joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415430
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get process heap flags
Get process heap force flags
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52f5ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
lea ebx, [esi + 0x10]
lea ecx, [esi + 0x12c]
mov word [ebx], 1
mov word [ebx + 2], 1
mov dword [ebx + 4], 1
mov dword [esi + 0x28], edi
call fcn.004152c0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x140], eax
mov dword [esi + 0x144], ecx
mov dword [esi + 0x148], edi
mov dword [esi + 0x14c], edi
mov eax, dword [0x659a18]
push edi
push edx
push eax
mov dword [esp + 0x34], edi
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push esi
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 4]
push edx
push 1
push 4
push eax
call edi
mov ecx, dword [0x659a18]
lea edx, [esi + 8]
push ecx
push 1
push 2
push edx
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 0xa]
push eax
push 1
push 2
push ecx
call edi
mov edx, dword [0x659a18]
add esp, 0x4c
lea eax, [esi + 0xc]
push edx
push 1
push 4
push eax
call edi
mov ecx, dword [0x659a18]
push ecx
push 1
push 8
push ebx
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 0x18]
push edx
push 1
push 4
push eax
call edi
mov ecx, dword [0x659a18]
lea ebx, [esi + 0x1c]
push ecx
push 1
push 0xc
push ebx
call edi
mov edx, dword [0x659a18]
add esp, 0x40
lea eax, [esp + 0x10]
push edx
push 1
push 0x10
push eax
call edi
mov ecx, dword [0x659a18]
lea eax, [esi + 0x2c]
push ecx
push 1
push pe_nt_image_headers32
push eax
call edi
mov edx, dword [esi]
add esp, 0x20
and edx, 7
cmp dl, 3
jne 0x41558f
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x41558a
lea ecx, [esp + 0x10]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x41558c
xor eax, eax
mov dword [esi + 0x28], eax
mov edi, 3
cmp dword [ebx], 0
je 0x4155b9
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x4155b5
mov edx, dword [ebx]
push 0
push edx
mov ecx, eax
call fcn.004bac90
jmp 0x4155b7
xor eax, eax
mov dword [ebx], eax
add ebx, 4
dec edi
jne 0x415594
lea edi, [esi + 0x2c]
mov ebx, 0x40
cmp dword [edi], 0
je 0x4155ec
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x4155e8
mov ecx, dword [edi]
push 0
push ecx
mov ecx, eax
call fcn.004bac90
jmp 0x4155ea
xor eax, eax
mov dword [edi], eax
add edi, 4
dec ebx
jne 0x4155c7
push pe_nt_image_headers32
mov ecx, esi
call fcn.004164d0
push eax
lea ecx, [esi + 0x12c]
call fcn.00415310
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x416650
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [esp + 0x3c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
push edi
push eax
mov dword [esi + 4], edi
mov dword [esi + 0x438], edi
mov dword [esi + 0x43c], edi
mov dword [esi + 0x440], edi
mov dword [esi + 0x464], edi
mov dword [esi + 0x468], edi
mov ecx, dword [0x659a18]
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call ebx
mov eax, dword [0x659a18]
lea ecx, [esp + 0x34]
push eax
push 1
push 0x10
push ecx
call ebx
push 0x24
call fcn.00470250
add esp, 0x30
cmp eax, edi
je 0x4166d2
lea edx, [esp + 0x18]
push 1
push edx
mov ecx, eax
call fcn.00489020
jmp 0x4166d4
xor eax, eax
mov dword [esi + 4], eax
mov eax, dword [0x659a18]
push eax
push 1
lea ecx, [esi + 8]
push 0x20
push ecx
call ebx
mov edx, dword [0x659a18]
lea eax, [esi + 0x28]
push edx
push 1
push 0x400
push eax
call ebx
mov ecx, dword [0x659a18]
lea ebp, [esi + 0x428]
push ecx
push 1
push 0x10
push ebp
call ebx
mov edx, dword [0x659a18]
lea eax, [esp + 0x68]
push edx
push 1
push 0x10
push eax
call ebx
mov ecx, dword [0x659a18]
add esp, 0x40
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
push ecx
push 1
push 8
push edx
mov dword [esp + 0x24], edi
call ebx
mov eax, dword [0x659a7c]
mov ecx, dword [esi]
add esp, 0x10
test eax, ecx
je 0x4167ae
mov ecx, dword [0x659a18]
lea edx, [esi + 0x444]
push ecx
push 1
push 0x20
push edx
call ebx
mov eax, dword [0x659a18]
lea ecx, [esp + 0x38]
push eax
push 1
push 0x10
push ecx
call ebx
mov edx, dword [0x659a80]
mov eax, dword [esi]
add esp, 0x20
test edx, eax
je 0x4167bf
push 0x24
call fcn.00470250
add esp, 4
cmp eax, edi
je 0x4167a4
lea ecx, [esp + 0x28]
push 1
push ecx
mov ecx, eax
call fcn.00489020
mov dword [esi + 0x464], eax
jmp 0x4167bf
xor eax, eax
mov dword [esi + 0x464], eax
jmp 0x4167bf
mov ecx, 8
xor eax, eax
lea edi, [esi + 0x444]
rep stosd dword es:[edi], eax
xor edi, edi
mov eax, dword [esi]
mov ecx, dword [0x659a68]
test eax, ecx
je 0x416872
test dword [0x659a6c], eax
je 0x41680b
xor edx, edx
push 0x24
mov dword [ebp], edx
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edx
call fcn.00470250
add esp, 4
cmp eax, edi
je 0x416803
lea ecx, [esp + 0x38]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x416805
xor eax, eax
mov dword [esi + 0x438], eax
mov edx, dword [0x659a70]
mov eax, dword [esi]
test edx, eax
je 0x416880
mov eax, dword [esp + 0x10]
cmp eax, edi
jle 0x416880
cmp dword [esp + 0x14], edi
je 0x416880
push eax
mov dword [esi + 0x43c], eax
call fcn.00470b90
mov dword [esi + 0x440], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [0x659a18]
push edi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov eax, dword [esi + 0x43c]
mov ecx, dword [esi + 0x440]
push edx
push eax
push 1
push ecx
call ebx
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4
xor edx, edx
mov dword [ebp], edx
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4
Function at 0x416ec0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
xor eax, eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
cmp ebx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
je 0x416f04
push eax
mov eax, dword [0x659a18]
push ebx
push eax
call esi
mov ecx, dword [0x659a18]
lea edx, [esp + 0x1c]
push ecx
push 1
push 4
push edx
call edi
add esp, 0x1c
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x416f2c
mov eax, dword [0x659a18]
push 0
push ebp
push eax
call esi
mov ecx, dword [0x659a18]
lea edx, [esp + 0x20]
push ecx
push 1
push 4
push edx
call edi
add esp, 0x1c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [0x5c4870], eax
add eax, ecx
test eax, eax
mov dword [0x5c486c], eax
jle 0x417083
lea edx, [eax*4]
mov ecx, 0x6af5d8
push edx
call fcn.004a7db0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x416f8c
mov eax, dword [0x659a18]
add ebx, 4
push 0
push ebx
push eax
call esi
mov ecx, dword [0x659a18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push ecx
push edx
push 4
push eax
call edi
add esp, 0x1c
mov eax, dword [esp + 0x14]
test eax, eax
jle 0x416fc2
mov ecx, dword [0x659a18]
add ebp, 4
push 0
push ebp
push ecx
call esi
mov edx, dword [0x659a18]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push 4
lea eax, [edx + ecx*4]
push eax
call edi
add esp, 0x1c
mov esi, dword [0x5c486c]
mov ecx, esi
shl ecx, 5
sub ecx, esi
lea edx, [ecx*4 + 4]
push edx
call fcn.00470280
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x417005
push fcn.004182e0
push fcn.00416cc0
lea edi, [eax + 4]
push esi
push 0x7c
push edi
mov dword [eax], esi
call fcn.0051c73f
mov dword [0x5c4868], edi
jmp 0x41700b
mov dword [0x5c4868], ebx
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
xor esi, esi
cmp eax, ebx
jle 0x41703e
mov edi, ebp
mov eax, dword [edi]
mov ecx, dword [0x5c4868]
push 0
push 0
push eax
add ecx, ebx
call fcn.004170f0
mov eax, dword [esp + 0x10]
inc esi
add edi, 4
add ebx, 0x7c
cmp esi, eax
jl 0x41701b
cmp esi, dword [0x5c486c]
jge 0x417078
mov edi, esi
lea ebx, [ebp + esi*4]
shl edi, 5
sub edi, esi
shl edi, 2
mov eax, dword [0x5c4868]
mov edx, dword [ebx]
push 0
push 1
push edx
lea ecx, [edi + eax]
call fcn.004170f0
mov eax, dword [0x5c486c]
inc esi
add ebx, 4
add edi, 0x7c
cmp esi, eax
jl 0x417054
push ebp
mov ecx, 0x6af5d8
call fcn.004a7de0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x418870
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 0
mov ecx, dword [0x659a18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
push edx
push 1
push 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 8]
add esp, 0x1c
test eax, eax
je 0x4188ca
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x4188c5
mov ecx, dword [esi + 8]
push 0
push ecx
mov ecx, eax
call fcn.004bac90
mov dword [esi + 8], eax
pop esi
ret 4
xor eax, eax
mov dword [esi + 8], eax
pop esi
ret 4

Function at 0x4188f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, ecx
push 0
mov ecx, dword [0x659a18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push edi
call ebx
mov eax, dword [0x659a18]
lea esi, [edi + 4]
push eax
push 1
push 4
push esi
call ebx
mov eax, dword [esi]
add esp, 0x2c
test eax, eax
je 0x418966
push 0x90
call fcn.00470250
add esp, 4
test eax, eax
je 0x418962
mov ecx, dword [edi]
mov edx, dword [esi]
and ecx, 0xff
push ecx
push edx
mov ecx, eax
call fcn.0048ceb0
mov dword [esi], eax
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
mov dword [esi], eax
pop edi
pop esi
pop ebx
ret 4

Function at 0x418af0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x659a18]
push edi
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 4]
push eax
push 1
push 4
push ecx
call edi
mov edx, dword [0x659a18]
lea ebx, [esi + 8]
push edx
push 1
push 0x10
push ebx
call edi
mov eax, dword [0x659a34]
mov ecx, dword [esi]
add esp, 0x3c
test eax, ecx
je 0x418b72
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x418b6d
push 1
push ebx
mov ecx, eax
call fcn.00489020
mov dword [esi + 0x18], eax
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
mov dword [esi + 0x18], eax
pop edi
pop esi
pop ebx
ret 4

Function at 0x419550
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 0
mov ecx, dword [0x659a18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
push edx
push 1
push 8
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
mov eax, esi
pop esi
ret 4
Function at 0x419590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x52f6be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi + 4], 1
mov dword [esp + 8], esi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi], 0x532af8
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
mov dword [esi + 0x30], edi
call fcn.00418ac0
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.004399d0
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
mov dword [esi + 0x6c], edi
call fcn.004399d0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi], 0x532b5c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41a0c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x659a18]
push edi
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call ebx
mov eax, dword [esi]
shl eax, 2
push eax
call fcn.00470b90
mov ecx, dword [esi]
mov edi, eax
shl ecx, 2
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 4], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x659a18]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push eax
push ecx
push 4
push edx
call ebx
mov eax, dword [esi]
add esp, 0x30
xor edi, edi
test eax, eax
jle 0x41a16d
mov eax, dword [esi + 4]
mov ebx, dword [eax + edi*4]
test ebx, ebx
je 0x41a166
push 0xb0
call fcn.00470250
add esp, 4
test eax, eax
je 0x41a152
mov ecx, eax
call fcn.00419590
jmp 0x41a154
xor eax, eax
mov ecx, dword [esi + 4]
push ebx
mov dword [ecx + edi*4], eax
mov edx, dword [esi + 4]
mov ecx, dword [edx + edi*4]
call fcn.004197b0
mov eax, dword [esi]
inc edi
cmp edi, eax
jl 0x41a12e
pop edi
pop esi
pop ebx
ret 4

Function at 0x41a190
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, dword [0x659a18]
push edi
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 4]
push eax
push 1
push 4
push ecx
call edi
mov edx, dword [0x659a18]
lea eax, [esp + 0x34]
push edx
push 1
push 0x10
push eax
call edi
mov ecx, dword [0x659a54]
mov eax, dword [esi]
add esp, 0x3c
test ecx, eax
je 0x41a21c
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x41a217
lea edx, [esp + 8]
push 1
push edx
mov ecx, eax
call fcn.00489020
mov dword [esi + 8], eax
pop edi
pop esi
add esp, 0x10
ret 4
xor eax, eax
mov dword [esi + 8], eax
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x41ad60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ecx, dword [0x659a18]
xor edi, edi
push edi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push ebx
call esi
mov eax, dword [0x659a18]
lea ecx, [esp + 0x2c]
push eax
push 1
push 8
push ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call esi
mov edx, dword [0x659a18]
lea eax, [esp + 0x44]
push edx
push 1
push 0x10
push eax
call esi
add esp, 0x3c
lea esi, [esp + 0x10]
lea edi, [ebx + 4]
mov ebp, 2
cmp dword [esi], 0
je 0x41adf6
push 0x48
call fcn.00470250
add esp, 4
test eax, eax
je 0x41ade8
mov ecx, eax
call fcn.0041a680
jmp 0x41adea
xor eax, eax
mov ecx, dword [esi]
mov dword [edi], eax
push ecx
mov ecx, eax
call fcn.0041a6f0
add edi, 4
add esi, 4
dec ebp
jne 0x41adcc
test byte [ebx], 1
je 0x41ae32
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x41ae2d
lea edx, [esp + 0x18]
push 1
push edx
mov ecx, eax
call fcn.00489020
pop edi
pop esi
mov dword [ebx + 0xc], eax
pop ebp
pop ebx
add esp, 0x18
ret 4
xor eax, eax
mov dword [ebx + 0xc], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x41b1a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x659a18]
push edi
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call ebx
mov eax, dword [esi]
shl eax, 2
push eax
call fcn.00470b90
mov ecx, dword [esi]
mov edi, eax
shl ecx, 2
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 4], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x659a18]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
push eax
push ecx
push 4
push edx
call ebx
mov eax, dword [esi]
add esp, 0x30
xor edi, edi
test eax, eax
jle 0x41b24a
mov eax, dword [esi + 4]
mov ebx, dword [eax + edi*4]
test ebx, ebx
je 0x41b243
push 0x20
call fcn.00470250
add esp, 4
test eax, eax
je 0x41b22f
mov ecx, eax
call fcn.0041ad30
jmp 0x41b231
xor eax, eax
mov ecx, dword [esi + 4]
push ebx
mov dword [ecx + edi*4], eax
mov edx, dword [esi + 4]
mov ecx, dword [edx + edi*4]
call fcn.0041ad60
mov eax, dword [esi]
inc edi
cmp edi, eax
jl 0x41b20e
pop edi
pop esi
pop ebx
ret 4
Function at 0x41b920
Capabilities:
Access peb ldr_data
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52f7d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call fcn.004caa70
or ebp, 0xffffffff
mov dword [esi + 4], edi
mov dword [esi + 8], 1
mov dword [esi + 0xc], edi
add esp, 4
mov word [esi + 0x12], di
mov word [esi + 0x10], di
mov word [esi + 0x16], bp
mov word [esi + 0x14], bp
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], eax
call fcn.004a81e0
mov word [esi + 0x36], di
mov word [esi + 0x34], di
mov word [esi + 0x3a], bp
mov word [esi + 0x38], bp
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], 0xffff
mov dword [esi + 0x48], edi
mov word [esi + 0x4c], di
mov word [esi + 0x4e], di
mov dword [esi], 0x532c4c
lea eax, [esi + 0x50]
push 0x41b8f0
push 0x41b8d0
push 2
mov dword [eax], eax
mov dword [eax + 4], eax
lea eax, [esi + 0x5c]
push 0x14
push eax
mov dword [esp + 0x40], edi
mov dword [esi + 0x58], edi
call fcn.0051c73f
push fcn.0041b4c0
push 0x41b900
push 2
lea ecx, [esi + 0x84]
push 0x14
push ecx
mov byte [esp + 0x40], 1
call fcn.0051c73f
lea ecx, [esi + 0xac]
push ecx
mov eax, esp
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [eax], edi
call fcn.0041b430
mov ebx, dword [esp + 0x34]
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi], 0x532b74
mov edx, dword [0x659a18]
push edi
push ebx
push edx
mov byte [esp + 0x38], 3
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [0x659a18]
mov word [esp + 0x22], di
push eax
push 1
mov word [esp + 0x28], di
mov word [esp + 0x2e], bp
mov word [esp + 0x2c], bp
push 8
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
movsx ecx, word [esi + 0x16]
movsx edx, word [esi + 0x12]
movsx eax, word [esi + 0x14]
sub ecx, edx
add esp, 0x1c
inc ecx
push ecx
movsx ecx, word [esi + 0x10]
sub eax, ecx
lea ecx, [esp + 0x20]
inc eax
push eax
push edi
push edi
call fcn.004b4a60
mov edx, dword [eax]
pop edi
mov dword [esi + 0x34], edx
mov eax, dword [eax + 4]
mov dword [esi + 0x38], eax
mov cx, word [esi + 0x10]
mov dx, word [esi + 0x12]
mov word [esp + 0x30], cx
mov word [esp + 0x32], dx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 8]
mov dword [esi + 4], ebx
and ah, 0xfc
mov dword [esi + 8], eax
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 4
Function at 0x41cdf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x52f8c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, dword [esp + 0x54]
lea edx, [esp + 0xc]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x18]
mov dword [esp + 0x10], ecx
push edi
movsx ecx, word [eax + 0x12]
movsx eax, word [eax + 0x10]
add word [esp + 0x10], ax
add word [esp + 0x14], ax
add word [esp + 0x12], cx
add word [esp + 0x16], cx
lea eax, [esp + 0x20]
push edx
push eax
lea ecx, [esp + 0x30]
push 0
push ecx
mov ecx, ebx
call fcn.004a8cf0
mov ecx, eax
call fcn.004b4d00
mov ebp, dword [eax]
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], ebp
lea edi, [esi + 0x1c]
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
call fcn.004a81e0
mov eax, dword [0x8d7270]
mov dword [esp + 0x50], 0
test eax, 0x10000
je 0x41cebc
push edi
lea ecx, [esp + 0x34]
call fcn.004a82a0
test dword [esp + 0x5c], 0x20000
je 0x41ceaf
push 0xff
lea ecx, [esp + 0x34]
call fcn.004a8a00
jmp 0x41ceb8
lea ecx, [esp + 0x30]
call fcn.004a8ac0
lea edi, [esp + 0x30]
movsx eax, word [esp + 0x1a]
movsx esi, word [esp + 0x12]
movsx ecx, bp
movsx ebp, word [esp + 0x10]
mov word [esp + 0x58], cx
mov word [esp + 0x5a], ax
mov edx, dword [esp + 0x58]
push 0
mov dword [esp + 0x60], edx
push 1
movsx edx, ax
movsx esi, si
sub edx, esi
movsx esi, cx
movsx ebp, bp
sub esi, ebp
mov word [esp + 0x62], dx
mov word [esp + 0x60], si
mov edx, dword [esp + 0x60]
mov dword [esp + 0x60], edx
movsx edx, word [esp + 0x26]
sub edx, eax
movsx eax, word [esp + 0x24]
sub eax, ecx
inc edx
inc eax
push edx
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0x68]
push ecx
push edx
push ebx
push edi
call fcn.00474b30
add esp, 0x20
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], 0xffffffff
call fcn.004a8ce0
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 8
Function at 0x41df00
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52f988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.0041d850
xor eax, eax
mov dword [esi], 0x532dcc
mov dword [esi + 0x204], eax
mov ecx, dword [0x659a18]
push ecx
push 1
lea edx, [esi + 0x1fc]
push 8
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 0x200]
add esp, 0x10
cmp eax, 1
jge 0x41df69
mov dword [esi + 0x200], 1
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, esi
push eax
call fcn.0043b300
mov ecx, dword [esi + 8]
mov eax, esi
and ch, 0xfd
or ch, 1
mov dword [esi + 8], ecx
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x41ea50
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52f9e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.0041d850
lea edi, [esi + 0x1fc]
xor eax, eax
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
lea edx, [esp + 0x20]
mov dword [edi], eax
mov dword [esi + 0x204], eax
mov dword [esi + 0x208], eax
mov dword [esi], 0x532f9c
mov ecx, dword [0x659a18]
mov dword [esp + 0x18], eax
push ecx
push 1
push 2
push edx
mov dword [esp + 0x30], eax
call ebx
mov eax, dword [0x659a18]
push eax
push 1
push 2
push edi
call ebx
mov eax, dword [edi]
add esp, 0x20
cmp eax, 2
je 0x41ead6
mov eax, dword [esi + 0xc4]
and dword [eax + 0x20], 0xfffffffe
mov ecx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_ftell]
push ecx
call ebx
add esp, 4
mov ecx, esi
push eax
call fcn.0043aef0
mov edx, dword [0x659a18]
push edx
call ebx
add esp, 4
mov ecx, esi
push eax
call fcn.0043b340
mov eax, dword [edi]
add eax, 0xfffffffc
cmp eax, 0xb
ja case.default.0x41eb0e
jmp dword [eax*4 + 0x41ebec]
mov eax, 0x102
jmp 0x41eb3d
mov eax, 0x106
jmp 0x41eb3d
mov eax, 0x105
jmp 0x41eb3d
mov eax, 0x103
jmp 0x41eb3d
mov eax, 0xc9
jmp 0x41eb3d
mov eax, 0xcb
push eax
mov eax, dword [esi + 0x18]
push 1
push esi
push eax
call fcn.004757a0
add esp, 0x10
mov eax, dword [esi + 8]
test ah, 3
jne 0x41eb5b
or ah, 3
mov dword [esi + 8], eax
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xe9
jl 0x41eb81
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xea
jle 0x41ebbe
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x102
je 0x41ebbe
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x115
je 0x41ebbe
push 1
push 0x2392
call fcn.00487160
mov ecx, eax
call fcn.00483920
test eax, eax
je 0x41ebd3
mov edi, dword [edi]
cmp edi, 4
jl 0x41ebca
cmp edi, 0xf
jle 0x41ebd3
mov eax, dword [esi + 8]
or ah, 8
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4