joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410430
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
mov word [esp + 0x14], ax
mov eax, dword [ebx + 8]
mov word [esp + 0x16], ax
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
lea eax, [esp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp dword [ebx + 8], 0xfffe
jbe 0x4104f8
lea eax, [esp + 0x16]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
mov word [esp + 0x16], 0xffff
call sub.msvcrt.dll_fwrite
mov eax, dword [ebx + 8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x24
pop ebx
pop esi
ret 8
lea eax, [esp + 0x16]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
add esp, 0x24
pop ebx
pop esi
ret 8

Function at 0x410520
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov dword [esp + 4], 0x48892b
mov dword [esp], edi
call sub.msvcrt.dll_fopen
test eax, eax
je 0x41057f
mov ebx, eax
jmp 0x41054d
cmp eax, 0x1a
je 0x410590
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
jne 0x410548
mov eax, dword [0x4b61c0]
mov dword [esp + 8], str.reached_end_of_file_while_skipping_header
mov dword [esp + 4], str.skip_header
mov dword [esp], eax
call fcn.004256d0
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x20
xor esi, esi
mov eax, esi
pop ebx
pop esi
pop edi
ret 4
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll_fread
dec eax
jne 0x410577
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.File__s__version__d_:_n
call fcn.004719d0
mov ecx, esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0040cae0
sub esp, 0xc
mov esi, eax
test al, al
je 0x410577
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x20
pop ebx
mov eax, esi
pop esi
pop edi
ret 4
Function at 0x410840
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov dword [esp + 4], 0x48892b
mov dword [esp], edi
call sub.msvcrt.dll_fopen
test eax, eax
je 0x41089f
mov ebx, eax
jmp 0x41086d
cmp eax, 0x1a
je 0x4108b0
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
jne 0x410868
mov eax, dword [0x4b61c0]
mov dword [esp + 8], str.reached_end_of_file_while_skipping_header
mov dword [esp + 4], str.skip_header
mov dword [esp], eax
call fcn.004256d0
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
xor ebp, ebp
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea eax, [esp + 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll_fread
dec eax
jne 0x410897
mov eax, dword [esp + 0x10]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], str.Contents_of_file__s__pak_version__u_:_n
call fcn.004719d0
mov dword [esp], str.type______________name____________________________nodes__size_n____________________________________________________________________n
call fcn.004719d0
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040c0d0
mov ebp, eax
test al, al
je 0x410897
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov edi, eax
test eax, eax
jne 0x410897
cmp word [esp + 0x18], 0
je 0x410957
nop
mov dword [esp], ebx
mov ecx, esi
call fcn.0040d340
test al, al
push edx
je 0x410897
xor eax, eax
inc edi
mov ax, word [esp + 0x18]
cmp eax, edi
jg 0x410938
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x4108a1
Function at 0x4120f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
xor ebp, ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x68]
mov dword [esp + 4], 0x48892b
mov dword [esp], edi
call sub.msvcrt.dll_fopen
mov ebx, eax
test eax, eax
jne 0x41211d
jmp 0x412151
cmp eax, 0x1a
je 0x412160
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
jne 0x412118
mov eax, dword [0x4b61c0]
mov dword [esp + 8], str.reached_end_of_file_while_skipping_header
mov dword [esp + 4], str.skip_header
mov dword [esp], eax
call fcn.004256d0
xor ebp, ebp
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x4c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
lea eax, [esp + 0x24]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp dword [esp + 0x24], 0x3eb
ja 0x412288
mov dword [esp + 4], edi
mov dword [esp], str.___copying_file__s_n
call fcn.004719d0
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040c0d0
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 4]
add ecx, eax
test ax, ax
mov word [edx + 4], cx
je 0x41227b
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x34]
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0040c0d0
mov eax, dword [esp + 0x60]
mov ecx, esi
mov dword [esp], eax
mov dword [esp + 4], edi
call fcn.00410430
push eax
push eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00480010
mov dword [esp + 0xc], ebx
mov ebp, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ebp
call sub.msvcrt.dll_fread
mov eax, dword [esp + 0x60]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], ebp
call sub.msvcrt.dll_fwrite
mov dword [esp], ebp
call fcn.0047ffe0
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov ecx, esi
call fcn.00410ba0
xor eax, eax
sub esp, 0xc
mov edx, dword [esp + 0x1c]
mov ax, word [esp + 0x2c]
inc edx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x1c]
cmp edx, eax
jl 0x4121d4
mov ebp, 1
jmp 0x412149
mov eax, dword [0x4b61c0]
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.skipping_file__s___version_mismatch__need_same_version_to_merge__
mov dword [esp + 4], str.root_writer_t::do_copy
mov dword [esp], eax
xor ebp, ebp
call fcn.00425600
jmp 0x412149
Function at 0x420400
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov cl, byte [esi]
test cl, cl
je 0x4204a8
mov ebx, esi
xor edi, edi
mov al, 0x10
mov dword [esp + 0x1c], ebp
lea esi, [esi]
inc ebx
mov dl, al
sub edx, ebx
and ecx, 0xff
add edx, esi
add edi, ecx
movsx ebp, byte [ebx]
movsx edx, dl
imul edx, ebp
mov ecx, ebp
test edx, edx
jne 0x420428
mov ecx, 0x65
mov eax, edi
xor edx, edx
mov ebp, dword [esp + 0x1c]
div ecx
lea eax, [edx + edx*2]
mov ebx, dword [ebp + eax*4]
test ebx, ebx
jne 0x420470
jmp 0x420498
jg 0x420498
mov ebx, dword [ebx]
test ebx, ebx
je 0x420498
mov dword [esp + 4], esi
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x420468
mov byte [ebx + 8], 1
mov eax, dword [ebx + 0xc]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4
add esp, 0x2c
mov eax, 0x489c0d
pop ebx
pop esi
pop edi
pop ebp
ret 4
xor edx, edx
jmp 0x420455
Function at 0x420900
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov al, byte [0x4b6230]
test al, al
je 0x4209c8
mov eax, dword [esp + 0x44]
mov dword [0x4b6238], eax
mov cl, byte [esi]
test cl, cl
je 0x420a08
mov ebx, esi
xor edi, edi
mov al, 0x10
mov dword [esp + 0x1c], ebp
nop
inc ebx
mov dl, al
sub edx, ebx
and ecx, 0xff
add edx, esi
add edi, ecx
movsx ebp, byte [ebx]
movsx edx, dl
imul edx, ebp
mov ecx, ebp
test edx, edx
jne 0x420938
mov ecx, 0x65
mov eax, edi
xor edx, edx
mov ebp, dword [esp + 0x1c]
div ecx
lea eax, [edx + edx*2]
mov ebx, dword [ebp + eax*4]
test ebx, ebx
jne 0x420980
jmp 0x4209b4
jg 0x4209b4
mov ebx, dword [ebx]
test ebx, ebx
je 0x4209b4
mov dword [esp + 4], esi
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x420978
mov edx, dword [ebx + 0xc]
mov byte [ebx + 8], 1
test edx, edx
je 0x4209b4
mov al, byte [edx]
mov ebx, edx
cmp al, 0x2c
jne 0x4209b0
jmp 0x420a10
mov al, byte [ebx + 1]
inc ebx
cmp al, 0x2c
je 0x420a10
test al, al
jne 0x4209a8
add esp, 0x2c
mov eax, 0x4b6238
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp], 0x4b6230
call fcn.00480440
test eax, eax
je 0x42091a
mov dword [esp], 0x4b6230
mov dword [0x4b6238], 0
call fcn.00480510
mov eax, dword [esp + 0x44]
mov dword [0x4b6238], eax
mov cl, byte [esi]
test cl, cl
jne 0x42092d
lea esi, [esi]
xor edx, edx
jmp 0x420965
mov dword [esp], edx
inc ebx
call sub.msvcrt.dll_atoi
mov dword [esp], ebx
mov word [0x4b6238], ax
call sub.msvcrt.dll_atoi
mov word [0x4b623a], ax
add esp, 0x2c
mov eax, 0x4b6238
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x420b90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov dword [esp + 0x18], ecx
mov ebp, dword [esp + 0x44]
mov cl, byte [esi]
test cl, cl
je 0x420c60
mov ebx, esi
xor edi, edi
mov al, 0x10
mov dword [esp + 0x1c], ebp
nop
inc ebx
mov dl, al
sub edx, ebx
and ecx, 0xff
add edx, esi
add edi, ecx
movsx ebp, byte [ebx]
movsx edx, dl
imul edx, ebp
mov ecx, ebp
test edx, edx
jne 0x420bb8
mov ecx, 0x65
mov eax, edi
xor edx, edx
mov ebp, dword [esp + 0x1c]
div ecx
lea eax, [edx + edx*2]
mov edi, dword [esp + 0x18]
mov ebx, dword [edi + eax*4]
test ebx, ebx
jne 0x420c00
jmp 0x420c1e
jg 0x420c1e
mov ebx, dword [ebx]
test ebx, ebx
je 0x420c1e
mov dword [esp + 4], esi
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x420bf8
mov edx, dword [ebx + 0xc]
mov byte [ebx + 8], 1
test edx, edx
jne 0x420c31
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
inc edx
mov al, byte [edx]
dec eax
cmp al, 0x1f
jbe 0x420c30
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_strtoul
add esp, 0x2c
pop ebx
and eax, 0xff
pop esi
pop edi
pop ebp
ret 0xc
xor edx, edx
jmp 0x420be5
Function at 0x420c70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov cl, byte [esi]
test cl, cl
je 0x420d40
mov ebx, esi
xor edi, edi
mov al, 0x10
mov dword [esp + 0x1c], ebp
lea esi, [esi]
inc ebx
mov dl, al
sub edx, ebx
and ecx, 0xff
add edx, esi
add edi, ecx
movsx ebp, byte [ebx]
movsx edx, dl
imul edx, ebp
mov ecx, ebp
test edx, edx
jne 0x420c98
mov ecx, 0x65
mov eax, edi
xor edx, edx
mov ebp, dword [esp + 0x1c]
div ecx
lea eax, [edx + edx*2]
mov ebx, dword [ebp + eax*4]
test ebx, ebx
jne 0x420ce0
jmp 0x420cfe
jg 0x420cfe
mov ebx, dword [ebx]
test ebx, ebx
je 0x420cfe
mov dword [esp + 4], esi
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x420cd8
mov edx, dword [ebx + 0xc]
mov byte [ebx + 8], 1
test edx, edx
jne 0x420d11
mov eax, dword [esp + 0x44]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 8
inc edx
mov al, byte [edx]
dec eax
cmp al, 0x1f
jbe 0x420d10
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_strtol
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 8
xor edx, edx
jmp 0x420cc5
Function at 0x4216a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
lea edi, [ecx + 0x4bc]
push esi
push ebx
mov ebx, ecx
sub esp, 0x3c
mov dword [esp + 0x2c], ecx
mov esi, dword [esp + 0x50]
jmp 0x4216cb
add ebx, 0xc
cmp ebx, edi
je 0x4217c5
mov ebp, dword [ebx]
test ebp, ebp
je 0x4216c0
mov dword [esp + 0x50], esi
mov esi, ebx
mov ebx, edi
cmp ebx, esi
je 0x4217bd
mov edi, esi
mov dword [esp + 0x28], ebx
cmp byte [ebp + 8], 0
jne 0x421797
mov eax, dword [esp + 0x50]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x4217d0
movsx eax, byte [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4217d0
mov esi, dword [ebp + 4]
mov cl, byte [esi]
test cl, cl
je 0x421806
mov ebx, esi
xor eax, eax
mov dword [esp + 0x24], ebp
inc ebx
mov dl, 0x10
sub edx, ebx
and ecx, 0xff
add edx, esi
add eax, ecx
movsx ebp, byte [ebx]
movsx edx, dl
imul edx, ebp
mov ecx, ebp
test edx, edx
jne 0x421730
mov ecx, 0x65
xor edx, edx
mov ebp, dword [esp + 0x24]
div ecx
lea eax, [edx + edx*2]
mov ecx, dword [esp + 0x2c]
mov ebx, dword [ecx + eax*4]
test ebx, ebx
jne 0x421780
jmp 0x482624
jg 0x482624
mov ebx, dword [ebx]
test ebx, ebx
je 0x421817
mov dword [esp + 4], esi
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x421770
mov byte [ebx + 8], 1
mov ebp, dword [ebp]
test ebp, ebp
jne 0x4216e7
mov esi, edi
mov ebx, dword [esp + 0x28]
jmp 0x4217b6
mov eax, dword [esi]
test eax, eax
jne 0x421810
add esi, 0xc
cmp ebx, esi
jne 0x4217b0
test ebp, ebp
jne 0x4216e1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp + 0x10], ebx
mov eax, dword [ebp + 4]
mov dword [esp + 8], str.Entry___s_s__ignored__check_spelling_
mov dword [esp + 0xc], eax
mov eax, dword [0x486078]
mov dword [esp + 4], eax
mov eax, dword [0x4b61c0]
mov dword [esp], eax
call fcn.00425600
mov esi, dword [ebp + 4]
mov cl, byte [esi]
test cl, cl
jne 0x421728
xor edx, edx
jmp 0x42175b
mov ebp, eax
jmp 0x4216d9
jmp 0x482624
Function at 0x4238c0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x60
mov esi, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
test esi, esi
je 0x423a48
test eax, eax
je 0x4238df
cmp byte [eax], 0
jne 0x423908
mov eax, dword [0x4b61c0]
mov dword [esp + 8], str.Invalid_path
mov dword [esp + 4], str.classify_file__
mov dword [esp], eax
call fcn.004256d0
mov eax, 1
add esp, 0x60
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 0x48a1d4
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov ebx, eax
test eax, eax
je 0x423a70
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
lea edi, [esp + 0x10]
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fread
cmp eax, 8
jne 0x423978
cmp dword [esp + 0x10], 0x474e5089
jne 0x423978
cmp dword [esp + 0x14], 0xa1a0a0d
je 0x423a80
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fread
cmp eax, 2
je 0x423a08
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], edi
call sub.msvcrt.dll_fread
cmp eax, 2
jne 0x423a28
cmp word [esp + 0x10], 0x3650
jne 0x423a28
mov dword [esi], 6
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0x423901
cmp word [esp + 0x10], 0x4d42
jne 0x4239b1
mov dword [esi], 5
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0x423901
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x48], 0
xor eax, eax
jmp 0x423901
mov eax, dword [0x4b61c0]
mov dword [esp + 8], 0x48a194
mov dword [esp + 4], str.classify_file__
mov dword [esp], eax
call fcn.004256d0
jmp 0x4238fc
mov eax, 2
jmp 0x423901
mov dword [esi], 4
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0x423901
Function at 0x43b000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov eax, dword [0x4b850c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x74]
test al, 1
je 0x43b159
test al, 6
jne 0x43b100
cmp edx, 1
je 0x43b070
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0043a1a0
mov eax, dword [esp + 0x1c]
sub eax, dword [0x4b850c]
jne 0x43b169
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], str.invalid
add esp, 0x20
pop ebx
pop esi
pop edi
jmp fcn.0042b9c0
lea esi, [esp + 0x1b]
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00432ff0
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00427190
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0043a1a0
test eax, eax
jne 0x43b0e7
movzx eax, word [ebx + 0x336]
test ax, ax
js 0x43b0e7
test al, 4
jne 0x43b130
movzx eax, byte [esp + 0x1b]
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [ebx + 0x2ec]
mov dword [esp + 4], eax
call fcn.00427d30
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00427cd0
mov eax, dword [esp + 0x1c]
sub eax, dword [0x4b850c]
jne 0x43b169
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0043a1a0
mov eax, dword [esp + 0x1c]
sub eax, dword [0x4b850c]
jne 0x43b169
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], str.out_of_place
add esp, 0x20
pop ebx
pop esi
pop edi
jmp fcn.0042b9c0
or ax, 0x8000
mov word [ebx + 0x336], ax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00427cd0
mov dword [esp + 4], str.too_many_profiles
mov dword [esp], ebx
call fcn.0042b9c0
jmp 0x43b0e7
mov dword [esp + 4], str.missing_IHDR
mov dword [esp], ebx
call fcn.0042b970
call fcn.00464ba0
nop
Function at 0x43cfd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov eax, dword [0x4b850c]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0x2a8]
test eax, eax
je 0x43d011
cmp eax, 1
je 0x43d128
sub eax, 1
mov dword [ebx + 0x2a8], eax
cmp eax, 1
je 0x43d150
mov eax, dword [ebx + 0x74]
test al, 1
je 0x43d1a4
test al, 4
jne 0x43d100
lea edx, [ebp + 1]
mov ecx, 1
mov eax, ebx
call fcn.004398e0
mov esi, eax
test eax, eax
je 0x43d180
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
mov dword [esp], ebx
call fcn.00432ff0
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00427190
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0043a1a0
test eax, eax
jne 0x43d0e5
add ebp, esi
mov eax, esi
mov byte [ebp], 0
cmp byte [esi], 0
je 0x43d088
nop
add eax, 1
cmp byte [eax], 0
jne 0x43d080
xor edx, edx
cmp ebp, eax
mov dword [esp + 0x10], 0xffffffff
setne dl
mov dword [esp + 0x14], esi
add eax, edx
mov dword [esp + 0x24], 0
mov dword [esp], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00441030
test eax, eax
jne 0x43d110
mov eax, dword [esp + 0x2c]
sub eax, dword [0x4b850c]
jne 0x43d1b4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
or eax, 8
mov dword [ebx + 0x74], eax
jmp 0x43d024
mov dword [esp + 4], str.Insufficient_memory_to_process_text_chunk
mov dword [esp], ebx
call fcn.0042b170
jmp 0x43d0e5
mov eax, dword [esp + 0x2c]
sub eax, dword [0x4b850c]
jne 0x43d1b4
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0043a1a0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.0043a1a0
mov eax, dword [esp + 0x2c]
sub eax, dword [0x4b850c]
jne 0x43d1b4
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], str.no_space_in_chunk_cache
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0042b9c0
mov eax, dword [esp + 0x2c]
sub eax, dword [0x4b850c]
jne 0x43d1b4
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], str.out_of_memory
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0042b9c0
mov dword [esp + 4], str.missing_IHDR
mov dword [esp], ebx
call fcn.0042b970
call fcn.00464ba0
lea esi, [esi]
Function at 0x447e80
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [0x4b850c]
mov dword [esp + 0x2c], ebx
xor ebx, ebx
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
test byte [esp + 0x58], 2
je 0x447f00
cmp dword [esp + 0x58], 3
mov esi, 8
je 0x447eb5
movzx esi, byte [eax + 0x151]
movzx edi, byte [edx]
mov ecx, esi
lea ebx, [edi - 1]
cmp bl, cl
jae 0x447ed8
movzx ecx, byte [edx + 1]
movzx edi, word [edx]
lea ebx, [ecx - 1]
mov ecx, esi
cmp bl, cl
jb 0x447f50
lea esi, [esi]
mov dword [esp + 4], str.Invalid_sBIT_depth_specified
mov dword [esp], eax
call fcn.0042b170
mov eax, dword [esp + 0x2c]
sub eax, dword [0x4b850c]
jne 0x447f7c
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [edx + 3]
test bl, bl
je 0x447ed8
cmp byte [eax + 0x151], bl
jb 0x447ed8
mov byte [esp + 0x28], bl
mov ebx, 1
test byte [esp + 0x58], 4
je 0x447f37
movzx edx, byte [edx + 4]
test dl, dl
je 0x447ed8
cmp byte [eax + 0x151], dl
jb 0x447ed8
mov byte [esp + ebx + 0x28], dl
add ebx, 1
mov dword [esp], ebx
lea ecx, [esp + 0x28]
mov edx, 0x73424954
call fcn.00447030
jmp 0x447ee8
movzx ecx, byte [edx + 2]
mov ebx, esi
lea ebp, [ecx - 1]
mov byte [esp + 0x1f], cl
mov ecx, ebp
cmp cl, bl
jae 0x447ed8
movzx ecx, byte [esp + 0x1f]
mov word [esp + 0x28], di
mov ebx, 3
mov byte [esp + 0x2a], cl
jmp 0x447f19
call fcn.00464ba0
lea esi, cs:[esi]
lea esi, [esi]

Function at 0x447f90
Capabilities:
Enumerate pe sections

Disassembly:
push edi
push esi
push ebx
sub esp, 0x40
mov ebx, dword [esp + 0x54]
lea esi, [esp + 0x1c]
mov edi, dword [esp + 0x50]
mov eax, dword [0x4b850c]
mov dword [esp + 0x3c], eax
mov eax, dword [ebx + 0x18]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004276d0
mov eax, dword [ebx + 0x1c]
mov dword [esp + 4], eax
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.004276d0
mov eax, dword [ebx]
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.004276d0
mov eax, dword [ebx + 4]
mov dword [esp + 4], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.004276d0
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.004276d0
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.004276d0
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.004276d0
mov eax, dword [ebx + 0x14]
mov dword [esp + 4], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.004276d0
mov dword [esp], 0x20
mov eax, edi
mov ecx, esi
mov edx, 0x6348524d
call fcn.00447030
mov eax, dword [esp + 0x3c]
sub eax, dword [0x4b850c]
jne 0x448066
add esp, 0x40
pop ebx
pop esi
pop edi
ret
call fcn.00464ba0
lea esi, cs:[esi]