joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb64250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb78808
push 0xb68288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xb64329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xb64329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00b671d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xb64329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xb64329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xb6432c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00b64351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb64d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb64d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xb64d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb64d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xb64d94
push eax
push esi
call fcn.00b6720b
add esp, 8
pop esi
ret 0x10

Function at 0xb64da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb64e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xb64e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xb7d320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b66dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xb64dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xb64e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb64ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xb64eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xb7d320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b66dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xb64eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xb64e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xb65000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xb65131
push esi
call fcn.00b68145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00b57080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xb65131
push 0
push ebp
call fcn.00b573a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00b57260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xb6508b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00b572f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xb65121
push str.CompanyName
push edi
call fcn.00b663f0
push eax
push ebx
push esi
call fcn.00b64f60
push str.FileDescription
push edi
call fcn.00b663f0
push eax
push ebx
push esi
call fcn.00b64f60
push str.LegalCopyright
push edi
call fcn.00b663f0
push eax
push ebx
push esi
call fcn.00b64f60
push str.ProductName
push edi
call fcn.00b663f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00b64f60
push str.ProductVersion
push edi
call fcn.00b663f0
push eax
push ebx
push esi
call fcn.00b64f60
push str.FileVersion
push edi
call fcn.00b663f0
push eax
push ebx
push esi
call fcn.00b64f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xb661b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b66140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b66140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b66140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b66140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb66bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb66c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xb7887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb66c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb66c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4010bf
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00401028
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0xc
push edi
call esi
mov ebx, eax
lea eax, [ebp - 0x108]
push eax
call esi
cmp eax, ebx
jge 0x40113a
lea ebx, [ebp - 0x108]
sub ebx, edi
mov dword [ebp - 4], ebx
jmp 0x40110c
mov ebx, dword [ebp - 4]
cmp byte [edi], 0x5c
jne 0x401120
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [edi]
push dword [ebp + 8]
mov byte [ebx + edi], al
inc edi
call esi
mov ebx, eax
lea eax, [ebp - 0x108]
push eax
call esi
cmp eax, ebx
jl 0x401109
lea eax, [ebp - 0x108]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401537
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
push ebx
push esi
push edi
push 0x44
pop edi
xor ebx, ebx
push edi
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.00401028
push 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.00401028
add esp, 0x18
mov esi, 0x104
lea eax, [ebp - 0x364]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x364]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x15c]
push eax
call esi
cmp byte [ebp + eax - 0x15d], 0x5c
je 0x4015c1
lea eax, [ebp - 0x15c]
push eax
call esi
mov byte [ebp + eax - 0x15d], bl
lea eax, [ebp - 0x15c]
push eax
jmp 0x40159c
mov eax, dword [0x4035f4]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add eax, 0x15c
mov dword [ebp - 0x58], edi
mov edi, dword [ebp + 8]
push eax
push dword [0x4035e4]
push str._s_s
push edi
call esi
mov eax, dword [0x4035f4]
add esp, 0x10
cmp dword [eax + 0x2b0], ebx
je 0x401611
lea eax, [ebp - 0x15c]
push eax
push edi
lea eax, [ebp - 0x260]
push str._s__S:__s_
push eax
call esi
add esp, 0x10
jmp 0x401623
push edi
lea eax, [ebp - 0x260]
push 0x403384
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x260]
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401669
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x10]
call esi
push 0xffffffffffffffff
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
jmp 0x40167c
push str.Unable_to_execute_command
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401196
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401b55
Capabilities:
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, 0x104
xor esi, esi
push edi
mov dword [ebp - 8], esi
call fcn.00401000
cmp eax, esi
pop ecx
mov dword [0x4035e4], eax
je 0x401b9d
push edi
call fcn.00401000
cmp eax, esi
pop ecx
mov dword [0x4035ec], eax
je 0x401b9d
mov ebx, 0x2bd
push ebx
call fcn.00401000
cmp eax, esi
pop ecx
mov dword [0x4035f4], eax
jne 0x401ba7
call fcn.00401166
jmp 0x401cd2
push 1
mov dword [ebp - 0xc], edi
pop edi
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push dword [0x4035ec]
push eax
push esi
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x403032], esi
push esi
jne 0x401c06
push str.GkWare_SFX_Module_V1.90_lz
push dword [0x403008]
jmp 0x401c6f
push 0x20
push 3
push esi
push edi
push 0x80000000
push 0x4034e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x4035e8], eax
jne 0x401c34
push esi
push str.GkWare_SFX_Module_V1.90_lz
push dword [0x40300c]
jmp 0x401c6f
call fcn.00401d52
test eax, eax
je 0x401c4c
push 0x30
push str.GkWare_SFX_Module_V1.90_lz
push dword [section..data]
jmp 0x401c6f
push esi
push dword [0x4035e8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x403032]
push esi
cmp eax, ecx
jne 0x401c7a
push str.GkWare_SFX_Module_V1.90_lz
push dword [0x403010]
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x401cd2
push esi
push ecx
push dword [0x4035e8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
push esi
push eax
push ebx
push dword [0x4035f4]
push dword [0x4035e8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], ebx
je 0x401cbf
push str.ReadFile_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401196
pop ecx
pop ecx
call fcn.0040114e
jmp 0x401cd2
mov eax, dword [0x4035f4]
cmp dword [eax + 0x50], esi
jne 0x401cd0
call fcn.0040117e
jmp 0x401cd2
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401cd7
Capabilities:
Read file on windows
Terminate process

Disassembly:
push esi
push 0x104
xor esi, esi
push 0x4034e0
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4035f0], eax
call fcn.00401b55
test eax, eax
je 0x401d4a
mov eax, dword [0x4035f4]
cmp dword [eax + 0x2b4], esi
jne 0x401d39
cmp dword [eax + 0x2b0], esi
push esi
push 0x4011fe
push esi
je 0x401d23
push str.SETUPMAINDLG
jmp 0x401d28
push 0x4034a8
push dword [0x4035f0]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
je 0x401d4a
call fcn.00401681
push dword [0x4035e8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401d52
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
xor ebx, ebx
cmp dword [0x403036], ebx
jne 0x401d6a
push 2
jmp 0x401d7f
push dword [0x403032]
call fcn.00401000
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
jne 0x401d85
push 3
pop eax
jmp 0x401e26
push esi
mov esi, dword [0x403036]
push edi
lea edx, [ebp - 0x40c]
mov dword [ebp - 0x40c], ebx
lea eax, [ebp - 0x408]
mov edi, 0x80
test byte [edx + 3], 0x80
mov ecx, dword [edx]
je 0x401db7
add ecx, ecx
mov dword [eax], ecx
xor ecx, esi
mov dword [eax - 4], ecx
jmp 0x401dc0
add ecx, ecx
mov dword [eax - 4], ecx
xor ecx, esi
mov dword [eax], ecx
add eax, 8
add edx, 4
dec edi
jne 0x401da4
mov esi, dword [0x403032]
lea eax, [ebp - 0xc]
push ebx
push eax
push esi
mov dword [ebp - 8], ebx
push dword [ebp - 4]
push dword [0x4035e8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
mov ecx, esi
dec esi
test ecx, ecx
je 0x401e10
lea ecx, [esi + 1]
movzx edx, byte [ebp - 5]
movzx esi, byte [eax]
xor edx, esi
shl ebx, 8
mov edx, dword [ebp + edx*4 - 0x40c]
xor ebx, edx
inc eax
dec ecx
mov dword [ebp - 8], ebx
jne 0x401df4
push dword [ebp - 4]
call fcn.00401014
xor eax, eax
cmp ebx, dword [0x40303a]
pop ecx
pop edi
setne al
pop esi
pop ebx
leave
ret

Function at 0x401e29
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
lea eax, [ebp - 0x88]
push 0x2010
push eax
push dword [ebp + 8]
call sub.LZ32.dll_LZOpenFileA
mov edi, eax
lea eax, [ebp - 0x110]
push 0x1002
push eax
push dword [ebp + 0xc]
call sub.LZ32.dll_LZOpenFileA
test edi, edi
mov esi, eax
jl 0x401e84
test esi, esi
jl 0x401e84
push esi
push edi
call sub.LZ32.dll_LZCopy
test eax, eax
jl 0x401e84
push edi
call sub.LZ32.dll_LZClose
push esi
call sub.LZ32.dll_LZClose
push 1
pop eax
jmp 0x401e86
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40136b
Capabilities:
Create thread

Disassembly:
jmp 0x5c6890
push esi
mov esi, ecx
cmp dword [esi + 0x1f4], 0
push edi
je 0x5c693f
mov edi, dword [esp + 0x14]
test edi, edi
je 0x5c693f
push 0
push 1
push 0x7e6cc0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x5c693f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [0x7e6cac], ecx
mov edx, dword [eax + 4]
mov dword [0x7e6cb0], edx
mov eax, dword [eax + 8]
mov dword [0x7e6cb4], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [0x7e6ca0], ecx
mov edx, dword [eax + 4]
mov dword [0x7e6ca4], edx
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x18]
mov dword [0x7e6ca8], eax
mov ecx, dword [esi + 0x1f4]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x401f41
push 0
push 0
mov dword [0x7e6cbc], ecx
mov dword [0x7e6cb8], edi
mov dword [0x79bc60], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x5c6946
push eax
push 0x7e6cc0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x402388
Capabilities:
Read file on windows

Disassembly:
jmp 0x5feac0
sub esp, 0x730
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x72c], eax
mov eax, dword [esp + 0x738]
push ebx
mov ebx, dword [esp + 0x738]
push esi
mov esi, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
test ebx, ebx
jne 0x5feaf9
xor eax, eax
jmp 0x5fec8e
test eax, eax
je 0x5feaf2
push edi
push ebx
push 1
lea eax, [esp + 0x1a]
push 1
push eax
call fcn.00606ca9
push 0x200
xor edi, edi
lea ecx, [esp + 0x54c]
push edi
push ecx
add esi, 0x10
call fcn.006061b0
lea edx, [esp + 0x30]
push edx
push str._02X
push esi
call fcn.006083d2
add esp, 0x28
test eax, eax
jle 0x5feb6e
lea esp, [esp]
cmp edi, 0x200
jge 0x5feb6e
mov al, byte [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
add esi, 2
push str._02X
mov byte [esp + edi + 0x540], al
push esi
inc edi
call fcn.006083d2
add esp, 0xc
test eax, eax
jg 0x5feb40
push ebp
push 0x100
lea edx, [esp + 0x540]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.0040e255
mov ebp, dword [esp + 0x758]
mov cl, byte [esp + 0x75c]
add esp, 0xc
xor edi, edi
mov byte [esp + 0x13], cl
test ebp, ebp
jle 0x5fec4d
push ebx
push 0x10
lea edx, [esp + 0x144]
push 1
push edx
call fcn.00606ca9
add esp, 0x10
cmp eax, 0x10
jne 0x5fec76
lea eax, [esp + 0x13c]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x2c]
push 0
push edx
call fcn.0040d90e
mov ecx, dword [esp + 0x30]
xor eax, eax
add esp, 0x10
xor dl, dl
mov byte [esp + 0x15], al
mov byte [esp + 0x14], al
lea esi, [ecx + edi + 1]
mov cl, byte [esp + eax + 0x13c]
add byte [esp + 0x13], cl
mov byte [esi + eax - 1], cl
mov cl, byte [esp + eax + 0x13d]
add byte [esp + 0x14], cl
mov byte [esi + eax], cl
mov cl, byte [esp + eax + 0x13e]
add byte [esp + 0x15], cl
mov byte [esi + eax + 1], cl
mov cl, byte [esp + eax + 0x13f]
mov byte [esi + eax + 2], cl
add eax, 4
add dl, cl
cmp eax, 0x10
jl 0x5febf1
add dl, byte [esp + 0x15]
mov ebx, dword [esp + 0x1c]
add dl, byte [esp + 0x14]
add edi, 0x10
add byte [esp + 0x13], dl
cmp edi, ebp
jl 0x5feba5
push ebx
push 1
lea edx, [esp + 0x1f]
push 1
push edx
call fcn.00606ca9
mov al, byte [esp + 0x26]
add esp, 0x10
cmp al, byte [esp + 0x17]
jne 0x5fec76
cmp al, byte [esp + 0x13]
jne 0x5fec76
mov eax, 1
jmp 0x5fec8c
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop edi
mov ecx, dword [esp + 0x734]
pop esi
pop ebx
xor ecx, esp
call fcn.00606374
add esp, 0x730
ret 0x10
Function at 0x4027e8
Capabilities:
Read file on windows

Disassembly:
jmp 0x58dbc0
sub esp, 0x208
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
mov edi, dword [esp + 0x214]
mov esi, ecx
mov dword [esp + 8], edi
test edi, edi
jne 0x58dbee
xor eax, eax
jmp 0x58dcaa
push 0x64061c
push edi
call fcn.0060682b
lea edx, [esi + 0x30]
add esp, 8
mov dword [esi + 4], eax
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x58dc06
mov eax, dword [esi + 4]
test eax, eax
je 0x58dbe7
push ebx
push ebp
push 2
push 0
push eax
call fcn.00609a3c
mov eax, dword [esi + 4]
push eax
call fcn.00609d84
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
mov ebx, eax
call fcn.00609a3c
add esp, 0x1c
mov ecx, esi
call fcn.00409f02
mov edx, dword [esi + 4]
push edx
push 1
lea edi, [esi + 0x18]
push 0xc
push edi
call fcn.00606ca9
mov eax, dword [edi]
sub eax, dword [esi + 0x1c]
add esp, 0x10
sub eax, dword [esi + 0x20]
lea ecx, [esi + 0x148]
push eax
call fcn.00406a41
test eax, eax
jne 0x58dcc3
push eax
push 0x38
push str.MHFile.cpp
call fcn.00409a25
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push str.Bin_File_Version_Error_____s
push edx
call fcn.00606889
add esp, 0x18
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
xor ecx, esp
call fcn.00606374
add esp, 0x208
ret 4
lea ecx, [esi + 0x148]
call fcn.00401456
test eax, eax
je 0x58dd67
lea edi, [ebx - 0xe]
push edi
call fcn.0060529a
add esp, 4
mov dword [esi + 0x28], eax
test eax, eax
jne 0x58dcfb
push eax
push 0x49
push str.MHFile.cpp
call fcn.00409a25
add esp, 0xc
jmp 0x58dca6
push edi
push 0
push eax
call fcn.006061b0
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 4]
add esp, 0xc
push ecx
push edi
push edx
push eax
lea ecx, [esi + 0x148]
call fcn.00402388
test eax, eax
jne 0x58dd47
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push str.File_Open_Error_:__s
push edx
call fcn.00606889
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x1c]
jmp 0x58dc9d
mov ecx, dword [esi + 4]
push ecx
call fcn.0060652a
mov eax, 1
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 0x2c], eax
jmp 0x58dca8
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esi + 0x24]
push 1
push eax
call fcn.00606ca9
mov eax, dword [esi + 0x20]
add esp, 0x10
test eax, eax
je 0x58dd9e
push eax
call fcn.0060529a
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x20]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x28], eax
call fcn.00606ca9
add esp, 0x14
mov eax, dword [esi + 4]
push eax
push 1
lea ecx, [esi + 0x25]
push 1
push ecx
call fcn.00606ca9
mov edx, dword [esi + 4]
push edx
call fcn.0060652a
add esp, 0x14
mov ecx, esi
mov dword [esi + 4], 0
call fcn.00409d09
test eax, eax
je 0x58dca6
call fcn.0040e28c
test eax, eax
je 0x58dca6
mov eax, 1
mov dword [esi + 0x2c], eax
jmp 0x58dca8