joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x10e2008], 0x8088405
inc edx
mov dword [ebx + 0x10e2008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x10cb56f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10cb576
ret
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x10cbf53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0x10e4248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0x10e4248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0x10e30d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d44
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d44
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d44
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10cbf5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x407930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
je 0x40795a
mov edx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x407944
pop edi
mov eax, edx
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret

Function at 0x408e20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0
sub esi, edi
je 0x408e49
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x408e38
pop edi
mov eax, edx
pop esi
ret 8
Function at 0x40bb80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af440
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4e42e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0040b7f0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x40bc13
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x4924924
je 0x40bd70
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.004723fa
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0x34], 0
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4bb8e0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x4bb8e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x40bd0f
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.0048eb70
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.004728d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x40bcee
cmp ebx, 0x200
jae 0x40bcec
shl ebx, 3
cmp ebx, ecx
jae 0x40bcee
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.0040e810
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040b7f0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x40bd12
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x40bd40
mov dword [ecx + eax*8], esi
jmp 0x40bd4f
cmp edi, edx
jne 0x40bd49
mov dword [ecx + eax*8], esi
jmp 0x40bd53
cmp dword [ecx + eax*8 + 4], ebx
jne 0x40bd53
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0045d131
int3
Function at 0x40e810
Capabilities:
Hash data using fnv

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push edi
mov edi, 1
mov dword [esp + 8], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x40e960
lea eax, [edx - 1]
or eax, edi
bsr ecx, eax
push ebp
push esi
mov esi, dword [ebx + 4]
lea ebp, [ebx + 0xc]
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.0040e4c0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x40e93c
nop
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebp]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x18], eax
cmp ebx, esi
jne 0x40e8c2
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x40e92b
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x40e8f5
mov eax, dword [eax]
cmp eax, ecx
je 0x40e8ec
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov eax, dword [esp + 0x18]
mov dword [eax + 4], ecx
jmp 0x40e92b
cmp ebx, eax
je 0x40e90c
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x40e944
cmp ebx, eax
jne 0x40e900
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x18]
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [esp + 0x10]
mov ecx, edx
lea ebp, [ebx + 0xc]
cmp edx, esi
jne 0x40e870
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret 4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x40e92b
push str.invalid_hash_bucket_count
call fcn.0045d131
int3
Function at 0x410280
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afaa0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4e42e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [ecx + 0xc8]
lea edx, [ecx + 0xc8]
lea esi, [ecx + 0xcc]
mov edi, dword [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
push edx
lea eax, [ebp - 0x44]
push eax
call fcn.0040b7f0
mov eax, dword [eax + 4]
test eax, eax
je 0x410308
mov ecx, dword [esi + 4]
jmp 0x41030d
mov eax, dword [esi + 4]
mov ecx, eax
cmp eax, ecx
je 0x41033f
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x4103b7
mov eax, dword [ecx]
push edi
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472897
mov esp, ebp
pop ebp
ret 4
push 0x4b95f515
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.0040b7f0
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x4103ad
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov edx, dword [edx + 0x34]
mov dword [ebp - 4], ecx
test edx, edx
je 0x41037f
mov eax, dword [edx]
lea ecx, [ebp - 0x38]
push ecx
mov ecx, edx
call dword [eax]
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 1
test ecx, ecx
je 0x4103bc
mov eax, dword [ecx]
push edi
call dword [eax + 8]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x410322
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x410322
push str.invalid_unordered_map_K__T__key
call fcn.0045d151
call fcn.0045d0f4
call fcn.0045d0f4
int3
Function at 0x414a90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x4e42e0]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x414b52
cmp byte [esi + 0x3d], 0
je 0x414b52
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x414b3f
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x414b04
sub eax, 1
je 0x414b08
sub eax, 2
jne 0x414b3f
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00472897
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x414b27
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004900d0
add esp, 0x10
cmp edi, eax
jne 0x414b3f
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00472897
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00472897
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.00472897
add esp, 0x28
ret
Function at 0x4162e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x4e42e0]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x416310
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00472897
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x41634d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x41634d
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00472897
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x416442
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x416375
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4163a9
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0048f759
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00472897
add esp, 0x30
ret 4
mov byte [esp + 0xc], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x416442
cmp eax, 1
jle 0x416411
cmp eax, 3
jne 0x416442
push dword [esi + 0x4c]
push dword [esp + 0x10]
call fcn.00413a20
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00472897
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x416430
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004900d0
add esp, 0x10
cmp edi, eax
jne 0x416442
lea eax, [esp + 0xc]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
jne 0x416337
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00472897
add esp, 0x30
ret 4
Function at 0x417dc0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ecx
test eax, eax
jg 0x417de1
jl 0x417dd7
test esi, esi
jne 0x417de1
pop edi
xor eax, eax
xor edx, edx
pop esi
pop ecx
ret 0xc
cmp dword [edi + 0x38], 0
push ebx
push ebp
mov ebx, esi
je 0x417e94
mov ebp, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
nop dword [eax]
mov ecx, edi
call fcn.00414b70
mov esi, eax
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
jl 0x417e51
jg 0x417e19
test esi, esi
je 0x417e51
cmp ebp, eax
jg 0x417e29
jl 0x417e23
cmp ebx, esi
jae 0x417e29
mov esi, ebx
mov dword [esp + 0x10], ebp
mov eax, dword [edi + 0x1c]
push esi
push dword [eax]
push dword [esp + 0x20]
call fcn.00489740
mov eax, dword [edi + 0x2c]
add esp, 0xc
sub ebx, esi
sbb ebp, dword [esp + 0x10]
sub dword [eax], esi
mov eax, dword [edi + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x18]
jmp 0x417e70
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x417e80
mov eax, dword [esp + 0x18]
add ebx, 0xffffffff
mov esi, 1
adc ebp, 0xffffffff
mov byte [eax], cl
add eax, esi
mov dword [esp + 0x18], eax
test ebp, ebp
jg 0x417e00
jl 0x417e80
test ebx, ebx
jne 0x417e00
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, ebx
sbb edx, ebp
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 0xc
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x417ea4
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x417ea6
xor eax, eax
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], esi
test eax, eax
je 0x417edc
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
cmovb esi, eax
push esi
push ecx
push ebp
call fcn.00489740
mov eax, dword [edi + 0x2c]
sub ebx, esi
add ebp, esi
mov dword [esp + 0x1c], ebx
add esp, 0xc
sub dword [eax], esi
mov eax, dword [edi + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
cmp dword [edi + 0x4c], 0
je 0x417f89
mov ecx, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [ecx], eax
jne 0x417f07
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
cmp edx, 0xfff
jbe 0x417f48
nop word [eax + eax]
push dword [edi + 0x4c]
push 0xfff
push 1
push ebp
call fcn.0048fa49
sub ebx, eax
add esp, 0x10
add ebp, eax
mov dword [esp + 0x18], ebx
mov edx, ebx
cmp eax, 0xfff
jne 0x417f76
cmp ebx, eax
ja 0x417f20
mov ecx, edx
test edx, edx
je 0x417f8d
push dword [edi + 0x4c]
push ebx
push 1
push ebp
call fcn.0048fa49
mov ecx, dword [esp + 0x28]
add esp, 0x10
mov edx, dword [esp + 0x20]
sub ecx, eax
sub esi, ecx
mov eax, esi
pop ebp
pop ebx
pop edi
sbb edx, 0
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
sub esi, ebx
pop ebp
pop ebx
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ecx
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
sub esi, ecx
pop ebp
pop ebx
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ecx
ret 0xc
Function at 0x418080
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp + 0x38], 0
je 0x418156
mov edx, dword [esp + 0x24]
mov ebx, edx
mov ecx, dword [esp + 0x20]
mov edi, ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
test edx, edx
jl 0x418146
jg 0x4180c0
test ecx, ecx
je 0x418146
nop dword [eax]
mov ecx, ebp
call fcn.0040f2a0
mov esi, eax
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
jl 0x41810e
jg 0x4180d9
test esi, esi
je 0x41810e
cmp ebx, eax
jg 0x4180e9
jl 0x4180e3
cmp edi, esi
jae 0x4180e9
mov esi, edi
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x1c]
push esi
push eax
mov eax, dword [ebp + 0x20]
push dword [eax]
call fcn.00489740
mov eax, dword [ebp + 0x30]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x10]
sub dword [eax], esi
mov eax, dword [ebp + 0x20]
add dword [eax], esi
jmp 0x418130
mov eax, dword [ebp]
mov ecx, ebp
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x41813e
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x1c], esi
test ebx, ebx
jg 0x4180c0
jl 0x41813e
test edi, edi
jne 0x4180c0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub ecx, edi
pop edi
pop esi
pop ebp
sbb edx, ebx
mov eax, ecx
pop ebx
add esp, 8
ret 0xc
mov eax, dword [ebp + 0x20]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], esi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x418176
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
jmp 0x418178
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x4181f2
jg 0x41818b
test esi, esi
je 0x4181f2
test eax, eax
jl 0x4181cb
jg 0x418195
test ebx, ebx
je 0x4181cb
cmp edi, eax
jg 0x4181a5
jl 0x41819f
cmp esi, ebx
jae 0x4181a5
mov ebx, esi
mov dword [esp + 0x20], edi
push ebx
push dword [esp + 0x20]
push ecx
call fcn.00489740
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebp + 0x30]
add ecx, ebx
sub esi, ebx
sbb edi, dword [esp + 0x20]
sub dword [eax], ebx
mov eax, dword [ebp + 0x20]
add dword [eax], ebx
jmp 0x4181cf
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x4181f2
jg 0x4181d9
test esi, esi
je 0x4181f2
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x4181f2
push eax
push esi
push 1
push ecx
call fcn.004900d0
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc