joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d530
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
push esi
mov si, word [esp + 0x34]
push edi
movsx eax, si
shl eax, 6
push ebp
mov edx, dword [0x4eaac8]
mov dword [esp + 0x10], eax
movzx eax, si
shl eax, 0x10
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [edx + ecx + 0x10]
xor ecx, ecx
mov edx, dword [eax]
mov cx, word [edx + 0xe]
or ecx, dword [esp + 0x14]
push ecx
call fcn.0049c8e0
add esp, 4
test eax, eax
jne 0x40d581
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
mov ecx, dword [eax]
test ecx, ecx
je 0x40d69b
cmp dword [ecx + 2], 0
jne 0x40d69b
test byte [ecx + 1], 0x80
je 0x40d69b
mov edi, dword [ecx + 6]
inc edi
push edi
push eax
lea eax, [esp + 0x20]
push 0
push 0x200
push eax
mov ebx, 1
call fcn.004c42f0
lea eax, [esp + 0x2c]
add esp, 0x14
push eax
call fcn.004c4cf0
add esp, 4
cmp edi, ebx
jbe 0x40d5f7
inc ebx
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.004c4d80
add esp, 8
mov ebp, eax
test byte [eax], 1
je 0x40d5f3
push ebp
push esi
call fcn.0040d800
mov word [ebp + 2], ax
add esp, 8
cmp edi, ebx
ja 0x40d5cf
mov esi, dword [esp + 0x40]
push esi
call fcn.004c4cf0
add esp, 4
mov ebp, 1
push esi
call fcn.004c42e0
add esp, 4
mov ebx, eax
cmp ebx, ebp
jbe 0x40d654
inc ebp
push ebp
push esi
call fcn.004c4d80
add esp, 8
mov edi, eax
test edi, edi
je 0x40d654
movsx eax, word [edi + 4]
inc eax
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.004c4d80
add esp, 8
test eax, eax
je 0x40d64a
mov ax, word [eax + 2]
mov word [edi + 4], ax
jmp 0x40d650
mov word [edi + 4], 0
cmp ebx, ebp
ja 0x40d618
push esi
call fcn.004c4d50
lea eax, [esp + 0x1c]
add esp, 4
push eax
call fcn.004c4d50
mov ecx, dword [esp + 0x14]
add esp, 4
mov eax, dword [0x4eaac8]
push 0
mov edx, dword [eax + ecx + 0x10]
xor ecx, ecx
mov eax, dword [edx]
mov cx, word [eax + 0xe]
or ecx, dword [esp + 0x18]
push ecx
call fcn.0049cd90
add esp, 8
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
mov ecx, dword [esp + 0x10]
push 0
mov eax, dword [0x4eaac8]
mov edx, dword [eax + ecx + 0x10]
xor ecx, ecx
mov eax, dword [edx]
mov cx, word [eax + 0xe]
or ecx, dword [esp + 0x18]
push ecx
call fcn.0049cd90
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x40ec90
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
mov esi, dword [esp + 8]
mov ax, word [esi + 2]
lea edx, [eax*4 + 4]
xor eax, eax
mov ecx, edx
dec edx
test ecx, ecx
je 0x40ecc6
mov ecx, eax
inc esi
shl ecx, 0x18
shr eax, 8
or ecx, eax
xor eax, eax
mov al, byte [esi - 1]
xor ecx, eax
mov eax, ecx
mov ecx, edx
dec edx
test ecx, ecx
jne 0x40ecab
pop esi
ret
Function at 0x40ed70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
xor esi, esi
call fcn.004943d0
cmp eax, 8
mov edi, eax
jl 0x40edb4
xor eax, eax
mov ax, word [0x4f0a78]
shl eax, 0x10
mov al, 1
push eax
call fcn.0048d910
add esp, 4
test eax, eax
je 0x40edb4
push 0x24
xor eax, eax
mov ax, word [0x4f0a78]
shl eax, 0x10
mov al, 1
push eax
call fcn.0048a920
add esp, 8
mov esi, eax
test esi, esi
jne 0x40ee22
mov eax, 0x100
cmp edi, 8
jge 0x40edc7
mov eax, 0x10
push 0x108
mov ecx, dword [0x4f0ba8]
movzx eax, ax
push eax
push ecx
call dword [0x4f6a90]
test eax, eax
je 0x40ee22
push eax
mov eax, dword [0x4f0ba8]
push eax
call dword [0x4f6a94]
mov edi, eax
test edi, edi
je 0x40ee22
push edi
call dword [0x4f6958]
test eax, eax
je 0x40ee1b
add eax, 0x14
xor ecx, ecx
mov cx, word [eax + 2]
shl ecx, 2
add ecx, 5
dec ecx
push ecx
push eax
call fcn.00479a50
add esp, 8
mov esi, eax
push edi
call dword [0x4f695c]
mov eax, esi
pop edi
pop esi
ret
Function at 0x413c60
Capabilities:
Capture screenshot

Disassembly:
sub esp, 4
mov dword [esp], 0
push ebx
push esi
push edi
push ebp
push 0
call dword [0x4f6cf0]
mov edi, eax
test edi, edi
je 0x413d6f
mov esi, dword [esp + 0x18]
push 0
mov eax, dword [esp + 0x20]
push esi
push eax
push 4
push esi
push edi
call dword [0x4f6838]
mov ebx, eax
push edi
push 0
call dword [0x4f6cf4]
test ebx, ebx
je 0x413d6f
push 0
mov edi, dword [0x4f67a8]
call edi
mov ebp, eax
test ebp, ebp
je 0x413d68
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
inc eax
push eax
push ecx
push ebp
call dword [0x4f6820]
mov dword [esp + 0x10], eax
test eax, eax
je 0x413d61
push 0
call edi
mov edi, eax
test edi, edi
je 0x413d61
push ebx
push edi
call dword [0x4f67a0]
mov ebx, eax
mov eax, dword [esp + 0x10]
push eax
push ebp
call dword [0x4f67a0]
mov dword [esp + 0x10], eax
push 0x2000000
push edi
call dword [0x4f67b0]
push 0x2ffffff
push edi
call dword [0x4f67d4]
cmp dword [esp + 0x20], 1
sbb eax, eax
mov ecx, dword [esi + 8]
and eax, 0x990018
mov edx, dword [esi + 4]
add eax, 0x330008
push eax
push 0
push 0
push edi
push ecx
push edx
push 0
push 0
push ebp
call dword [0x4f67a4]
push ebx
push edi
call dword [0x4f67a0]
mov ebx, eax
mov ecx, dword [esp + 0x10]
push ecx
push ebp
call dword [0x4f67a0]
mov dword [esp + 0x10], eax
push edi
call dword [0x4f679c]
push ebp
call dword [0x4f679c]
push ebx
call dword [0x4f677c]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x415c70
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [0x4f6c18]
test eax, eax
je 0x415c9c
cmp dword [esp + 0xc], 1
mov ecx, 0
adc ecx, 0xffffffff
and ecx, 5
push ecx
push eax
call dword [0x4f6c20]
ret
Function at 0x41a240
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 4
lea eax, [esp]
push ebx
lea ecx, [esp + 6]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push eax
push ecx
push esi
call fcn.0041fd20
mov cx, word [esp + 0x1e]
add esp, 0xc
cmp word [esp + 0x10], cx
je 0x41a2f6
mov eax, dword [0x4f0ba4]
push eax
call dword [0x4f6c64]
test eax, eax
je 0x41a2f6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x12]
push eax
push ecx
push esi
call fcn.0041fa70
add esp, 0xc
mov edi, eax
test edi, edi
je 0x41a2f0
push edi
mov ebx, dword [0x4f6aac]
call ebx
push eax
call fcn.004b0b30
add esp, 4
movzx esi, ax
push edi
call fcn.00479d00
add esp, 4
lea ebp, [esi + eax]
mov esi, dword [0x4f6aa4]
push edi
call esi
push 2
push ebp
push edi
call fcn.00479aa0
add esp, 0xc
test eax, eax
je 0x41a2e1
push edi
call ebx
push ebp
push eax
call fcn.004b0a60
add esp, 8
push edi
call esi
call dword [0x4f6c5c]
push edi
push 1
call dword [0x4f6c58]
call dword [0x4f6c60]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x41a520
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x84
push ebx
push esi
mov esi, dword [esp + 0xa4]
push edi
mov ebx, dword [esp + 0x94]
push ebp
push esi
push ebx
call fcn.0041f8a0
mov dword [esp + 0x18], eax
add esp, 8
push esi
push ebx
call fcn.0041f860
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0xb0]
add esp, 8
lea eax, [eax + ecx + 0x10]
mov ecx, dword [esp + 0xa4]
push edx
mov dword [esp + 0x18], eax
push ecx
mov eax, dword [ebx + 0x56]
push eax
call fcn.0045ee90
add esp, 0xc
add eax, 0x10
mov ebp, dword [ebx + 0x56]
mov dword [esp + 0x18], eax
push ebp
call dword [0x4f67a8]
mov dword [ebx + 0x56], eax
test eax, eax
je 0x41a6fb
mov eax, dword [esp + 0x14]
push 0
mov ecx, dword [esp + 0x1c]
push 1
push 1
push eax
push ecx
call dword [0x4f67bc]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x41a6f4
push eax
mov ecx, dword [ebx + 0x56]
push ecx
call dword [0x4f67a0]
mov dx, word [ebx + 0x86]
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], eax
push ecx
mov ax, word [esi + 6]
push edx
push eax
call fcn.004bcfe0
lea ecx, [esp + 0x30]
lea eax, [esp + 0x4c]
add esp, 0xc
mov edx, dword [ebx + 0x56]
push ecx
push edx
push eax
call fcn.0045e810
lea edi, [esp + 0x68]
add esp, 0xc
mov esi, eax
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x5c]
lea edi, [esp + 0x78]
mov ecx, 7
push 0xff0062
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
mov eax, dword [ebx + 0x56]
push edx
push 0
push 0
push eax
call dword [0x4f6834]
movsx ecx, word [esp + 0xa8]
mov eax, dword [esp + 0xa4]
push ecx
mov edx, dword [esp + 0x14]
push eax
push edx
mov ecx, dword [ebx + 0x56]
push 0
push ecx
call dword [0x4f6774]
mov esi, dword [esp + 0xa0]
push 0x2000000
sub esi, dword [esp + 0x14]
push ebp
call dword [0x4f67b0]
push 0x2ffffff
push ebp
call dword [0x4f67d4]
push 0x990066
push 0
push 0
mov eax, dword [ebx + 0x56]
mov ecx, dword [esp + 0x20]
push eax
mov edx, dword [esp + 0x28]
push ecx
mov eax, dword [esp + 0xb0]
push edx
push esi
push eax
push ebp
call dword [0x4f67a4]
lea ecx, [esp + 0x78]
mov eax, dword [ebx + 0x56]
lea edx, [esp + 0x40]
push ecx
push eax
push edx
call fcn.0045e810
lea ecx, [esp + 0x30]
add esp, 0xc
push ecx
call fcn.0045e7e0
mov ecx, dword [esp + 0x24]
add esp, 4
mov edx, dword [ebx + 0x56]
push ecx
push edx
call dword [0x4f67a0]
mov ecx, dword [ebx + 0x56]
push ecx
call dword [0x4f679c]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [0x4f677c]
mov eax, 1
mov dword [ebx + 0x56], ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x84
ret
push ebp
call dword [0x4f679c]
xor eax, eax
mov dword [ebx + 0x56], ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x84
ret
Function at 0x42fb30
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00456b40
mov si, word [esp + 0x24]
test si, si
jne 0x42fb5d
mov edi, dword [esp + 0x28]
push edi
call fcn.0046fb90
add esp, 4
test eax, eax
je 0x42fb66
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call fcn.0046fea0
mov edi, dword [esp + 0x28]
test edi, edi
je 0x42fb74
push 0
call fcn.0042fc40
add esp, 4
cmp si, 2
je 0x42fb8c
cmp si, 3
je 0x42fb8c
call fcn.0049c770
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov eax, dword [0x4f0ba4]
xor edi, edi
push eax
call dword [0x4f6cb0]
lea eax, [esp + 0xc]
push eax
push 0x28
call dword [0x4f6928]
push eax
call dword [0x4f6758]
mov ebx, dword [0x4f6a78]
test eax, eax
jne 0x42fbbc
call ebx
mov edi, eax
test edi, edi
jne 0x42fc08
lea eax, [esp + 0x14]
push eax
push str.SeShutdownPrivilege
push 0
call dword [0x4f675c]
test eax, eax
je 0x42fbfe
lea eax, [esp + 0x10]
push 0
mov ecx, dword [esp + 0x10]
push 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], 2
push 0
push eax
push 0
push ecx
call dword [0x4f6764]
call ebx
test eax, eax
jne 0x42fc2c
test edi, edi
je 0x42fc0d
cmp edi, 0x78
jne 0x42fc2c
cmp si, 3
push 0
jne 0x42fc24
push 0xd
call dword [0x4f6bd8]
pop edi
pop esi
pop ebx
add esp, 0x14
ret
push 6
call dword [0x4f6bd8]
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x457ec0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x38
mov ecx, dword [0x4f0ba8]
lea eax, [esp + 0x10]
push esi
push eax
push str.APW_COVER
push ecx
call dword [0x4f6d30]
test eax, eax
jne 0x457f39
xor esi, esi
mov eax, dword [0x4f0ba8]
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
push 0x7f00
mov dword [esp + 0x28], eax
push esi
mov dword [esp + 0x20], 0x457dd0
mov dword [esp + 0x30], esi
call dword [0x4f6d34]
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
push ecx
mov dword [esp + 0x3c], str.APW_COVER
mov dword [esp + 0x38], esi
call dword [0x4f6d38]
test ax, ax
jne 0x457f39
xor eax, eax
pop esi
add esp, 0x38
ret
lea eax, [esp + 4]
mov ecx, dword [esp + 0x40]
push eax
push ecx
call dword [0x4f6c2c]
push 0
mov ecx, dword [0x4f0ba8]
mov eax, dword [esp + 0x14]
push ecx
sub eax, dword [esp + 0x10]
push 0
push 0
inc eax
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
sub eax, dword [esp + 0x18]
inc eax
push eax
push ecx
push edx
push 0x80000000
push 0x4e9128
push str.APW_COVER
push 0
call dword [0x4f6bc0]
mov esi, eax
push 8
push esi
call dword [0x4f6c20]
mov eax, esi
pop esi
add esp, 0x38
ret
Function at 0x459060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x830
push ebx
push esi
push edi
push ebp
xor ebp, ebp
cmp dword [esp + 0x85c], ebp
je 0x45907c
mov eax, 0xffffff
jmp 0x459083
mov ebp, 0xffffff
xor eax, eax
cmp dword [esp + 0x854], 0
mov dword [esp + 0x14], ebp
je 0x4590a9
lea ecx, [eax - 0xffffff]
cmp ecx, 1
sbb edx, edx
and dx, 0xff
mov bx, dx
xor bl, 0xff
jmp 0x4590b3
mov dx, word [esp + 0x18]
mov bx, word [esp + 0x18]
mov cx, word [esp + 0x850]
lea edi, [esp + 0x440]
shl cx, 2
mov esi, dword [esp + 0x844]
mov word [esp + 0x12], cx
mov ecx, dword [esp + 0x12]
and ecx, 0xffff
mov dword [esp + 0x18], ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
mov esi, dword [esp + 0x84c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x860], 0
je 0x4591b5
lea esi, [esp + 0x440]
lea edi, [esp + 0x40]
cmp dword [esp + 0x854], 0
je 0x459170
cmp word [esp + 0x850], 0
je 0x4591dd
mov ax, word [esp + 0x850]
mov word [esp + 0x14], ax
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 1]
mov cl, byte [esi + 2]
shl eax, 8
or eax, ecx
xor ecx, ecx
mov cl, byte [esi]
shl ecx, 0x10
mov word [edi], dx
or eax, ecx
cmp eax, ebp
je 0x459161
mov word [edi], bx
add edi, 2
add esi, 4
dec word [esp + 0x14]
jne 0x45913f
jmp 0x4591dd
cmp word [esp + 0x850], 0
je 0x4591dd
mov bx, word [esp + 0x850]
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 1]
mov dl, byte [esi + 2]
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
or ecx, edx
cmp ecx, ebp
jne 0x4591a3
mov dword [edi], eax
jmp 0x4591a9
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add edi, 4
add esi, 4
dec bx
jne 0x459183
jmp 0x4591dd
cmp dword [esp + 0x854], 0
je 0x4591ce
mov word [esp + 0x40], dx
mov word [esp + 0x23e], bx
jmp 0x4591dd
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x40], eax
mov dword [esp + 0x43c], ecx
cmp dword [esp + 0x854], 0
je 0x4591f8
mov cx, word [esp + 0x850]
lea eax, [ecx*2 + 0x28]
jmp 0x459201
mov ax, word [esp + 0x12]
add ax, 0x28
lea esi, [esp + 0x18]
mov edi, dword [esp + 0x848]
movzx eax, ax
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x830
ret
Function at 0x45eeb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push eax
xor edi, edi
call dword [0x4f6958]
test eax, eax
je 0x45ef2f
mov esi, dword [esp + 0x10]
movsx ecx, word [eax]
mov dword [esi], ecx
movsx edx, word [eax + 2]
mov dword [esi + 4], edx
movsx ecx, word [eax + 4]
mov dword [esi + 8], ecx
movsx edi, word [eax + 6]
mov dword [esi + 0xc], edi
movsx edx, word [eax + 8]
mov dword [esi + 0x10], edx
mov cl, byte [eax + 0xa]
mov byte [esi + 0x14], cl
mov dl, byte [eax + 0xb]
mov byte [esi + 0x15], dl
mov cl, byte [eax + 0xc]
mov byte [esi + 0x16], cl
mov dl, byte [eax + 0xd]
mov byte [esi + 0x17], dl
mov cl, byte [eax + 0xe]
mov byte [esi + 0x18], cl
push 0x20
mov dl, byte [eax + 0xf]
add eax, 0x12
push eax
mov byte [esi + 0x19], dl
mov cl, byte [eax - 2]
mov edi, 1
mov byte [esi + 0x1a], cl
lea ecx, [esi + 0x1c]
mov dl, byte [eax - 1]
push ecx
mov byte [esi + 0x1b], dl
call dword [0x4f6aa0]
jmp 0x45ef33
mov esi, dword [esp + 0x10]
test edi, edi
je 0x45ef4e
cmp dword [0x4eb22c], 0
je 0x45ef4e
cmp byte [esi + 0x17], 0
jne 0x45ef4e
call fcn.004b1450
mov byte [esi + 0x17], al
mov eax, edi
pop edi
pop esi
ret

Function at 0x45f5b0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
mov ecx, dword [eax]
mov esi, 0xffffffff
push 0
push ecx
call fcn.004611f0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
add esp, 8
cmp dword [esp + 4], 0
je 0x45f5f6
push 0
push eax
call dword [0x4f6a48]
mov esi, eax
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push ecx
push eax
call fcn.004604c0
add esp, 8
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x45f660
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
push ebx
push esi
push edi
xor esi, esi
push ebp
xor edi, edi
lea eax, [esp + 0x10]
push 0x105
mov ecx, dword [esp + 0x228]
push eax
push ecx
call fcn.00465710
add esp, 0xc
test eax, eax
je 0x45f699
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x210
ret
mov ebx, dword [0x4f6a3c]
xor ebp, ebp
inc edi
lea eax, [esp + 0x118]
lea ecx, [esp + 0x10]
push eax
push edi
push str.untit
push ecx
call dword [0x4f6a4c]
test eax, eax
je 0x45f700
lea eax, [esp + 0x118]
push ebp
push 0x4000080
push 1
push ebp
push 2
push 0x40000000
push eax
call dword [0x4f6a50]
cmp eax, 0xffffffff
jne 0x45f6fd
call dword [0x4f6a78]
cmp eax, 0xb7
mov esi, eax
jne 0x45f700
cmp edi, 3
jge 0x45f700
mov ebp, 1
jmp 0x45f700
push eax
call ebx
test ebp, ebp
jne 0x45f69f
cmp esi, 0x6c
je 0x45f720
cmp esi, 5
je 0x45f720
cmp esi, 0x13
je 0x45f720
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x210
ret
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x210
ret
Function at 0x460720
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 4
mov ecx, dword [esp + 0x1c]
push ebx
mov edx, dword [esp + 0xc]
push esi
push edi
push ebp
push eax
push ecx
mov eax, dword [esp + 0x24]
push eax
push edx
call fcn.00460540
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x460759
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0x1c]
and eax, 0xffff0000
jne 0x4607a1
lea eax, [esp + 0x10]
push 0
mov ecx, dword [esp + 0x28]
push eax
mov edx, dword [esp + 0x28]
push ecx
mov dword [esp + 0x1c], 0
push edx
push esi
call dword [0x4f6a24]
test eax, eax
je 0x460794
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
test eax, eax
je 0x460847
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push ecx
push eax
call fcn.00461130
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x46082e
mov ebp, dword [ebx + 0x14]
mov eax, dword [esp + 0x24]
sub ebp, dword [ebx + 0x18]
cmp ebp, eax
jl 0x4607d1
mov ebp, eax
test ebp, ebp
jg 0x4607db
xor ebp, ebp
test ebp, ebp
jle 0x46080d
mov eax, dword [ebx + 0x10]
push eax
call dword [0x4f6aac]
test eax, eax
je 0x46080d
mov esi, dword [ebx + 0x18]
mov edi, dword [esp + 0x20]
add esi, eax
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [ebx + 0x18], ebp
mov eax, dword [ebx + 0x10]
push eax
call dword [0x4f6aa4]
push 0x4f0a18
call fcn.004c4d50
add esp, 4
push 0
call fcn.00461120
add esp, 4
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, 0xffffffff
push 2
call fcn.00461120
add esp, 4
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x460860
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 4
mov ecx, dword [esp + 0x1c]
push ebx
mov edx, dword [esp + 0xc]
push esi
push edi
push ebp
push eax
push ecx
mov eax, dword [esp + 0x24]
push eax
push edx
call fcn.00460540
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x460899
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [esp + 0x1c]
and eax, 0xffff0000
jne 0x4608e1
lea eax, [esp + 0x10]
push 0
mov ebx, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x28]
push ebx
mov dword [esp + 0x1c], 0
push ecx
push esi
call dword [0x4f6a2c]
test eax, eax
je 0x4608d4
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
test eax, eax
je 0x4609ad
push 0
call fcn.00461120
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 4
push ecx
push eax
call fcn.00461130
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x460994
mov ebx, dword [esp + 0x24]
mov esi, dword [ebp + 0x18]
add esi, ebx
cmp dword [ebp + 0x14], esi
jge 0x46095c
cmp dword [ebp + 0x1c], esi
jl 0x460932
mov eax, dword [ebp + 0x10]
push eax
call fcn.00479d00
add esp, 4
cmp eax, esi
jge 0x460959
push 2
mov eax, dword [ebp + 0x10]
push esi
push eax
call fcn.00479af0
add esp, 0xc
test eax, eax
jne 0x460956
mov ebx, 0xffffffff
push 0x70
call fcn.00461120
add esp, 4
jmp 0x46095c
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], esi
test ebx, ebx
jle 0x46097d
mov eax, dword [ebp + 0x10]
mov esi, dword [esp + 0x20]
mov ecx, ebx
mov edi, dword [eax]
shr ecx, 2
add edi, dword [ebp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [ebp + 0x18], ebx
push 0x4f0a18
call fcn.004c4d50
add esp, 4
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebx, 0xffffffff
push 2
call fcn.00461120
add esp, 4
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x460a20
Capabilities:
Move file

Disassembly:
sub esp, 0x210
push esi
push edi
mov esi, dword [esp + 0x21c]
push esi
call fcn.00465a20
add esp, 4
test eax, eax
jne 0x460a57
push 0x45e
call fcn.00461120
add esp, 4
mov eax, 0x45e
pop edi
pop esi
add esp, 0x210
ret
mov edi, dword [esp + 0x220]
push edi
call fcn.00465a20
add esp, 4
test eax, eax
jne 0x460a86
push 0x45e
call fcn.00461120
add esp, 4
mov eax, 0x45e
pop edi
pop esi
add esp, 0x210
ret
lea eax, [esp + 8]
push 0x105
push eax
push edi
call fcn.00465830
lea eax, [esp + 0x14]
add esp, 0xc
mov edi, dword [0x4f6bf8]
push eax
lea eax, [esp + 0xc]
push eax
call edi
lea ecx, [esp + 0x110]
push 0x105
push ecx
push esi
call fcn.00465830
lea eax, [esp + 0x11c]
add esp, 0xc
push eax
lea eax, [esp + 0x114]
push eax
call edi
lea ecx, [esp + 8]
lea edx, [esp + 0x110]
push ecx
push edx
call dword [0x4f6a18]
test eax, eax
jne 0x460af8
call fcn.00461110
pop edi
pop esi
add esp, 0x210
ret
xor eax, eax
pop edi
pop esi
add esp, 0x210
ret