joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411120
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x30
push eax
push 0x480e90
call fcn.00450dd0
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, str.Init_OpenGL
add esp, 0xc
test ecx, ecx
je 0x4111e9
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4111e9
lea esi, [ecx + 1]
push esi
call fcn.00450d2b
mov edi, eax
push esi
push str.Init_OpenGL
push edi
call fcn.00450dd0
push edi
push 0x483838
call fcn.00407c90
mov eax, dword [0x483958]
add esp, 0x18
test eax, eax
je 0x4111e9
mov edx, dword [0x48383c]
dec edx
push edx
push 0x483838
call fcn.00407cf0
mov edx, eax
add esp, 8
test edx, edx
je 0x4111ca
lea eax, [esp + 0x18]
push 0
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [0x483950]
push edx
push ecx
call ebx
mov eax, dword [0x483950]
lea edx, [esp + 0x18]
push 0
push edx
push 2
push 0x46b2f4
push eax
call ebx
mov ecx, dword [0x483950]
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
call fcn.0040f6d0
add esp, 4
test eax, eax
je 0x411201
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, str.Done
test eax, eax
je 0x4112a6
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4112a6
lea esi, [ecx + 1]
push esi
call fcn.00450d2b
mov edi, eax
push esi
push str.Done
push edi
call fcn.00450dd0
push edi
push 0x483838
call fcn.00407c90
mov eax, dword [0x483958]
add esp, 0x18
test eax, eax
je 0x4112a6
mov ecx, dword [0x48383c]
dec ecx
push ecx
push 0x483838
call fcn.00407cf0
mov edx, eax
add esp, 8
test edx, edx
je 0x411287
lea eax, [esp + 0x18]
push 0
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [0x483950]
push edx
push ecx
call ebx
mov eax, dword [0x483950]
lea edx, [esp + 0x18]
push 0
push edx
push 2
push 0x46b2f4
push eax
call ebx
mov ecx, dword [0x483950]
push ecx
call ebp
mov eax, fcn.00409a00
pop edi
pop esi
mov dword [0x481dd4], eax
mov dword [0x4839d0], eax
mov dword [0x483edc], eax
mov dword [0x47f780], eax
pop ebp
mov dword [0x47db3c], 0x40f450
mov dword [0x47f7a4], 0x40f420
mov dword [0x47f768], 0x40f480
mov dword [0x4839b4], 0x40f4f0
mov dword [0x4839c4], 0x40f4a0
mov dword [0x47f904], 0x40f570
mov dword [0x483b14], 0x410110
mov dword [0x47f73c], 0x4101d0
mov dword [0x483978], 0x4100d0
mov dword [0x484ee4], 0x4100f0
mov dword [0x483ff4], 0x40ead0
mov dword [0x4819c0], 0x40fec0
mov dword [0x47dff8], 0x4109d0
mov dword [0x481530], 0x4110b0
mov dword [0x47f730], 0x4110e0
mov dword [0x47dfec], 0x410040
mov dword [0x47e008], 0x410080
mov dword [0x484ea8], 0x40fdc0
mov dword [0x46b734], 0x3f800000
mov dword [0x485514], 0
mov eax, 1
pop ebx
ret
Function at 0x413a90
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x413ac3
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.00450d2b
add esp, 4
lea ecx, [esp + 0xc]
mov esi, eax
push 0
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esi], 0x43505247
jne 0x413b6e
mov edx, dword [esi + 8]
mov eax, dword [esp + 0xc]
add edx, 0xc
cmp edx, eax
je 0x413b11
push esi
call fcn.00450d9f
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esi + 4]
push eax
call fcn.00450d2b
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
mov ebx, eax
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x1c], edx
push eax
push ecx
lea edx, [esi + 0xc]
push ebx
push edx
call fcn.004081c0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esi + 4]
add esp, 0x14
cmp eax, ecx
push esi
je 0x413b64
call fcn.00450d9f
push ebx
call fcn.00450d9f
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
call fcn.00450d9f
add esp, 4
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
cmp eax, 0x30505247
jne 0x413b86
push esi
call fcn.00413910
jmp 0x413b9a
cmp eax, 0x31505247
push esi
jne 0x413b95
call fcn.004139b0
jmp 0x413b9a
call fcn.00413870
mov eax, dword [esi]
add esp, 4
cmp eax, 0x2046464f
jne 0x413bc7
mov ecx, dword [esi + 0xc]
xor eax, eax
test ecx, ecx
jbe 0x413bc7
xor ecx, ecx
mov edx, dword [esi + 0x10]
inc eax
mov dword [edx + ecx + 0x28], 0
mov edx, dword [esi + 0xc]
add ecx, 0x30
cmp eax, edx
jb 0x413bb1
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x415f10
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x415f39
xor eax, eax
pop edi
ret
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.00450d2b
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 0x10]
mov edx, dword [esi]
add edi, esi
xor ecx, ecx
test edx, edx
mov dword [esi + 0x10], edi
mov eax, edi
jle 0x415f8e
add eax, 0x2c
mov edx, dword [eax]
add eax, 0x30
add edx, esi
inc ecx
mov dword [eax - 0x30], edx
mov edx, dword [esi]
cmp ecx, edx
jl 0x415f7d
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x415fa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.DATA_soundmathSND.lst
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x415fcb
xor eax, eax
pop edi
pop ecx
ret
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.00450d2b
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push 0
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 0x10]
mov edx, dword [esi]
add edi, esi
xor ecx, ecx
test edx, edx
mov dword [esi + 0x10], edi
mov eax, edi
jle 0x416020
add eax, 0x2c
mov edx, dword [eax]
add eax, 0x30
add edx, esi
inc ecx
mov dword [eax - 0x30], edx
mov edx, dword [esi]
cmp ecx, edx
jl 0x41600f
mov eax, esi
pop esi
pop ebx
pop edi
pop ecx
ret
Function at 0x418590
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push 0
push eax
push 0x2bc
push edi
push esi
call ebx
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
lea eax, [edx + ecx*4]
shl eax, 2
push eax
call fcn.00450d2b
add esp, 4
test eax, eax
jne 0x4185d5
mov ecx, 0xaf
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
ret
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
shl ecx, 2
mov dword [edi + 0xc], eax
add eax, ecx
mov dword [edi + 0x10], eax
push 0
lea eax, [eax + edx*4]
lea edx, [esp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [edi + 0xc]
push edx
push ecx
push eax
push esi
call ebx
mov ecx, dword [edi + 4]
xor eax, eax
test ecx, ecx
jle 0x418621
push ebp
mov ecx, dword [edi + 0xc]
mov edx, dword [0x4853e0]
mov ebp, dword [ecx + eax*4]
lea ecx, [ecx + eax*4]
add ebp, edx
inc eax
mov dword [ecx], ebp
mov ecx, dword [edi + 4]
cmp eax, ecx
jl 0x418605
pop ebp
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0x10]
lea eax, [esp + 0x14]
push 0
shl ecx, 2
push eax
push ecx
push edx
push esi
call ebx
lea eax, [esp + 0x14]
push 0
mov edx, dword [edi + 0x14]
push eax
mov eax, dword [edi + 8]
lea ecx, [eax + eax*2]
shl ecx, 2
push ecx
push edx
push esi
call ebx
mov eax, dword [edi]
test al, 0x10
je 0x41866a
mov dword [edi + 0x54], 1
mov ecx, dword [0x47f708]
shr eax, 0x1c
mov dword [edi + 0x50], ecx
mov dword [edi + 0x60], eax
pop edi
pop esi
pop ebx
ret

Function at 0x418670
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0xcccccccd
mov ecx, dword [0x4853e0]
push esi
mov esi, dword [esp + 0x18]
mul esi
mov eax, dword [0x4853d0]
shr edx, 3
cmp edx, eax
je 0x4186a6
mov eax, dword [esp + 0x14]
push 1
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
add esp, 0xc
ret
test edx, edx
jbe 0x418736
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea edi, [ecx + 0x1c]
lea esi, [ecx + 0xc]
mov dword [esp + 0x24], edx
lea ecx, [esp + 0x20]
push 0
push ecx
lea edx, [esp + 0x18]
push 0xa
push edx
push ebx
call ebp
mov eax, dword [esp + 0x10]
test ax, ax
je 0x418722
test ah, 0x10
je 0x4186ec
or byte [esi + 1], 0x10
mov eax, dword [esp + 0x10]
test ah, 0x20
je 0x4186f9
or byte [esi + 1], 0x20
mov eax, dword [esp + 0x10]
test ah, 0x40
je 0x418706
or byte [esi + 1], 0x40
mov eax, dword [esp + 0x10]
test ah, 1
je 0x418713
or byte [esi + 1], 1
mov eax, dword [esp + 0x10]
test ah, 2
je 0x418722
or byte [esi + 1], 2
mov eax, dword [esp + 0x12]
mov dword [edi], eax
mov eax, dword [esp + 0x24]
add esi, 0x24
add edi, 0x24
dec eax
mov dword [esp + 0x24], eax
jne 0x4186c5
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x41a120
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x41a22a
mov edi, dword [esp + 0x14]
test edi, edi
je 0x41a22a
mov cx, word [esi + 6]
cmp cx, word [edi + 6]
jne 0x41a22a
xor eax, eax
xor edx, edx
mov ax, word [esi + 8]
mov dx, word [edi + 8]
and ecx, 0xffff
lea eax, [eax + edx + 1]
imul eax, ecx
mov ecx, dword [esi + 0x24]
lea eax, [eax + eax*2]
shl eax, 2
push eax
push ecx
call fcn.004513a0
mov ebx, eax
xor edx, edx
mov dx, word [esi + 8]
xor eax, eax
mov ax, word [edi + 8]
lea eax, [edx + eax + 1]
mov edx, dword [esi + 0x28]
lea ecx, [eax + eax*2]
shl ecx, 3
push ecx
push edx
call fcn.004513a0
add esp, 0x10
test ebx, ebx
je 0x41a22a
xor ecx, ecx
mov dword [esi + 0x24], ebx
mov cx, word [esi + 6]
test eax, eax
lea edx, [ecx + ecx*2]
lea edx, [ebx + edx*4]
mov dword [esi + 0x14], edx
je 0x41a22a
mov dword [esi + 0x28], eax
add eax, 0x18
mov dword [esi + 0x18], eax
xor eax, eax
mov ax, word [edi + 8]
imul eax, ecx
lea eax, [eax + eax*2]
shl eax, 2
push eax
mov eax, dword [edi + 0x14]
push eax
xor eax, eax
mov ax, word [esi + 8]
imul eax, ecx
lea ecx, [eax + eax*2]
lea edx, [edx + ecx*4]
push edx
call fcn.00450dd0
xor eax, eax
mov ecx, dword [edi + 0x18]
mov ax, word [edi + 8]
lea eax, [eax + eax*2]
shl eax, 3
push eax
xor eax, eax
mov ax, word [esi + 8]
push ecx
lea edx, [eax + eax*2]
mov eax, dword [esi + 0x18]
lea ecx, [eax + edx*8]
push ecx
call fcn.00450dd0
mov cx, word [esi + 8]
mov dx, word [edi + 8]
mov eax, ecx
add esp, 0x18
and eax, 0xffff
add dx, cx
mov word [esi + 8], dx
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
Function at 0x41fee0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov ecx, 0x15
xor eax, eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebp, ebp
push edi
push ebp
mov edi, esi
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x28]
push ebp
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41ff24
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x20]
push ebp
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push ebx
call edi
lea eax, [esp + 0x20]
push ebp
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push ebx
call edi
lea edx, [esp + 0x20]
push ebp
push edx
push 0x54
push esi
push ebx
call edi
mov eax, dword [esi + 0x18]
mov dword [esi + 0x38], ebp
mov dword [esi + 0x50], ebp
lea ecx, [eax*8]
sub ecx, eax
shl ecx, 2
push ecx
call fcn.00450d2b
mov ecx, dword [esi + 0x18]
add esp, 4
lea edx, [esp + 0x20]
mov dword [esi + 0x38], eax
push ebp
push edx
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call edi
fld dword [esi + 0x2c]
fmul dword [0x4672c0]
fcom dword [0x4671bc]
fnstsw ax
test ah, 1
je 0x41ffad
fadd dword [0x4672a4]
fmul dword [0x4672f8]
call fcn.004518d4
fld dword [esi + 0x30]
fmul dword [0x4672c0]
mov dword [esi + 0x2c], eax
fcom dword [0x4671bc]
fnstsw ax
test ah, 1
je 0x41ffd7
fadd dword [0x4672a4]
fmul dword [0x4672f8]
call fcn.004518d4
fld dword [esi + 0x34]
fmul dword [0x4672c0]
mov dword [esi + 0x30], eax
fcom dword [0x4671bc]
fnstsw ax
test ah, 1
je 0x420001
fadd dword [0x4672a4]
fmul dword [0x4672f8]
call fcn.004518d4
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x18]
test eax, eax
jle 0x4200c2
mov dword [esp + 0x1c], 0
mov eax, dword [esi + 0x38]
mov ecx, dword [esp + 0x1c]
fld dword [ecx + eax + 0x10]
fmul dword [0x4672c0]
lea edi, [ecx + eax + 0x10]
fcom dword [0x4671bc]
fnstsw ax
test ah, 1
je 0x42004a
fadd dword [0x4672a4]
fmul dword [0x4672f8]
call fcn.004518d4
fld dword [edi + 4]
fmul dword [0x4672c0]
mov dword [edi], eax
fcom dword [0x4671bc]
fnstsw ax
test ah, 1
je 0x420073
fadd dword [0x4672a4]
fmul dword [0x4672f8]
call fcn.004518d4
fld dword [edi + 8]
fmul dword [0x4672c0]
mov dword [edi + 4], eax
fcom dword [0x4671bc]
fnstsw ax
test ah, 1
je 0x42009d
fadd dword [0x4672a4]
fmul dword [0x4672f8]
call fcn.004518d4
mov ecx, dword [esp + 0x1c]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x18]
inc ebp
add ecx, 0x1c
cmp ebp, eax
mov dword [esp + 0x1c], ecx
jl 0x420022
push ebx
mov dword [0x4855d0], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x42d8e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0xdc
cmp eax, 0xd8
je 0x42d912
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0xe0]
push 1
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0xdc
ret
mov eax, dword [esp + 0xe8]
push ebp
xor ebp, ebp
test eax, eax
jbe 0x42d983
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov esi, dword [esp + 0xf0]
push edi
mov edi, dword [esp + 0xf0]
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x1c]
push 0xd8
push eax
push edi
call ebx
mov ecx, dword [esp + 0x10]
push edi
sub esi, ecx
lea ecx, [esp + 0xdc]
push ecx
call fcn.00408010
lea edx, [esp + 0x1c]
push 1
push edx
sub esi, eax
call fcn.0042d640
add esp, 0x10
test esi, esi
jbe 0x42d980
mov eax, dword [esp + 0xf8]
inc ebp
cmp ebp, eax
jb 0x42d937
pop edi
pop esi
pop ebx
mov eax, dword [0x47f910]
pop ebp
cmp eax, 1
jle 0x42d9b2
push 0x42d890
push 0x42d870
dec eax
push 0xd8
push eax
mov eax, dword [0x47f920]
add eax, 0xd8
push eax
call fcn.00408440
add esp, 0x14
add esp, 0xdc
ret
Function at 0x42da20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov ecx, 0x36
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x18]
mov ecx, esi
mov eax, edi
lea ebp, [esi + 0x54]
lea ebx, [edi + 0x24]
push 0x10
mov edx, dword [eax]
push ebx
mov dword [ecx], edx
push ebp
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
lea edx, [esi + 0xc]
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
lea ecx, [edi + 0xc]
mov eax, dword [edi + 0xc]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
or eax, 0xffffffff
mov ecx, dword [ecx + 8]
mov dword [edx + 8], ecx
fld dword [edi + 0x18]
fld st(0)
fchs
fst dword [esi + 0x20]
fst dword [esi + 0x1c]
fstp dword [esi + 0x18]
fst dword [esi + 0x2c]
fst dword [esi + 0x28]
fstp dword [esi + 0x24]
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x88], eax
or ecx, 0x10000
mov dword [esi + 0x8c], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
call fcn.00450dd0
mov edx, dword [edi + 0x3c]
add esp, 0xc
mov dword [esi + 0x68], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x78], eax
mov ecx, ebx
xor edx, edx
mov al, byte [ecx]
test al, al
je 0x42dadd
cmp al, 0x61
jl 0x42dad6
cmp al, 0x7a
jg 0x42dad6
sub al, 0x20
mov byte [ecx], al
inc ecx
inc edx
cmp edx, 0x10
jl 0x42dac4
mov dword [esi + 0x50], 0x300
mov edi, dword [edi + 0x1c]
cmp edi, 4
mov dword [esp + 0x14], edi
jne 0x42daf8
mov dword [esi + 0x4c], edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, str.NEWLEVEL
xor edx, edx
mov eax, ebx
sub edi, ebx
mov cl, byte [eax]
cmp cl, byte [edi + eax]
jne 0x42db21
test cl, cl
je 0x42db15
inc eax
inc edx
cmp edx, 0x10
jl 0x42db03
mov dword [esi + 0x4c], 0x100
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, str.TELEPORTSOURCE
xor edx, edx
mov eax, ebx
sub edi, ebx
mov cl, byte [eax]
mov bl, byte [edi + eax]
cmp cl, bl
jne 0x42db4c
test cl, cl
je 0x42db40
inc eax
inc edx
cmp edx, 0x10
jl 0x42db2c
mov dword [esi + 0x4c], 0x200
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, str.TELEPORT
xor edx, edx
mov eax, ebp
sub ebx, ebp
mov cl, byte [eax]
cmp cl, byte [ebx + eax]
jne 0x42db75
test cl, cl
je 0x42db40
inc eax
inc edx
cmp edx, 0x10
jl 0x42db57
mov dword [esi + 0x4c], 0x200
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov eax, 0x1000
cmp ecx, eax
jne 0x42db8a
mov dword [esi + 0x4c], eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x4c], 5
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42dba0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
sub esp, 0x128
xor edx, edx
div ecx
push ebx
push esi
cmp ecx, 0xd8
push edi
jne 0x42dc74
test eax, eax
jle 0x42dd36
mov esi, dword [esp + 0x138]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0x18]
push 0xd8
push ecx
push esi
call edi
lea edx, [esp + 0x10]
test edx, edx
je 0x42dc68
lea ecx, [esp + 0x64]
xor edx, edx
mov al, byte [ecx]
test al, al
je 0x42dc13
cmp al, 0x61
jl 0x42dc0c
cmp al, 0x7a
jg 0x42dc0c
sub al, 0x20
mov byte [ecx], al
inc ecx
inc edx
cmp edx, 0x10
jl 0x42dbfa
mov eax, dword [0x483e88]
mov ecx, dword [0x483e8c]
cmp eax, ecx
jl 0x42dc3a
mov ecx, dword [0x483e90]
push ecx
push 0x483e88
call fcn.00407e80
add esp, 8
test eax, eax
je 0x42dc68
mov eax, dword [0x483e94]
mov ecx, dword [0x483e98]
push eax
imul eax, dword [0x483e88]
lea edx, [esp + 0x14]
add eax, ecx
push edx
push eax
call fcn.00450dd0
mov eax, dword [0x483e88]
add esp, 0xc
inc eax
mov dword [0x483e88], eax
dec ebx
jne 0x42dbd8
jmp 0x42dd36
test eax, eax
jle 0x42dd36
mov esi, dword [esp + 0x138]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esp + 0xf0]
push 0x4c
push ecx
push esi
call edi
lea edx, [esp + 0xe8]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0042da20
lea ecx, [esp + 0x18]
add esp, 8
test ecx, ecx
je 0x42dd2f
lea ecx, [esp + 0x64]
xor edx, edx
mov al, byte [ecx]
test al, al
je 0x42dcdb
cmp al, 0x61
jl 0x42dcd4
cmp al, 0x7a
jg 0x42dcd4
sub al, 0x20
mov byte [ecx], al
inc ecx
inc edx
cmp edx, 0x10
jl 0x42dcc2
mov edx, dword [0x483e88]
mov eax, dword [0x483e8c]
cmp edx, eax
jl 0x42dd01
mov eax, dword [0x483e90]
push eax
push 0x483e88
call fcn.00407e80
add esp, 8
test eax, eax
je 0x42dd2f
mov eax, dword [0x483e94]
lea ecx, [esp + 0x10]
push eax
imul eax, dword [0x483e88]
push ecx
mov ecx, dword [0x483e98]
add eax, ecx
push eax
call fcn.00450dd0
mov eax, dword [0x483e88]
add esp, 0xc
inc eax
mov dword [0x483e88], eax
dec ebx
jne 0x42dc8b
mov eax, fcn.0043b320
pop edi
pop esi
mov dword [0x4819c8], eax
mov dword [0x481dd8], eax
pop ebx
add esp, 0x128
ret
Function at 0x43b120
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x2c4
push ebx
push ebp
push esi
push edi
push 0xa
push 0xa
push 0x2b8
push 0x47d798
call fcn.00407e20
push 0x483eec
push str._sPLAYERS.LST
push 0x47e250
mov dword [0x483a68], 0xffffffff
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push 0x47e250
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x43b30e
mov eax, dword [0x47e898]
push ebx
push esi
lea ebp, [eax + 0x2b8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [esp + 0x10]
push ebx
push ecx
lea edx, [esp + 0x20]
push 4
mov edi, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edx
push esi
sub edi, 0xc
call ebx
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push esi
call ebx
lea edx, [esp + 0x10]
push 0
push edx
push 4
push 0x483a68
push esi
call ebx
mov eax, dword [esp + 0x14]
cmp eax, ebp
jne 0x43b307
mov ecx, dword [esp + 0x18]
mov edx, ecx
imul edx, eax
cmp edx, edi
jne 0x43b307
xor ebp, ebp
test ecx, ecx
jbe 0x43b2f0
jmp 0x43b20b
mov eax, dword [esp + 0x14]
mov ecx, ebp
push 0
imul ecx, eax
add ecx, 0xc
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x24]
push 0x2b8
push eax
push esi
call ebx
cmp dword [esp + 0x10], 0x2b8
jne 0x43b2e3
mov ecx, dword [0x47e898]
push ecx
call fcn.00450d2b
mov ecx, dword [0x47e898]
add esp, 4
lea edx, [esp + 0x10]
mov dword [esp + 0x2d0], eax
push 0
push edx
push ecx
push eax
push esi
call ebx
mov ecx, dword [0x47e898]
mov eax, dword [esp + 0x10]
cmp ecx, eax
je 0x43b28e
mov edi, dword [esp + 0x2d0]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x47d798]
mov ecx, dword [0x47d79c]
cmp eax, ecx
jl 0x43b2b5
mov ecx, dword [0x47d7a0]
push ecx
push 0x47d798
call fcn.00407e80
add esp, 8
test eax, eax
je 0x43b2e3
mov eax, dword [0x47d7a4]
mov edi, dword [0x47d7a8]
push eax
imul eax, dword [0x47d798]
lea edx, [esp + 0x20]
add eax, edi
push edx
push eax
call fcn.00450dd0
mov eax, dword [0x47d798]
add esp, 0xc
inc eax
mov dword [0x47d798], eax
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jb 0x43b207
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c4
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c4
ret
Function at 0x447dc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push eax
push 4
push ecx
push esi
call edi
lea edx, [esp + 0x18]
push 0
push edx
lea eax, [esp + 0x14]
push 4
push eax
push esi
call edi
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push esi
call edi
mov eax, dword [esp + 0x1c]
push 1
add eax, 0xfffffff4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop edi
mov dword [0x4856b8], 0
pop esi
add esp, 0xc
ret