + 4]
call fcn.15038730
mov ecx, esp
xor bl, bl
xor esi, esi
test edi, edi
mov byte [ecx], 0xd
mov byte [ecx + 1], 0xa
mov eax, 2
jbe 0x15014f87
mov edx, dword [ebp + 0xc]
mov dl, byte [esi + edx]
cmp dl, 0xa
jne 0x15014f73
cmp bl, 0xd
je 0x15014f73
mov byte [eax + ecx], 0xd
add eax, 1
mov byte [eax + ecx], dl
add esi, 1
add eax, 1
cmp esi, edi
mov bl, dl
jb 0x15014f5c
cmp dl, 0xa
je 0x15014f95
mov byte [eax + ecx], 0xd
add eax, 1
mov byte [eax + ecx], 0xa
add eax, 1
push 0
lea edx, [ebp - 8]
push edx
push eax
mov byte [eax + ecx], 0
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1503831e
mov esp, ebp
pop ebp
ret 8

Function at 0x15014fd0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x210
mov eax, dword [0x15049cf8]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
test ebp, ebp
mov dword [esp + 4], eax
jne 0x15015000
mov ebp, str._Log
push ebx
push 0x104
lea ecx, [esp + 0x114]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [esp + 0x224]
push edx
lea eax, [esp + 0x114]
push eax
push esi
call sym.Storm.dll_Ordinal_501
mov dl, 0x5c
mov ecx, esi
call sym.Storm.dll_Ordinal_570
mov ebx, eax
test ebx, ebx
je 0x15015041
mov byte [ebx + 1], 0
jmp 0x1501504b
push esi
call sym.Storm.dll_Ordinal_506
mov ebx, eax
add ebx, esi
mov ecx, dword [esp + 0x224]
push ecx
push str.Errors_
push esi
call sym.Storm.dll_Ordinal_503
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x15015091
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1501507d
cmp eax, 5
jne 0x1501508d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1501508d
test al, 0x10
jne 0x15015091
mov byte [ebx + 1], 0
test edi, edi
pop ebx
je 0x150150ce
mov edx, dword [esp + 4]
movzx eax, word [edi + 0xc]
movzx ecx, word [edi + 0xa]
push edx
movzx edx, word [edi + 8]
push ebp
push eax
movzx eax, word [edi + 6]
push ecx
movzx ecx, word [edi + 2]
push edx
movzx edx, word [edi]
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push str._04d__02d__02d__02d._02d._02d__s._s
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x28
jmp 0x150150e7
mov ecx, dword [esp + 4]
push ecx
push ebp
lea edx, [esp + 0x10]
push str._s._s
push edx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x10
mov eax, dword [esp + 0x220]
push eax
lea ecx, [esp + 0xc]
push ecx
push esi
call sym.Storm.dll_Ordinal_503
mov ecx, dword [esp + 0x210]
pop ebp
xor ecx, esp
call fcn.1503831e
add esp, 0x210
ret 0xc
Function at 0x15016700
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x1cc
mov eax, dword [0x15049cf8]
xor eax, esp
mov dword [esp + 0x1c8], eax
cmp dword [0x1504c2a4], 0
push esi
mov esi, dword [esp + 0x1d8]
push edi
mov edi, dword [esp + 0x1d8]
jne 0x1501674d
push 0x1504c2a0
push 0
push str.Debug_Memory
push str.Internal
mov dword [0x1504c2a4], 1
call sym.Storm.dll_Ordinal_423
cmp dword [0x1504c2a0], 0
je 0x150167e5
test esi, esi
je 0x1501677e
cmp byte [esi], 0
je 0x1501677e
push esi
push edi
push str._s___s_
lea eax, [esp + 0x14]
push 0x100
push eax
call sym.Storm.dll_Ordinal_578
add esp, 0x14
jmp 0x15016796
push edi
push 0x150415f4
lea ecx, [esp + 0x10]
push 0x100
push ecx
call sym.Storm.dll_Ordinal_578
add esp, 0x10
cmp dword [0x15057700], 0
jne 0x150167b8
push 1
push 1
push 0
push 0xfffffffffffffffd
lea edx, [esp + 0x18]
push edx
push 0x8510007f
call sym.Storm.dll_Ordinal_461
jmp 0x150167e5
lea eax, [esp + 8]
push eax
push str.Storm_Error_:_handle_never_released_____s_n
lea ecx, [esp + 0x110]
push 0xc8
push ecx
call sym.Storm.dll_Ordinal_578
add esp, 0x10
lea edx, [esp + 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x1d0]
pop edi
pop esi
xor ecx, esp
call fcn.1503831e
add esp, 0x1cc
ret 8
Function at 0x15017570
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, eax
shr esi, 2
mov eax, 0xeeeeeeee
je 0x150175d0
push ebx
mov ebx, dword [0x1504c2e4]
push ebp
push edi
jmp 0x15017590
mov edi, ecx
and edi, 0xff
add eax, dword [ebx + edi*4 + 0x1000]
sub esi, 1
lea edi, [eax + ecx]
xor dword [edx], edi
mov edi, dword [edx]
mov ebp, eax
shl ebp, 5
add ebp, edi
mov edi, ecx
not edi
shl edi, 0x15
add edi, 0x11111111
shr ecx, 0xb
add edx, 4
or ecx, edi
test esi, esi
lea eax, [eax + ebp + 3]
jne 0x15017590
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x15017770
Capabilities:
Read file on windows

Disassembly:
push ebp
xor ebp, ebp
cmp edi, 0xffffffff
je 0x15017784
push 0
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0
push esi
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esi]
mov ecx, dword [esp + 8]
add edx, edi
test eax, eax
mov dword [ecx], edx
jne 0x150177f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x15049600]
sub ecx, 0
je 0x1501780a
sub ecx, 1
je 0x150177d4
sub ecx, 1
jne 0x15017773
mov edx, dword [esp + 0x14]
push 1
push ecx
push ecx
push 0xfffffffffffffffc
push edx
push eax
call sym.Storm.dll_Ordinal_461
jmp 0x15017773
mov ecx, dword [0x1504c2e0]
test ecx, ecx
je 0x1501780a
push ebp
push eax
mov eax, dword [esp + 0x1c]
push eax
call ecx
add ebp, 1
test eax, eax
jne 0x15017773
pop ebp
ret 0x10
mov ecx, dword [esp + 0x10]
cmp dword [esi], ecx
jne 0x15017803
mov eax, 1
pop ebp
ret 0x10
push 0x26
call sym.Storm.dll_Ordinal_465
xor eax, eax
pop ebp
ret 0x10

Function at 0x15017990
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x120
mov eax, dword [0x15049cf8]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push esi
push edi
push 4
push eax
lea eax, [esp + 0x10]
push eax
call sym.Storm.dll_Ordinal_501
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor edi, edi
push 0x104
lea edx, [esp + 0x24]
push edi
push edx
mov esi, eax
mov dword [esp + 0x20], edi
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edi
push edi
push edi
push edi
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x15017a06
xor eax, eax
jmp 0x15017a69
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x15017a02
mov eax, dword [esp + 0x14]
and eax, 4
xor eax, dword [esp + 0x20]
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0xc]
xor eax, esi
mov edx, eax
shr edx, 0x10
xor edx, eax
movzx eax, dx
cmp ax, 0x1f00
je 0x15017a64
cmp ax, 0x805
jne 0x15017a02
mov eax, 1
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, esp
call fcn.1503831e
add esp, 0x120
ret 4
Function at 0x15017b50
Capabilities:
Get file attributes

Disassembly:
push ebx
mov bl, byte [esp + 8]
push edi
mov edi, eax
xor eax, eax
test bl, 3
je 0x15017be4
test bl, 2
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
je 0x15017b85
push 1
mov ecx, esi
call fcn.15017a90
push edi
call ebp
shr eax, 4
not eax
and eax, 1
jne 0x15017be3
test bl, 1
je 0x15017be3
cmp byte [esi], 0x5c
je 0x15017bcc
mov ebx, dword [sym.imp.MSVCR80.dll_strstr]
push 0x15043758
push esi
call ebx
add esp, 8
test eax, eax
jne 0x15017bcc
push 0x15043754
push esi
call ebx
add esp, 8
test eax, eax
jne 0x15017bcc
push eax
mov ecx, esi
call fcn.15017a90
push edi
call ebp
shr eax, 4
pop ebp
not eax
pop edi
and eax, 1
pop ebx
ret 4
push 0x104
push esi
push edi
call sym.Storm.dll_Ordinal_501
push edi
call ebp
shr eax, 4
not eax
and eax, 1
pop ebp
pop edi
pop ebx
ret 4

Function at 0x150187c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp dword [esp + 0x14], 0
jne 0x150187f1
cmp dword [esp + 0x1c], 0
jne 0x150187f1
mov dword [esp + 0x14], 0x15043630
mov dword [esp + 0x18], 0x100
mov dword [esp + 0x1c], 0x15043730
mov dword [esp + 0x20], 4
cmp dword [esp + 0x10], 0
jne 0x15018800
lea eax, [esp + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push ebx
push ebp
push esi
push edi
mov dword [ecx], 0
push edx
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
call sym.Storm.dll_Ordinal_649
push 0x1504c420
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0xb31
push str..SFile.cpp
push 0x10000
call sym.Storm.dll_Ordinal_401
mov ebp, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
mov ebx, eax
mov eax, dword [ebp + 0x10c]
push 0
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x28], esi
je 0x15018901
mov ecx, dword [ebp + 0x130]
mov edx, dword [ebp + 0x10c]
push 0
push 0
push ecx
push edx
call edi
cmp eax, 0xffffffff
je 0x15018901
mov ecx, dword [esp + 0x10]
call sym.Storm.dll_Ordinal_653
mov edi, eax
mov eax, dword [ebp + 0x138]
add edi, dword [eax + 8]
je 0x150188ef
cmp edi, 0x10000
mov esi, 0x10000
ja 0x150188b1
mov esi, edi
mov edx, dword [ebp + 0x10c]
push 0
lea ecx, [esp + 0x34]
push ecx
push esi
push ebx
push edx
sub edi, esi
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x15018901
cmp dword [esp + 0x30], esi
jne 0x15018901
mov ecx, dword [esp + 0x10]
push esi
mov edx, ebx
call sym.Storm.dll_Ordinal_650
test edi, edi
jne 0x150188a2
mov esi, dword [esp + 0x28]
mov eax, dword [ebp + 0x10c]
push 0
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0xb57
push str..SFile.cpp
push ebx
call sym.Storm.dll_Ordinal_403
push 0x1504c420
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x14]
call sym.Storm.dll_Ordinal_651
mov edx, dword [esp + 0x20]
neg eax
sbb eax, eax
and eax, 4
add eax, 1
xor ecx, ecx
cmp eax, 5
sete cl
pop edi
pop esi
pop ebp
mov dword [edx], eax
pop ebx
mov eax, ecx
add esp, 8
ret 0x18
Function at 0x15018c20
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x15018c30
mov dword [edi], 0
push 0x1504c420
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x110], 0xffffffff
push 0x1504c420
je 0x15018c66
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x110]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop edi
pop esi
ret 8
mov ecx, dword [esi + 0x118]
mov esi, dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
ret 8
Function at 0x1501af30
Capabilities:
Create thread

Disassembly:
cmp dword [0x1504c2fc], 0
jne 0x1501af72
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x1504c2f8
push 0
push 0
push 0x1501abd0
push 0
push 0
mov dword [0x1504c308], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
push eax
mov dword [0x1504c2fc], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
ret

Function at 0x1501af80
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x1504c2fc]
test eax, eax
push esi
push edi
mov esi, edx
mov edi, ecx
jne 0x1501afd6
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x1504c2f8
push 0
push 0
push 0x1501abd0
push 0
push 0
mov dword [0x1504c308], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
push eax
mov dword [0x1504c2fc], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1504c2f8]
mov ecx, dword [0x1504c2fc]
mov dword [edi], eax
pop edi
mov dword [esi], ecx
pop esi
ret
mov edx, dword [0x1504c2f8]
mov dword [edi], edx
pop edi
mov dword [esi], eax
pop esi
ret
Function at 0x1501d3b0
Capabilities:
Get file attributes
Get file size

Disassembly:
sub esp, 0x10c
mov eax, dword [0x15049cf8]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x11c]
or ecx, 0xffffffff
test eax, eax
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 4], eax
jne 0x1501d3e2
xor ecx, ecx
jmp 0x1501d3e8
mov dword [eax], 0
mov al, byte [esi]
neg al
sbb eax, eax
test ecx, eax
jne 0x1501d413
push 0x57
call sym.Storm.dll_Ordinal_465
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.1503831e
add esp, 0x10c
ret 0x10
push 0x1504c420
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1504c2e4], 0
jne 0x1501d431
mov eax, 0x100001
call fcn.15017650
push edi
push 0x104
push esi
lea ecx, [esp + 0x14]
push ecx
call sym.Storm.dll_Ordinal_501
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x113], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
shr eax, 4
not eax
test al, 1
jne 0x1501d4a5
cmp byte [esi], 0x5c
je 0x1501d495
mov edi, dword [sym.imp.MSVCR80.dll_strstr]
push 0x15043758
push esi
call edi
add esp, 8
test eax, eax
jne 0x1501d495
push 0x15043754
push esi
call edi
add esp, 8
test eax, eax
jne 0x1501d495
push eax
lea edi, [esp + 0x10]
mov ecx, esi
call fcn.15017a90
jmp 0x1501d4a5
push 0x104
push esi
lea eax, [esp + 0x14]
push eax
call sym.Storm.dll_Ordinal_501
push ebx
push ebp
lea ecx, [esp + 0x14]
push ecx
call fcn.15017990
mov ebx, dword [esp + 0x128]
test bl, 1
mov ebp, eax
je 0x1501d4dc
test ebp, ebp
jne 0x1501d4dc
push 0xf
call sym.Storm.dll_Ordinal_465
push 0x1504c420
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x1501d5e2
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1501d4ca
push 8
push 0xfffffffffffffffe
push str.._AUARCHIVEREC_SFile_Storm__
push 0x25c
call sym.Storm.dll_Ordinal_401
xor esi, esi
cmp eax, esi
je 0x1501d51d
mov dword [eax], esi
mov dword [eax + 4], esi
mov esi, eax
push 0x104
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 8]
push ecx
call sym.Storm.dll_Ordinal_501
mov eax, dword [esp + 0x124]
mov edx, ebp
neg edx
sbb edx, edx
and edx, 3
test ebp, ebp
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edx
mov dword [esi + 0x118], eax
mov dword [esi + 0x148], 1
je 0x1501d56c
mov dword [esi + 0x110], 3
jmp 0x1501d57a
movzx ecx, bl
shr ecx, 1
and ecx, 1
mov dword [esi + 0x110], ecx
push 0
push 0x1050
mov edx, ebx
shr edx, 2
push str..SFile.cpp
and edx, 1
push 0x20
mov dword [esi + 0x114], edx
call sym.Storm.dll_Ordinal_401
push 0
push edi
mov dword [esi + 0x138], eax
mov dword [esi + 0x130], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x134], eax
mov eax, dword [esp + 0x10]
push eax
push ebp
mov edx, ebx
mov ecx, esi
mov dword [esi + 0x258], 0
call fcn.1501cfc0
push 0x1504c420
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x118]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.1503831e
add esp, 0x10c
ret 0x10
Function at 0x1501db80
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
mov dword [eax + 0x10], ebx
mov ecx, dword [esi + 0x1c]
push edi
mov edi, dword [sym.imp.MSVCR80.dll_fread]
mov dword [ecx + 0xc], edx
jmp 0x1501dba0
mov eax, dword [esi + 0x1c]
cmp dword [eax + 4], 0
jne 0x1501dbce
mov edx, dword [esi + 0x18]
mov dword [eax], edx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx]
push eax
push 0x1000
push 1
push edx
call edi
add esp, 0x10
test eax, eax
jle 0x1501dbce
mov ecx, dword [esi + 0x1c]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x1c]
mov edx, 2
call fcn.1503ba50
mov edx, dword [esi + 0x1c]
cmp dword [edx + 0x10], 0
je 0x1501dbf5
cmp eax, 1
je 0x1501dc0d
test eax, eax
je 0x1501dba0
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1501dbff
mov dword [eax], ebx
add dword [esi + 0x20], ebx
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1501dc1e
mov ecx, edx
mov edx, ebx
sub edx, dword [ecx + 0x10]
mov dword [eax], edx
mov eax, dword [esi + 0x1c]
mov ecx, ebx
sub ecx, dword [eax + 0x10]
xor edx, edx
add dword [esi + 0x20], ecx
sub ebx, dword [eax + 0x10]
pop edi
cmp edx, ebx
sbb eax, eax
pop esi
neg eax
pop ebx
ret 8

Function at 0x1501dca0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax]
sub esp, 0x30
cmp ecx, 4
ja case.default.0x1501dcae
jmp dword [ecx*4 + 0x1501dd24]
cmp dword [eax + 4], 0
je case.default.0x1501dcae
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x1501dcc9
mov dword [ecx], 0
mov edx, dword [eax + 4]
lea ecx, [esp]
push ecx
push edx
call dword [sym.imp.MSVCR80.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR80.dll__fstat64i32]
add esp, 8
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 0x14]
add esp, 0x30
ret 8
mov eax, dword [eax + 0x14]
add esp, 0x30
ret 8
add esp, 0x30
mov edx, dword [eax + 0x3c]
mov dword [esp + 4], edx
jmp sym.Storm.dll_Ordinal_265
mov ecx, dword [eax + 0x40]
call fcn.15037c30
add esp, 0x30
ret 8
xor eax, eax
add esp, 0x30
ret 8
Function at 0x1501e160
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
add ecx, 0x24
call sym.Storm.dll_public:_void___thiscall_SCritSect::Enter_void_
mov eax, dword [esi + 8]
mov ebp, dword [eax + 0x58]
mov eax, dword [eax]
cmp eax, 4
ja case.default.0x1501e181
push edi
jmp dword [eax*4 + 0x1501e2ec]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
push ebx
push ecx
call dword [sym.imp.MSVCR80.dll_ftell]
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 8]
mov ebx, dword [sym.imp.MSVCR80.dll_fseek]
mov edi, eax
mov eax, dword [edx]
mov edx, dword [ecx + 4]
push 0
push eax
push edx
call ebx
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
push ecx
push edx
push 1
push eax
call dword [sym.imp.MSVCR80.dll_fread]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 4]
push 0
push edi
push edx
call ebx
add esp, 0x2c
pop ebx
jmp 0x1501e2bc
mov ecx, dword [esi + 0x14]
mov ecx, dword [ecx]
test ecx, ecx
mov eax, dword [esi + 8]
mov edi, dword [eax + 0x20]
je 0x1501e1f5
push 0
push 0
push ecx
push eax
call sym.Storm.dll_public:_static_unsigned_long_int___stdcall_SFile::SetFilePointer_class_SFile___long_int__long_int___unsigned_long_int_
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 8]
push 0
push edx
mov edx, dword [esi + 0xc]
call fcn.1501db80
mov eax, dword [esi + 8]
push 0
push 0
push edi
push eax
call sym.Storm.dll_public:_static_unsigned_long_int___stdcall_SFile::SetFilePointer_class_SFile___long_int__long_int___unsigned_long_int_
jmp 0x1501e2bc
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x3c]
push 1
push 0
push 0
push edx
call sym.Storm.dll_Ordinal_271
mov edi, eax
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x1501e247
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x3c]
push 0
push 0
push eax
push edx
call sym.Storm.dll_Ordinal_271
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [edx + 0x3c]
push ecx
push eax
call sym.Storm.dll_Ordinal_291
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x3c]
push 0
push 0
push edi
push edx
call sym.Storm.dll_Ordinal_271
jmp 0x1501e2bc
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x40]
call fcn.15037c20
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
test edx, edx
mov edi, eax
je 0x1501e299
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x40]
push 0
call fcn.15037b40
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
push 0
push ecx
mov ecx, dword [eax + 0x40]
call fcn.15037c40
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x40]
push 0
mov edx, edi
call fcn.15037b40
pop edi
mov eax, dword [esi + 8]
add dword [eax + 0x5c], 0xffffffff
mov ecx, dword [esi + 8]
add ecx, 0x24
call sym.Storm.dll_public:_void___thiscall_SCritSect::Leave_void_
mov edx, dword [esi + 0x14]
mov ecx, dword [edx + 4]
call sym.Storm.dll_public:_int___thiscall_SEvent::Set_void_
test ebp, ebp
je 0x1501e2e7
mov eax, dword [esi + 8]
push eax
call sym.Storm.dll_public:_static_unsigned_long_int___stdcall_SFile::Close_class_SFile__
pop esi
pop ebp
ret
Function at 0x1501e7e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x1501e810
test eax, eax
je 0x1501e7f9
mov ecx, dword [eax + 4]
call sym.Storm.dll_public:_int___thiscall_SEvent::Set_void_
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1501e807
mov dword [eax], 0
mov eax, 1
pop edi
ret 0x18
test eax, eax
jne 0x1501e914
push ebx
push esi
mov esi, dword [esp + 0x10]
lea ebx, [esi + 0x24]
mov ecx, ebx
call sym.Storm.dll_public:_void___thiscall_SCritSect::Enter_void_
mov eax, dword [esi]
cmp eax, 4
ja case.default.0x1501e833
jmp dword [eax*4 + 0x1501e92c]
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x14]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR80.dll_fread]
mov esi, eax
add esp, 0x10
test esi, esi
jl 0x1501e90c
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1501e863
mov dword [eax], esi
mov ecx, ebx
call sym.Storm.dll_public:_void___thiscall_SCritSect::Leave_void_
xor eax, eax
test esi, esi
pop esi
pop ebx
setg al
pop edi
ret 0x18
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push edi
mov ecx, esi
call fcn.1501db80
mov ecx, ebx
mov esi, eax
call sym.Storm.dll_public:_void___thiscall_SCritSect::Leave_void_
mov eax, esi
pop esi
pop ebx
pop edi
ret 0x18
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x3c]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x3c], 0
call sym.Storm.dll_Ordinal_291
jmp 0x1501e8d7
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x40]
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0x28], 0
call fcn.15037c40
test eax, eax
mov ecx, dword [esp + 0x20]
jne 0x1501e8e7
test ecx, ecx
ja 0x1501e8e7
xor esi, esi
jmp 0x1501e8ec
mov esi, 1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1501e8f6
mov dword [eax], ecx
mov ecx, ebx
call sym.Storm.dll_public:_void___thiscall_SCritSect::Leave_void_
mov eax, esi
pop esi
pop ebx
pop edi
ret 0x18
mov ecx, ebx
call sym.Storm.dll_public:_void___thiscall_SCritSect::Leave_void_
pop esi
pop ebx
xor eax, eax
pop edi
ret 0x18
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push edi
call fcn.1501e700
mov eax, 1
pop edi
ret 0x18