joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push edi
lea edi, [ebp - 0xb4]
mov ecx, 0x2d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x50beb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x5018b8]
mov word [ebp - 0xb0], ax
mov byte [0x50fd54], 0x7f
mov byte [0x50fd55], 0
mov byte [0x50fd56], 0
mov byte [0x50fd57], 1
push 0x5018bc
call fcn.00490c00
add esp, 4
test eax, eax
jne 0x44a580
push str.127.0.0.1
push 0x14
lea ecx, [ebp - 0x1c]
push ecx
push str.centerip
push 0x5018e0
call fcn.00490d20
add esp, 0x14
lea edx, [ebp - 0xb0]
push edx
push 4
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.0044a650
add esp, 0x10
lea edx, [ebp - 0xa4]
push edx
call fcn.004979c0
add esp, 4
mov byte [0x50fd54], al
lea eax, [ebp - 0x84]
push eax
call fcn.004979c0
add esp, 4
mov byte [0x50fd55], al
lea ecx, [ebp - 0x64]
push ecx
call fcn.004979c0
add esp, 4
mov byte [0x50fd56], al
lea edx, [ebp - 0x44]
push edx
call fcn.004979c0
add esp, 4
mov byte [0x50fd57], al
push 0x1f40
push 0x5018e4
push 0x5018f0
call fcn.00491210
add esp, 0xc
mov dword [0x5018b0], eax
push 0x1770
push 0x5018f4
push 0x501900
call fcn.00491210
add esp, 0xc
mov dword [0x5018b4], eax
push 0x800
push str.bufsize
push 0x50190c
call fcn.00491210
add esp, 0xc
mov dword [0x5018ac], eax
call fcn.00490d00
push 1
mov eax, dword [0x5018ac]
push eax
call fcn.00496490
add esp, 8
mov dword [0x50fd60], eax
cmp dword [0x50fd60], 0
jne 0x44a5b2
push str._nmalloc_net_recv_buf_failed_program_will_exit___
call fcn.0048c1d0
add esp, 4
push 1
call fcn.00497ed0
mov ecx, dword [0x5018b4]
push ecx
call fcn.0048f1a0
add esp, 4
mov dword [0x50fd58], eax
cmp dword [0x50fd58], 0xffffffff
jne 0x44a5e3
push str._nopen_udp_socket_failed_program_will_exit___
call fcn.0048c1d0
add esp, 4
push 1
call fcn.00497ed0
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x44a614]
call fcn.00492460
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004932b0
add esp, 0xb4
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x44e0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push edi
lea edi, [ebp - 0x28]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x50beb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
mov dword [ebp - 0x28], 0
push 0x502454
mov ecx, dword [str.overlap.dat]
push ecx
call fcn.004943f0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44e136
push str.The_file_overlapTable.dat_was_not_opened_n
call fcn.0048c1d0
add esp, 4
or eax, 0xffffffff
jmp 0x44e254
mov dword [ebp - 8], 0
jmp 0x44e148
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 8
jge 0x44e238
push 0x10
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00493230
add esp, 0xc
mov ecx, dword [ebp - 8]
imul ecx, ecx, 0x18
add ecx, dword [0x50fd8c]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc]
push edx
push 1
push 0x18
mov eax, dword [ebp - 0x28]
push eax
call fcn.00493d00
add esp, 0x10
mov ecx, dword [ebp - 0x28]
movsx edx, word [ecx + 8]
test edx, edx
jle 0x44e1c0
mov eax, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x44e1c0
mov ecx, dword [ebp - 0x28]
movsx edx, word [ecx + 8]
cmp edx, 0x10
ja 0x44e1c0
mov eax, dword [ebp - 0x28]
movsx ecx, word [eax + 8]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.004952a0
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
push 1
push 0x10
lea eax, [ebp - 0x20]
push eax
call fcn.00493d00
add esp, 0x10
push 0x10
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.00493230
add esp, 0xc
mov edx, dword [ebp - 0x28]
movsx eax, word [edx + 0x10]
test eax, eax
jle 0x44e21f
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0xc], 0
je 0x44e21f
mov edx, dword [ebp - 0x28]
movsx eax, word [edx + 0x10]
cmp eax, 0x10
ja 0x44e21f
mov ecx, dword [ebp - 0x28]
movsx edx, word [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0xc]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.004952a0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 1
push 0x10
lea ecx, [ebp - 0x20]
push ecx
call fcn.00493d00
add esp, 0x10
jmp 0x44e13f
mov edx, dword [ebp - 0xc]
push edx
call fcn.00493af0
add esp, 4
mov eax, dword [str.overlap.dat]
push eax
call fcn.004307b0
add esp, 4
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x44e280]
call fcn.00492460
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004932b0
add esp, 0x28
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x44e2a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x50beb0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x502484
mov eax, dword [str.overlap.dat]
push eax
call fcn.004943f0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44e301
push str.The_file_overlapTable.dat_was_not_opened__n
call fcn.0048c1d0
add esp, 4
or eax, 0xffffffff
jmp 0x44e445
mov dword [ebp - 0xc], 0
jmp 0x44e313
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 8
jge 0x44e437
push 0x10
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00493230
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
push 1
push 0x18
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x18
add ecx, dword [0x50fd8c]
push ecx
call fcn.00494bc0
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
push 1
push 0x10
lea eax, [ebp - 0x20]
push eax
call fcn.00494bc0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x18
mov edx, dword [0x50fd8c]
mov dword [edx + ecx + 4], 0
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x18
mov ecx, dword [0x50fd8c]
movsx edx, word [ecx + eax + 8]
test edx, edx
jle 0x44e3b6
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x18
mov ecx, dword [0x50fd8c]
movsx edx, word [ecx + eax + 8]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x18
mov edx, dword [0x50fd8c]
lea eax, [edx + ecx + 4]
push eax
call fcn.0044b570
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.00493230
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
push 1
push 0x10
lea eax, [ebp - 0x20]
push eax
call fcn.00494bc0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x18
mov edx, dword [0x50fd8c]
mov dword [edx + ecx + 0xc], 0
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x18
mov ecx, dword [0x50fd8c]
movsx edx, word [ecx + eax + 0x10]
test edx, edx
jle 0x44e432
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x18
mov ecx, dword [0x50fd8c]
movsx edx, word [ecx + eax + 0x10]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x18
mov edx, dword [0x50fd8c]
lea eax, [edx + ecx + 0xc]
push eax
call fcn.0044b570
add esp, 0xc
jmp 0x44e30a
mov ecx, dword [ebp - 8]
push ecx
call fcn.00493af0
add esp, 4
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x44e470]
call fcn.00492460
pop eax
pop edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004932b0
add esp, 0x24
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x452850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x50beb0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x502ab0
mov eax, dword [str.phaseTable.dat]
push eax
call fcn.004943f0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4528ae
push str.The_file_phaseTable.dat_was_not_opened_n
call fcn.0048c1d0
add esp, 4
or eax, 0xffffffff
jmp 0x452959
mov dword [ebp - 8], 0
jmp 0x4528c0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
movsx edx, word [0x618c2a]
cmp dword [ebp - 8], edx
jge 0x45293c
push 8
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.00493230
add esp, 0xc
mov ecx, dword [ebp - 8]
shl ecx, 5
add ecx, dword [0x618c30]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0xc]
push edx
push 1
push 0x20
mov eax, dword [ebp - 0x20]
push eax
call fcn.00493d00
add esp, 0x10
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x18], 0
je 0x452923
mov edx, dword [ebp - 0x20]
movsx eax, word [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x18]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.004952a0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 8
lea edx, [ebp - 0x18]
push edx
call fcn.00493d00
add esp, 0x10
jmp 0x4528b7
mov eax, dword [ebp - 0xc]
push eax
call fcn.00493af0
add esp, 4
mov ecx, dword [str.phaseTable.dat]
push ecx
call fcn.004307b0
add esp, 4
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x452984]
call fcn.00492460
pop eax
pop edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004932b0
add esp, 0x20
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x4529a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x50beb0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x502ae0
mov eax, dword [str.phaseTable.dat]
push eax
call fcn.004943f0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x452a01
push str.The_file_phaseTable.dat_was_not_opened__n
call fcn.0048c1d0
add esp, 4
or eax, 0xffffffff
jmp 0x452b3a
push 2
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00494fe0
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call fcn.00494c20
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x452a47
mov eax, dword [ebp - 0x10]
push eax
call fcn.00493af0
add esp, 4
push str.The_file_phaseTable.dat_is_empty_n
call fcn.0048c1d0
add esp, 4
or eax, 0xffffffff
jmp 0x452b3a
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0x28
div ecx
mov word [0x618c2a], ax
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.00494fe0
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x452a7b
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
movsx ecx, word [0x618c2a]
cmp dword [ebp - 8], ecx
jge 0x452b2c
mov edx, dword [ebp - 0x10]
push edx
push 1
push 0x20
mov eax, dword [ebp - 8]
shl eax, 5
add eax, dword [0x618c30]
push eax
call fcn.00494bc0
add esp, 0x10
mov ecx, dword [ebp - 0x10]
push ecx
push 1
push 8
lea edx, [ebp - 0x20]
push edx
call fcn.00494bc0
add esp, 0x10
mov eax, dword [ebp - 8]
shl eax, 5
mov ecx, dword [0x618c30]
movsx edx, word [ecx + eax + 0x1c]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x452b14
mov eax, dword [ebp - 0xc]
push eax
call fcn.00493ac0
add esp, 4
mov ecx, dword [ebp - 8]
shl ecx, 5
mov edx, dword [0x618c30]
mov dword [edx + ecx + 0x18], eax
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
shl edx, 5
mov eax, dword [0x618c30]
mov ecx, dword [eax + edx + 0x18]
push ecx
call fcn.004952a0
add esp, 0xc
jmp 0x452b27
mov edx, dword [ebp - 8]
shl edx, 5
mov eax, dword [0x618c30]
mov dword [eax + edx + 0x18], 0
jmp 0x452a72
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00493af0
add esp, 4
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x452b64]
call fcn.00492460
pop eax
pop edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004932b0
add esp, 0x24
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x46e670
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
push 0x507ad8
mov eax, dword [str.RoadInfoTable.dat]
push eax
call fcn.004943f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x46e6a2
or al, 0xff
jmp 0x46e6ca
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x2f0
mov edx, dword [0x618b30]
push edx
call fcn.00494bc0
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00493af0
add esp, 4
xor al, al
add esp, 4
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret

Function at 0x470470
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0x90
mov eax, dword [ebp - 4]
push eax
call fcn.00493ac0
add esp, 4
mov dword [0x510abc], eax
cmp dword [0x510abc], 0
jne 0x4704b0
push 0x507b8c
call fcn.0048c1d0
add esp, 4
push 1
call fcn.00497ed0
mov ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [0x510abc]
push edx
call fcn.00493230
add esp, 0xc
mov eax, 6
mov word [0x510ab6], ax
mov dword [ebp - 4], 0xc0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00493ac0
add esp, 4
mov dword [0x510ad0], eax
cmp dword [0x510ad0], 0
jne 0x470505
push str.rs232_port_table_malloc_error_n
call fcn.0048c1d0
add esp, 4
push 1
call fcn.00497ed0
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [0x510ad0]
push eax
call fcn.00493230
add esp, 0xc
mov ecx, 6
mov word [0x510aca], cx
call fcn.00470a70
call fcn.004706b0
xor eax, eax
add esp, 4
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x470540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
push 0x507bcc
mov eax, dword [str.rs232.dat]
push eax
call fcn.004943f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47058c
mov ecx, dword [str.rs232.dat]
push ecx
push str.open__s_failed_n
call fcn.0048c1d0
add esp, 8
or eax, 0xffffffff
jmp 0x470698
mov dword [ebp - 8], 1
jmp 0x47059e
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 6
jg 0x47065f
mov eax, dword [ebp - 4]
push eax
push 1
push 4
mov ecx, dword [ebp - 8]
sub ecx, 1
imul ecx, ecx, 0x18
mov edx, dword [0x510abc]
lea eax, [edx + ecx + 4]
push eax
call fcn.00493d00
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
push 1
push 4
mov edx, dword [ebp - 8]
sub edx, 1
imul edx, edx, 0x18
mov eax, dword [0x510abc]
lea ecx, [eax + edx + 0x10]
push ecx
call fcn.00493d00
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
push 1
push 4
mov eax, dword [ebp - 8]
sub eax, 1
shl eax, 5
mov ecx, dword [0x510ad0]
lea edx, [ecx + eax + 4]
push edx
call fcn.00493d00
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
push 1
push 4
mov ecx, dword [ebp - 8]
sub ecx, 1
shl ecx, 5
mov edx, dword [0x510ad0]
lea eax, [edx + ecx + 8]
push eax
call fcn.00493d00
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
push 1
push 4
mov edx, dword [ebp - 8]
sub edx, 1
shl edx, 5
mov eax, dword [0x510ad0]
lea ecx, [eax + edx + 0xc]
push ecx
call fcn.00493d00
add esp, 0x10
jmp 0x470595
mov edx, dword [ebp - 4]
push edx
call fcn.00493af0
add esp, 4
mov eax, dword [str.rs232.dat]
push eax
call fcn.004307b0
add esp, 4
test eax, eax
je 0x470696
mov ecx, dword [str.rs232.dat]
push ecx
push str.save__s_to_flash_failed_n
call fcn.0048c1d0
add esp, 8
or eax, 0xffffffff
jmp 0x470698
xor eax, eax
add esp, 8
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x4706b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
push 0x507bfc
mov eax, dword [str.rs232.dat]
push eax
call fcn.004943f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4706ef
or eax, 0xffffffff
jmp 0x47081c
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00494fe0
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.00494c20
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x47073b
mov eax, dword [str.rs232.dat]
push eax
push str.The_file__s_is_empty_n
call fcn.0048c1d0
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.00493af0
add esp, 4
or eax, 0xffffffff
jmp 0x47081c
mov dword [ebp - 8], 1
jmp 0x47074d
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 6
jg 0x47080e
mov eax, dword [ebp - 4]
push eax
push 1
push 4
mov ecx, dword [ebp - 8]
sub ecx, 1
imul ecx, ecx, 0x18
mov edx, dword [0x510abc]
lea eax, [edx + ecx + 4]
push eax
call fcn.00494bc0
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
push 1
push 4
mov edx, dword [ebp - 8]
sub edx, 1
imul edx, edx, 0x18
mov eax, dword [0x510abc]
lea ecx, [eax + edx + 0x10]
push ecx
call fcn.00494bc0
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
push 1
push 4
mov eax, dword [ebp - 8]
sub eax, 1
shl eax, 5
mov ecx, dword [0x510ad0]
lea edx, [ecx + eax + 4]
push edx
call fcn.00494bc0
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
push 1
push 4
mov ecx, dword [ebp - 8]
sub ecx, 1
shl ecx, 5
mov edx, dword [0x510ad0]
lea eax, [edx + ecx + 8]
push eax
call fcn.00494bc0
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
push 1
push 4
mov edx, dword [ebp - 8]
sub edx, 1
shl edx, 5
mov eax, dword [0x510ad0]
lea ecx, [eax + edx + 0xc]
push ecx
call fcn.00494bc0
add esp, 0x10
jmp 0x470744
mov edx, dword [ebp - 4]
push edx
call fcn.00493af0
add esp, 4
xor eax, eax
add esp, 0xc
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x471890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push edi
lea edi, [ebp - 0x58]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x50beb0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x508058
mov eax, dword [str.community.dat]
push eax
call fcn.004943f0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4718e1
push 0x50805c
call fcn.0048c1d0
add esp, 4
or eax, 0xffffffff
jmp 0x471a22
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00494fe0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call fcn.00494c20
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x471927
mov eax, dword [ebp - 8]
push eax
call fcn.00493af0
add esp, 4
push str.The_file_overlapTable.dat_is_empty_n
call fcn.0048c1d0
add esp, 4
or eax, 0xffffffff
jmp 0x471a22
mov eax, dword [ebp - 0xc]
sub eax, 0x20
xor edx, edx
mov ecx, 0x30
div ecx
mov word [0x510ade], ax
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00494fe0
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
push 1
push 0x20
lea ecx, [ebp - 0x30]
push ecx
call fcn.00494bc0
add esp, 0x10
push 0x14
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.00418440
add esp, 0xc
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
lea edx, [ebp - 0x4c]
push edx
push 0x510ae8
call fcn.0044b570
add esp, 0xc
mov byte [ebp - 0x55], 0
jmp 0x471998
mov al, byte [ebp - 0x55]
add al, 1
mov byte [ebp - 0x55], al
movzx ecx, byte [ebp - 0x55]
movsx edx, word [0x510ade]
cmp ecx, edx
jge 0x471a14
mov eax, dword [ebp - 8]
push eax
push 1
push 0x10
movzx ecx, byte [ebp - 0x55]
shl ecx, 4
add ecx, dword [0x510ae4]
push ecx
call fcn.00494bc0
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
push 1
push 0x20
lea eax, [ebp - 0x30]
push eax
call fcn.00494bc0
add esp, 0x10
push 0x14
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.00418440
add esp, 0xc
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
push eax
lea ecx, [ebp - 0x4c]
push ecx
movzx edx, byte [ebp - 0x55]
shl edx, 4
mov eax, dword [0x510ae4]
lea ecx, [eax + edx + 4]
push ecx
call fcn.0044b570
add esp, 0xc
jmp 0x471990
mov edx, dword [ebp - 8]
push edx
call fcn.00493af0
add esp, 4
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x471a4c]
call fcn.00492460
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004932b0
add esp, 0x58
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret
Function at 0x471a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
lea edi, [ebp - 0x38]
mov ecx, 0xe
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x50beb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
push 0x5080a0
mov eax, dword [str.community.dat]
push eax
call fcn.004943f0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x471ad8
push str.open_community_file_error__n
call fcn.0048c1d0
add esp, 4
or eax, 0xffffffff
jmp 0x471bcf
push 0x20
push 0
lea ecx, [ebp - 0x30]
push ecx
call fcn.00493230
add esp, 0xc
push 0x20
lea edx, [ebp - 0x30]
push edx
movsx eax, word [0x510aec]
push eax
mov ecx, dword [0x510ae8]
push ecx
call fcn.004180b0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
push 1
push 0x20
lea eax, [ebp - 0x30]
push eax
call fcn.00493d00
add esp, 0x10
mov byte [ebp - 0x35], 0
jmp 0x471b2b
mov cl, byte [ebp - 0x35]
add cl, 1
mov byte [ebp - 0x35], cl
movzx edx, byte [ebp - 0x35]
movsx eax, word [0x510ade]
cmp edx, eax
jge 0x471bb2
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x10
movzx edx, byte [ebp - 0x35]
shl edx, 4
add edx, dword [0x510ae4]
push edx
call fcn.00493d00
add esp, 0x10
push 0x20
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.00493230
add esp, 0xc
push 0x20
lea ecx, [ebp - 0x30]
push ecx
movzx edx, byte [ebp - 0x35]
shl edx, 4
mov eax, dword [0x510ae4]
movsx ecx, word [eax + edx + 8]
push ecx
movzx edx, byte [ebp - 0x35]
shl edx, 4
mov eax, dword [0x510ae4]
mov ecx, dword [eax + edx + 4]
push ecx
call fcn.004180b0
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
push 1
push 0x20
lea eax, [ebp - 0x30]
push eax
call fcn.00493d00
add esp, 0x10
jmp 0x471b22
mov ecx, dword [ebp - 8]
push ecx
call fcn.00493af0
add esp, 4
mov edx, dword [str.community.dat]
push edx
call fcn.004307b0
add esp, 4
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x471bfc]
call fcn.00492460
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004932b0
add esp, 0x38
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret

Function at 0x472a00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
push 0x508308
push str.shadowTable.dat
call fcn.004943f0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x472a48
push str.Error:_The_file_shadowTable.dat_was_not_opened___n
call fcn.0048c1d0
add esp, 4
or eax, 0xffffffff
jmp 0x472a8c
mov dword [ebp - 4], 0
jmp 0x472a5a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jge 0x472a7e
mov ecx, dword [ebp - 8]
push ecx
push 1
push 4
mov edx, dword [ebp - 4]
mov eax, dword [0x510b04]
lea ecx, [eax + edx*4]
push ecx
call fcn.00494bc0
add esp, 0x10
jmp 0x472a51
mov edx, dword [ebp - 8]
push edx
call fcn.00493af0
add esp, 4
xor eax, eax
add esp, 8
cmp ebp, esp
call fcn.00492430
mov esp, ebp
pop ebp
ret