joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47fec5
Capabilities:
Hash data using sha256

Disassembly:
push esi
push 0x70
mov esi, ecx
push 0
push esi
call fcn.005091d0
add esp, 0xc
mov dword [esi], 0x6a09e667
xor eax, eax
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
inc eax
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
ret

Function at 0x489309
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52d9c5
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
push edi
mov eax, dword [0x5c2460]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x34]
call fcn.00486531
lea eax, [esp + 0x34]
mov dword [esp + 0x58], eax
xor esi, esi
mov ecx, eax
mov dword [esp + 0x68], esi
call fcn.004865c7
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x486624
mov dword [esp + 0x1c], 0x4866a0
mov dword [esp + 0x20], 0x4866bd
mov dword [esp + 0x24], 0x4866d4
mov dword [esp + 0x28], 0x48679d
mov dword [esp + 0x2c], 0x4867c6
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.004bfc7f
mov esi, eax
pop ecx
test esi, esi
js 0x4893d5
cmp dword [esp + 0x3c], 0
jne 0x4893be
mov esi, 0x80004005
jmp 0x4893d5
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push dword [esp + 0x4c]
call fcn.0048915d
mov esi, eax
or dword [esp + 0x68], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.00486587
mov eax, esi
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4b09a6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
lea esi, [edi - 8]
lea ecx, [esi + 4]
test esi, esi
jne 0x4b09bd
mov ecx, ebx
mov eax, dword [ecx]
push 0x9c4
push ecx
call dword [eax + 0x54]
cmp eax, 2
je 0x4b0a97
mov eax, dword [ebp + 0xc]
push 0x4b9
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
cmp eax, 0x20
jne 0x4b0a97
mov eax, dword [edi + 0x14c]
test al, 1
je 0x4b0a97
and eax, 0xfffffffe
push 1
mov dword [edi + 0x14c], eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x4b0a67
test byte [edi + 0x14c], 2
je 0x4b0a33
lea ecx, [esi + 4]
test esi, esi
jne 0x4b0a20
mov ecx, ebx
mov eax, dword [ecx]
push 0x9c4
push ecx
call dword [eax + 0x54]
mov byte [ebp + 0xb], 1
test eax, eax
je 0x4b0a36
mov byte [ebp + 0xb], bl
test esi, esi
je 0x4b0a3d
lea ebx, [esi + 4]
mov eax, dword [ebx]
push 0x417
push ebx
call dword [eax + 0x68]
test al, al
je 0x4b0a58
lea eax, [edi - 4]
mov edx, dword [eax]
push eax
call dword [edx + 0xe4]
cmp byte [ebp + 0xb], 0
je 0x4b0a84
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
jmp 0x4b0a84
test esi, esi
je 0x4b0a6e
lea ebx, [esi + 4]
mov eax, dword [ebx]
push 0x417
push ebx
call dword [eax + 0x68]
test al, al
je 0x4b0a84
mov ecx, esi
call fcn.004b4fa1
mov eax, dword [ebp + 0xc]
push 1
push 0x480
push eax
mov ecx, dword [eax]
call dword [ecx + 0x8c]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4b0be4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
lea esi, [ebx - 8]
lea ecx, [esi + 4]
test esi, esi
jne 0x4b0bfb
mov ecx, edi
mov eax, dword [ecx]
push 0x9c4
push ecx
call dword [eax + 0x54]
cmp eax, 2
je 0x4b0cb7
mov eax, dword [ebp + 0xc]
push 1
push 0x480
push eax
mov ecx, dword [eax]
call dword [ecx + 0x8c]
add ebx, 0xfffffffc
push ebx
mov eax, dword [ebx]
call dword [eax + 0xe8]
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4b0c99
mov eax, dword [ebx]
push ebx
call dword [eax + 0xe0]
lea ecx, [esi + 4]
test esi, esi
jne 0x4b0c4f
mov ecx, edi
mov eax, dword [ecx]
push 0x417
push ecx
call dword [eax + 0x68]
test al, al
je 0x4b0c99
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4b0c90
mov eax, dword [ebp + 8]
test byte [eax + 0x14c], 2
jne 0x4b0c99
test dword [esi + 0x154], 2
jne 0x4b0c99
push 1
mov ecx, esi
call fcn.004b501f
jmp 0x4b0c99
mov eax, dword [ebx]
push ebx
call dword [eax + 0xe4]
test esi, esi
je 0x4b0ca0
lea edi, [esi + 4]
mov eax, dword [edi]
push 0x9c4
push edi
call dword [eax + 0x54]
cmp eax, 1
jne 0x4b0cb7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4b0d7b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
lea esi, [ebx - 8]
lea ecx, [esi + 4]
test esi, esi
jne 0x4b0d92
mov ecx, edi
mov eax, dword [ecx]
push 0x9c4
push ecx
call dword [eax + 0x54]
cmp eax, 2
je 0x4b0dea
test esi, esi
je 0x4b0da9
lea edi, [esi + 4]
mov eax, dword [edi]
push 0x417
push edi
call dword [eax + 0x68]
test al, al
je 0x4b0dea
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4b0dea
test byte [ebx + 0x14c], 1
jne 0x4b0dea
mov ecx, esi
call fcn.004b4fa1
mov eax, dword [ebp + 0xc]
push 1
push 0x480
push eax
mov ecx, dword [eax]
call dword [ecx + 0x8c]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4b14ca
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
lea esi, [edi - 8]
lea ecx, [esi + 4]
test esi, esi
jne 0x4b14e1
mov ecx, ebx
mov eax, dword [ecx]
push 0x9c4
push ecx
call dword [eax + 0x54]
cmp eax, 2
je 0x4b15bb
mov eax, dword [ebp + 0xc]
push 0x4b9
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
cmp eax, 0x20
jne 0x4b15bb
mov eax, dword [edi + 0x14c]
test al, 1
je 0x4b15bb
and eax, 0xfffffffe
push 1
mov dword [edi + 0x14c], eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x4b158b
test byte [edi + 0x14c], 2
je 0x4b1557
lea ecx, [esi + 4]
test esi, esi
jne 0x4b1544
mov ecx, ebx
mov eax, dword [ecx]
push 0x9c4
push ecx
call dword [eax + 0x54]
mov byte [ebp + 0xb], 1
test eax, eax
je 0x4b155a
mov byte [ebp + 0xb], bl
test esi, esi
je 0x4b1561
lea ebx, [esi + 4]
mov eax, dword [ebx]
push 0x417
push ebx
call dword [eax + 0x68]
test al, al
je 0x4b157c
lea eax, [edi - 4]
mov edx, dword [eax]
push eax
call dword [edx + 0xe4]
cmp byte [ebp + 0xb], 0
je 0x4b15a8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
jmp 0x4b15a8
test esi, esi
je 0x4b1592
lea ebx, [esi + 4]
mov eax, dword [ebx]
push 0x417
push ebx
call dword [eax + 0x68]
test al, al
je 0x4b15a8
mov ecx, esi
call fcn.004b50bb
mov eax, dword [ebp + 0xc]
push 1
push 0x480
push eax
mov ecx, dword [eax]
call dword [ecx + 0x8c]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4b1708
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
lea esi, [ebx - 8]
lea ecx, [esi + 4]
test esi, esi
jne 0x4b171f
mov ecx, edi
mov eax, dword [ecx]
push 0x9c4
push ecx
call dword [eax + 0x54]
cmp eax, 2
je 0x4b17db
mov eax, dword [ebp + 0xc]
push 1
push 0x480
push eax
mov ecx, dword [eax]
call dword [ecx + 0x8c]
add ebx, 0xfffffffc
push ebx
mov eax, dword [ebx]
call dword [eax + 0xe8]
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4b17bd
mov eax, dword [ebx]
push ebx
call dword [eax + 0xe0]
lea ecx, [esi + 4]
test esi, esi
jne 0x4b1773
mov ecx, edi
mov eax, dword [ecx]
push 0x417
push ecx
call dword [eax + 0x68]
test al, al
je 0x4b17bd
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4b17b4
mov eax, dword [ebp + 8]
test byte [eax + 0x14c], 2
jne 0x4b17bd
test dword [esi + 0x154], 2
jne 0x4b17bd
push 1
mov ecx, esi
call fcn.004b1177
jmp 0x4b17bd
mov eax, dword [ebx]
push ebx
call dword [eax + 0xe4]
test esi, esi
je 0x4b17c4
lea edi, [esi + 4]
mov eax, dword [edi]
push 0x9c4
push edi
call dword [eax + 0x54]
cmp eax, 1
jne 0x4b17db
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4b17e2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
lea esi, [ebx - 8]
lea ecx, [esi + 4]
test esi, esi
jne 0x4b17f9
mov ecx, edi
mov eax, dword [ecx]
push 0x9c4
push ecx
call dword [eax + 0x54]
cmp eax, 2
je 0x4b1851
test esi, esi
je 0x4b1810
lea edi, [esi + 4]
mov eax, dword [edi]
push 0x417
push edi
call dword [eax + 0x68]
test al, al
je 0x4b1851
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4b1851
test byte [ebx + 0x14c], 1
jne 0x4b1851
mov ecx, esi
call fcn.004b50bb
mov eax, dword [ebp + 0xc]
push 1
push 0x480
push eax
mov ecx, dword [eax]
call dword [ecx + 0x8c]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4c981c
Capabilities:
Check os version

Disassembly:
push pe_nt_image_headers32
mov eax, 0x533ce0
call fcn.00511c9a
mov ecx, dword [0x5c8b80]
cmp ecx, 0xffffffff
jne 0x4c98d9
mov esi, dword [0x5d6fd8]
xor ebx, ebx
add esi, 0x10
mov byte [ebp - 0x128], bl
mov dword [ebp - 0x12c], esi
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x5c8b80], 0xffffffff
mov byte [ebp - 0x128], 1
jne 0x4c98b7
push 0x110
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], 0x114
push ebx
push eax
call fcn.005091d0
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4c98a9
cmp dword [ebp - 0x120], 6
jb 0x4c98a9
xor ecx, ecx
inc ecx
jmp 0x4c98ab
mov ecx, ebx
xor eax, eax
test cl, cl
setne al
mov dword [0x5c8b80], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
mov byte [ebp - 0x128], bl
call fcn.00429972
mov ecx, dword [0x5c8b80]
xor eax, eax
cmp ecx, 1
sete al
call fcn.00511c58
ret
Function at 0x4c9f70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.004cde30
add esp, 4
lea edx, [ebp - 0x64]
mov ecx, esi
call fcn.004cdee0
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.00501d03
mov esp, ebp
pop ebp
ret

Function at 0x4c9fe0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.004cde30
add esp, 4
lea edx, [ebp - 0x64]
mov ecx, esi
call fcn.004cdee0
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x4ca140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push ebx
push esi
push edi
push eax
push 0x20119
push 0
push str.SOFTWARE360MachineSignature
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ca29f
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
mov esi, 0x400
mov dword [ebp - 4], esi
movdqu xmmword [ebx], xmm0
movdqu xmmword [ebx + 0x10], xmm0
mov dword [ebx + 0x20], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push str.Operator
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ca1bf
cmp dword [ebp - 8], 1
jne 0x4ca28b
mov eax, dword [ebp - 4]
mov dword [ebx], edi
lea edi, [eax + edi]
sub esi, eax
je 0x4ca28b
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push str.IssueDate
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ca1f8
cmp dword [ebp - 8], 1
jne 0x4ca28b
mov dword [ebx + 4], edi
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
je 0x4ca28b
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push str.ExpirationDate
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ca229
cmp dword [ebp - 8], 1
jne 0x4ca28b
mov dword [ebx + 8], edi
add edi, dword [ebp - 4]
sub esi, dword [ebp - 4]
je 0x4ca28b
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push str.SignData
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ca28b
cmp dword [ebp - 8], 3
jne 0x4ca28b
mov eax, dword [ebp - 4]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], edi
sub esi, eax
je 0x4ca28b
lea ecx, [ebx + 0xc]
call fcn.004ca050
test eax, eax
je 0x4ca28b
mov eax, dword [ebp + 0xc]
mov ecx, 0x400
push dword [ebp - 0xc]
sub ecx, esi
mov esi, 1
mov dword [eax], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0xc]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ca670
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x68]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x50], 0
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x54], 0
push eax
push ecx
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.004cc8b0
add esp, 0x10
test eax, eax
jne 0x4ca6df
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00501d03
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ca6f4
push eax
mov edx, ebx
lea ecx, [ebp - 0x64]
call fcn.004cde30
add esp, 4
lea edx, [ebp - 0x64]
mov ecx, edi
call fcn.004cdee0
test esi, esi
je 0x4ca70f
mov eax, dword [ebp - 0x6c]
xor ecx, ecx
cmp eax, dword [ebp - 0x68]
sete cl
mov dword [esi], ecx
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret

Function at 0x4ca750
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push ecx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4c], 0
push eax
push ecx
mov esi, edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.004ccae0
add esp, 0xc
test eax, eax
jne 0x4ca7ae
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00501d03
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x60]
mov ecx, esi
call fcn.004cdee0
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00501d03
mov esp, ebp
pop ebp
ret
Function at 0x4ca870
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x5c2460]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, edx
mov dword [ebp - 0xd8], ecx
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x18], 0x9302d30
movzx edx, word [esi + 0x84]
mov dword [ebp - 0x14], 0xe2b0506
mov dword [ebp - 0x10], 0x51a0203
mov word [ebp - 0xc], 0x400
mov byte [ebp - 0xa], 0x20
mov dword [ebp - 0xdc], 0x2f
test edi, edi
je 0x4ca8d0
mov dword [edi], 1
lea ecx, [ecx]
movzx eax, cx
lea eax, [eax + eax*2]
cmp word [eax*4 + 0x5642f0], dx
je 0x4ca8ec
inc ecx
cmp cx, 1
jb 0x4ca8d0
jmp 0x4ca9fb
cmp cx, 1
jae 0x4ca9fb
movzx eax, cx
xorps xmm0, xmm0
mov dword [ebp - 0xd4], 0x6a09e667
mov dword [ebp - 0xd0], 0xbb67ae85
mov dword [ebp - 0xcc], 0x3c6ef372
lea eax, [eax + eax*2]
mov dword [ebp - 0xc8], 0xa54ff53a
mov ebx, dword [eax*4 + 0x5642f4]
lea eax, [ebp - 0xd4]
push eax
push ecx
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0xc4], 0x510e527f
mov dword [ebp - 0xc0], 0x9b05688c
mov dword [ebp - 0xbc], 0x1f83d9ab
mov dword [ebp - 0xb8], 0x5be0cd19
movlpd qword [ebp - 0xb4], xmm0
call fcn.004ccbf0
add esp, 8
test eax, eax
je 0x4ca9fb
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0xd4]
call fcn.004cdc30
push ebx
push ecx
lea eax, [esi + 0x90]
push eax
lea edx, [ebp - 0xdc]
lea ecx, [ebp - 0x48]
call fcn.004cd4c0
add esp, 0xc
test eax, eax
jne 0x4ca9fb
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x48]
lea esi, [eax + 0xb]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4ca9fb
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4ca9b1
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x4ca9fb
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4ca9fb
lea ecx, [ebp - 0x68]
mov esi, 0x1c
lea edx, [ebp - 0x39]
lea ecx, [ecx]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4ca9fb
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4ca9e0
test edi, edi
je 0x4ca9fb
mov dword [edi], 3
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00501d03
mov esp, ebp
pop ebp
ret

Function at 0x4cb230
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4cb26a
push str.ReadFile__
push eax
push 0xfc
push str.QHImageHlp.c
call fcn.004ced50
add esp, 0x10
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, dword [ebp - 4]
je 0x4cb28f
push 0x567448
push 1
push 0xfe
push str.QHImageHlp.c
call fcn.004cee50
add esp, 0x10
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cc000
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push dword [ebp + 0x14]
lea eax, [ecx + 0xccc]
mov esi, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ecx]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4cc048
push str.GetFileSizeEx__
push eax
push 0x11e
push str.QHImageHlp.c
call fcn.004ced50
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
lea edx, [esi + 8]
mov esi, dword [ebp + 8]
xor ecx, ecx
movlpd qword [ebp - 0x20], xmm0
cmp ecx, esi
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
jne 0x4cc072
mov eax, dword [ebp + 0x14]
mov esi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x4cc078
mov esi, dword [edx - 8]
mov ecx, dword [edx - 4]
sub esi, ebx
mov eax, esi
sbb ecx, edi
shrd eax, ecx, 0xf
shr ecx, 0xf
mov dword [ebp - 8], eax
and esi, 0x7fff
jne 0x4cc097
mov esi, 0x8000
jmp 0x4cc09b
inc eax
mov dword [ebp - 8], eax
test eax, eax
je 0x4cc105
nop
push 0
push 0
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x4cc1c2
push 0
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4cc1a0
cmp esi, dword [ebp - 0x1c]
jne 0x4cc17e
mov eax, 0x4ca730
test eax, eax
je 0x4cc0f3
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
push esi
call fcn.004cdb90
add esp, 4
add ebx, esi
mov esi, 0x8000
adc edi, 0
dec dword [ebp - 8]
jne 0x4cc0a0
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
cmp ecx, esi
jae 0x4cc160
mov eax, dword [edx]
test eax, eax
je 0x4cc172
mov ebx, 0x4ca730
test ebx, ebx
je 0x4cc156
cmp dword [edx + 4], 0
je 0x4cc156
cmp eax, 0x8000
ja 0x4cc1e4
mov ebx, dword [ebp - 0xc]
push eax
push 0
push ebx
call fcn.005091d0
mov eax, dword [ebp - 4]
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov edx, ebx
push dword [eax]
call fcn.004cdb90
mov edx, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp - 0x10]
mov ebx, dword [edx]
xor edi, edi
add ebx, dword [edx - 8]
adc edi, dword [edx - 4]
inc ecx
add edx, 0x18
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
cmp ecx, esi
jbe 0x4cc066
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x567448
push 1
push 0xfe
push str.QHImageHlp.c
call fcn.004cee50
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ReadFile__
push 0
push 0xfc
push str.QHImageHlp.c
call fcn.004ced50
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.SetFilePointerEx__
push 0
push 0xf9
push str.QHImageHlp.c
call fcn.004ced50
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x567558
push 8
push 0x3d8
push str.QHImageHlp.c
call fcn.004cee50
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cc730
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x10], xmm0
push dword [ebx]
mov edi, dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4cc77a
push str.GetFileSizeEx__
push eax
push 0x11e
push str.QHImageHlp.c
call fcn.004ced50
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x10]
sub esi, edi
mov edi, dword [ebp - 0xc]
sbb edi, 0
sub esi, 0x298
sbb edi, 0
js 0x4cc808
jg 0x4cc79a
cmp esi, dword [ebx + 0xb4]
jb 0x4cc808
mov ebx, dword [ebx]
push 0
push 0
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4cc7ce
push str.SetFilePointerEx__
push eax
push 0xf9
push str.QHImageHlp.c
call fcn.004ced50
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov ecx, ebx
push 0x298
call fcn.004cb230
add esp, 4
test eax, eax
je 0x4cc771
mov eax, dword [ebp + 8]
test eax, eax
je 0x4cc7f0
mov dword [eax], esi
mov dword [eax + 4], edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4cc814
mov ecx, 1
mov word [eax], cx
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4cc814
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret