joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4062d0
Capabilities:
Check for software breakpoints

Disassembly:
xor eax, eax
mov byte [0x5e9895], 0
mov al, byte [0x5e9896]
mov ax, word [eax*4 + 0x5e9898]
cmp ax, 0x64
jae 0x4062a3
cmp ax, 0x5a
jbe 0x4061fd
call dword [sym.imp.MSVCRT.dll_rand]
and eax, 0x800003ff
jns 0x4061ea
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0xcc
jge 0x4062a3
mov byte [0x5e9895], 1
ret
cmp ax, 0x50
jbe 0x40622a
call dword [sym.imp.MSVCRT.dll_rand]
and eax, 0x800003ff
jns 0x406217
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x199
jge 0x4062a3
mov byte [0x5e9895], 1
ret
cmp ax, 0x46
jbe 0x406253
call dword [sym.imp.MSVCRT.dll_rand]
and eax, 0x800003ff
jns 0x406244
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x266
jge 0x4062a3
mov byte [0x5e9895], 1
ret
cmp ax, 0x3c
jbe 0x40627c
call dword [sym.imp.MSVCRT.dll_rand]
and eax, 0x800003ff
jns 0x40626d
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x333
jge 0x4062a3
mov byte [0x5e9895], 1
ret
test ax, ax
jbe 0x4062a3
call dword [sym.imp.MSVCRT.dll_rand]
and eax, 0x800003ff
jns 0x406295
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x39a
jge 0x4062a3
mov byte [0x5e9895], 1
ret
push ebx
push ebp
push esi
push edi
mov ecx, 0x5e9898
mov esi, 0x65343c
mov edi, dword [0x652130]
mov ebx, dword [esi]
mov eax, dword [edi + 0x34]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
sub eax, ebx
test eax, eax
mov dword [ecx], eax
jg 0x406302
mov dword [ecx], 0x64
jmp 0x406311
cdq
idiv dword [edi + 0x34]
mov edx, 0x32
sub edx, eax
shl edx, 1
mov dword [ecx], edx
cmp dword [ecx], 0
jge 0x40631c
mov dword [ecx], 0
add esi, 0x7d0
add ecx, 4
cmp esi, 0x65537c
jl 0x4062de
mov edi, dword [0x5e9898]
mov ebp, dword [sym.imp.MSVCRT.dll_rand]
mov ebx, 1
mov byte [0x5e9896], 0
mov esi, 0x5e989c
mov eax, dword [esi]
cmp edi, eax
jl 0x406371
jne 0x406369
call ebp
and eax, 0x800003ff
jns 0x406362
dec eax
or eax, 0xfffffc00
inc eax
cmp eax, 0x200
jg 0x406371
mov edi, dword [esi]
mov byte [0x5e9896], bl
add esi, 4
inc ebx
cmp esi, 0x5e98a8
jl 0x40634a
mov eax, dword [0x652130]
pop edi
pop esi
pop ebp
mov ecx, dword [eax + 0x3c]
pop ebx
cmp ecx, 3
jge 0x406395
mov byte [0x5e9896], 0
jmp 0x4061b0
Function at 0x407790
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
push esi
push edi
call fcn.00401950
push 0
push 0x3ff00000
push 0
push 0
mov edi, eax
mov eax, dword [0x6349a8]
push 0x3e8
push 0
push 0xd
push eax
push 0x145
push 0xffffff47
push edi
mov dword [esp + 0x34], edi
call fcn.00401b10
add esp, 0x2c
mov esi, 0x14
push 0
push 0x1e
push edi
call fcn.004026c0
add esp, 0xc
call fcn.004454f0
dec esi
jne 0x4077d2
mov ecx, dword [0x66c0a8]
mov edx, dword [0x66c0d0]
push ebx
push ebp
push 0
push 0x407970
push ecx
push 0x85
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ecx, dword [0x66c0a8]
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], edx
mov edx, dword [0x66c0a8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
push ecx
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov esi, 1
sub ecx, edi
push esi
sub edx, eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
add eax, 0xec
push edx
add ecx, 0x17c
push eax
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x3e8
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004454f0
push esi
call fcn.004234d0
add esp, 4
test eax, eax
jne 0x4078ba
call fcn.00423520
test eax, eax
je 0x4078c0
mov dword [0x5e9cc0], esi
cmp dword [0x66c0e0], esi
je 0x4078da
mov eax, dword [0x5e9cc0]
test eax, eax
jne 0x4078da
mov eax, dword [0x5e98b0]
test eax, eax
je 0x40789f
mov ebp, dword [esp + 0x40]
push 0x14
push ebp
push 0x3e8
push ebx
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40791b
mov edi, str._IGS_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop ebp
mov esi, 0x14
pop ebx
mov eax, dword [esp + 8]
push 0
push 0x1e
push eax
call fcn.004026c0
add esp, 0xc
call fcn.004454f0
dec esi
jne 0x407929
mov ecx, dword [esp + 8]
push ecx
call fcn.00401a90
mov ecx, dword [0x5e9cc0]
add esp, 4
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
add esp, 0x2c
ret
Function at 0x409c20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x88
push ebx
push ebp
push esi
mov esi, dword [esp + 0x98]
test esi, esi
push edi
jl 0x409c4b
cmp esi, 0xa
jge 0x409c4b
lea eax, [esi + esi*4]
lea ecx, [esi + eax*2]
mov al, byte [ecx*4 + 0x6347d8]
test al, al
jne 0x409c58
push 0x493004
call fcn.00445450
add esp, 4
mov edi, dword [esp + 0xa0]
lea edx, [esi + esi*4]
push 0x4921c8
push edi
lea eax, [esi + edx*2]
lea esi, [eax*4 + 0x6347d8]
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x409c90
push edi
push 0x492ff0
call fcn.00445450
add esp, 8
mov ecx, dword [esi + 0x14]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
lea edx, [esp + 0x20]
push 0x80
push edx
call ebp
mov eax, dword [esp + 0x2c]
mov ebx, dword [sym.imp.MSVCRT.dll_fclose]
and eax, 0xffff
add esp, 0x10
sub eax, 0xaf11
je 0x409cf3
dec eax
je 0x409cda
mov eax, dword [esi + 0x14]
push eax
call ebx
push edi
push 0x492fd8
call fcn.00445450
add esp, 0xc
jmp 0x409cfa
mov eax, dword [esp + 0x68]
mov ecx, dword [esi + 0x14]
push 0
push eax
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
jmp 0x409cfa
mov dword [esi + 0x10], 0x80
cmp word [esp + 0x1c], 0xaf11
jne 0x409d1c
mov eax, dword [esp + 0x28]
mov dx, word [esp + 0x1e]
cmp ax, 1
mov word [esi + 2], dx
mov word [esi + 4], ax
jae 0x409d54
jmp 0x409d4e
mov ecx, dword [esp + 0x28]
mov ax, word [esp + 0x1e]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
fild qword [esp + 0x10]
mov word [esi + 2], ax
fmul qword [0x485658]
call sub.MSVCRT.dll__ftol
cmp ax, 1
mov word [esi + 4], ax
jae 0x409d54
mov word [esi + 4], 1
xor edx, edx
mov dx, word [esi + 4]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fmul qword [0x485650]
fdivr qword [0x485648]
fdivr qword [0x485648]
call sub.MSVCRT.dll__ftol
mov word [esi + 4], ax
mov eax, dword [esp + 0xa4]
xor edi, edi
cmp eax, edi
jne 0x409db3
mov eax, dword [esp + 0x18]
push eax
call fcn.004225a0
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0x1c]
push ecx
push 1
push edx
push eax
mov dword [esi + 0x18], eax
call ebp
mov eax, dword [esi + 0x14]
push eax
call ebx
add esp, 0x18
mov dword [esi + 0x14], edi
jmp 0x409db6
mov dword [esi + 0x18], edi
push 0x200
call fcn.004225a0
push 0x10
mov dword [esi + 0x1c], eax
call fcn.004225a0
mov dword [esi + 0x20], eax
mov byte [eax], 0
mov ecx, dword [esi + 0x20]
mov dx, word [esp + 0x28]
mov word [ecx + 2], dx
mov eax, dword [esi + 0x20]
mov cx, word [esp + 0x2a]
mov word [eax + 4], cx
mov edx, dword [esp + 0x2a]
mov eax, dword [esp + 0x28]
and edx, 0xffff
and eax, 0xffff
imul edx, eax
push edx
call fcn.004225a0
mov ecx, dword [esi + 0x20]
add esp, 0xc
mov dword [ecx + 8], eax
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
pop edi
mov dword [edx + 0xc], eax
mov byte [esi], 4
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
Function at 0x40ac50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x224
push ebp
push esi
push edi
mov byte [esp + 0xc], 1
mov byte [esp + 0xd], 0
mov byte [esp + 0xe], 0
mov byte [esp + 0xf], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x14], 1
mov byte [esp + 0x15], 1
mov byte [esp + 0x16], 1
mov byte [esp + 0x17], 1
mov byte [esp + 0x18], 1
mov byte [esp + 0x19], 1
call fcn.0040aac0
push str.IGSMJ_P.SAV
push 0x66c0e4
lea eax, [esp + 0x134]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x13c]
push 0x4921c8
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 0x18
test ebp, ebp
je 0x40ad80
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push ebp
push 1
lea edx, [esp + 0x28]
push 8
push edx
call ebx
add esp, 0x10
mov ecx, 2
mov edi, str.IGSMJP07
lea esi, [esp + 0x20]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x40ad75
push ebp
push 1
lea ecx, [esp + 0x28]
push 8
push ecx
call ebx
push ebp
push 1
lea edx, [esp + 0x40]
push 4
push edx
call ebx
add esp, 0x20
mov ecx, 2
mov edi, str.SETTING
lea esi, [esp + 0x20]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x40ad4e
push ebp
push 1
push 0x2868
push 0x634bc8
call ebx
add esp, 0x10
jmp 0x40ad0b
mov ecx, 2
mov edi, str.FILE_END
lea esi, [esp + 0x20]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40ad75
mov eax, dword [esp + 0x28]
push 1
push eax
push ebp
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
jmp 0x40ad0b
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop ebx
mov edi, str.SoftwareIGSIGSMJ
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push 0x20019
push 0
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40add2
mov byte [0x634bc8], 1
call fcn.0040aea0
mov al, byte [0x634bc8]
test al, al
je 0x40adf7
mov eax, 0x1010101
mov dword [0x634990], eax
mov dword [0x634994], eax
mov dword [0x634998], eax
mov word [0x63499c], ax
jmp 0x40ae55
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [0x634990], ecx
mov cx, word [esp + 0x18]
mov dword [0x634994], edx
mov word [0x63499c], cx
mov dword [0x634998], eax
xor ecx, ecx
xor edx, edx
mov dl, byte [ecx + 0x634bd8]
mov al, byte [edx + 0x634990]
test al, al
jne 0x40ae4f
lea eax, [edx + 1]
mov esi, 0xe
cdq
idiv esi
mov al, byte [edx + 0x634990]
test al, al
je 0x40ae34
mov byte [ecx + 0x634bd8], dl
inc ecx
cmp ecx, 4
jl 0x40ae22
call fcn.0040af70
call fcn.0040b070
pop edi
pop esi
test eax, eax
pop ebp
je 0x40ae80
push 0x634b70
call fcn.0041a1f0
add esp, 4
test eax, eax
jne 0x40ae8a
call fcn.0040b070
test eax, eax
jne 0x40ae66
mov dword [0x66c0e0], 1
add esp, 0x224
ret
Function at 0x40aea0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
push esi
call fcn.0040b420
push str.IGSMJ_P.SAV
push 0x66c0e4
lea eax, [esp + 0x10]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x18]
push 0x4933a8
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40af5c
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
push esi
push 1
push 8
push str.IGSMJP07
call edi
push esi
push 1
push 8
push str.SETTING
mov dword [esp + 0x28], 0x2868
call edi
push esi
push 1
lea edx, [esp + 0x30]
push 4
push edx
call edi
push esi
push 1
push 0x2868
push 0x634bc8
call edi
add esp, 0x40
mov dword [esp + 8], 0
push esi
push 1
push 8
push str.FILE_END
call edi
push esi
push 1
lea eax, [esp + 0x20]
push 4
push eax
call edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
mov eax, 1
pop edi
pop esi
add esp, 0x108
ret
xor eax, eax
pop esi
add esp, 0x108
ret

Function at 0x40af70
Capabilities:
Get common file path
Read file on windows

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 7], 0x5c
je 0x40afb1
lea ecx, [esp + 8]
lea edx, [esp + 0x10c]
push ecx
push str._sigsmj2002.no
push edx
jmp 0x40afc3
lea eax, [esp + 8]
lea ecx, [esp + 0x10c]
push eax
push 0x4933ac
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x10c]
push 0x4921c8
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x40b019
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
push 0x51
push 0x634b70
call edi
push esi
push 1
push 0x51
push 0x634b1c
call edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
pop edi
pop esi
add esp, 0x208
ret
mov edi, 0x637434
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x634b70
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.mj.chinesegamer.net
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x634b1c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x208
ret
Function at 0x40b420
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 7], 0x5c
je 0x40b461
lea ecx, [esp + 8]
lea edx, [esp + 0x10c]
push ecx
push str._sigsmj2002.no
push edx
jmp 0x40b473
lea eax, [esp + 8]
lea ecx, [esp + 0x10c]
push eax
push 0x4933ac
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x10c]
push 0x4933a8
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x40b4c0
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
push esi
push 1
push 0x51
push 0x634b70
call edi
push esi
push 1
push 0x51
push 0x634b1c
call edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x24
pop edi
pop esi
add esp, 0x208
ret
Function at 0x411ed0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x94
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa4]
push 0x4921c8
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
xor ebp, ebp
add esp, 8
cmp ebx, ebp
mov dword [esp + 0xc], ebx
jne 0x411f15
push esi
push 0x493658
call fcn.00445450
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
push ebx
push 0x80
lea eax, [esp + 0x28]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 0x80
jne 0x4120f7
cmp byte [esp + 0x20], 0xa
jne 0x4120f7
cmp byte [esp + 0x21], 5
jne 0x4120f7
push edi
push 0x10
call fcn.004225a0
mov esi, eax
mov dword [esp + 0x24], esi
mov byte [esi], 0
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
inc ecx
mov word [esi + 2], cx
mov edx, dword [esp + 0x32]
sub edx, dword [esp + 0x2e]
movsx ecx, cx
lea eax, [edx + 1]
movsx edx, ax
imul ecx, edx
push ecx
mov word [esi + 4], ax
call fcn.004225a0
add esp, 8
cmp word [esi + 4], bp
mov edi, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jle 0x412040
xor ebp, ebp
push ebx
call dword [sym.imp.MSVCRT.dll_fgetc]
mov cl, al
add esp, 4
and cl, 0xc0
cmp cl, 0xc0
jne 0x4120ee
mov edx, dword [esp + 0x10]
and al, 0x3f
push edx
mov bl, al
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
mov cl, bl
dec bl
test cl, cl
mov byte [esp + 0x1c], bl
je 0x412010
mov esi, dword [esp + 0x1c]
mov bl, al
and esi, 0xff
add edi, ebp
inc esi
mov bh, bl
mov ecx, esi
mov eax, ebx
mov edx, ecx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
add ebp, esi
mov esi, dword [esp + 0x20]
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x66]
and eax, 0xffff
cmp ebp, eax
jl 0x411fa7
movsx ecx, word [esi + 2]
mov eax, dword [esp + 0x14]
add edi, ecx
movsx edx, word [esi + 4]
inc eax
mov dword [esp + 0x18], edi
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x411fa5
mov eax, dword [esp + 0xac]
test eax, eax
je 0x4120d1
push 0x200
call fcn.004225a0
push 0x300
mov dword [esi + 0xc], eax
call fcn.004225e0
push ebx
mov edi, eax
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 0xc
cmp eax, 0xc
jne 0x4120d1
push ebx
push 0x300
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 0x300
jne 0x4120d1
xor ecx, ecx
lea eax, [edi + 2]
mov dl, byte [eax - 2]
add ecx, 2
and dl, 0xf8
add eax, 3
movzx di, dl
mov dl, byte [eax - 4]
and dl, 0xf8
movzx dx, dl
shl edi, 5
add edi, edx
mov dl, byte [eax - 3]
shr dl, 3
movzx dx, dl
cmp ecx, 0x200
lea edx, [edx + edi*4]
mov edi, dword [esi + 0xc]
mov word [ecx + edi - 2], dx
jl 0x412095
push esi
call fcn.00411e50
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
mov byte [edi + ebp], al
inc ebp
jmp 0x412014
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
push esi
push 0x493640
call fcn.00445450
add esp, 0xc
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
Function at 0x412ae0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x94
push ebx
push ebp
mov ebp, dword [esp + 0xa0]
push esi
push edi
push ebp
push 0x80
lea eax, [esp + 0x2c]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push 0x10
call fcn.004225a0
mov esi, eax
mov dword [esp + 0x30], esi
mov byte [esi], 0
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
inc ecx
mov word [esi + 2], cx
mov edx, dword [esp + 0x42]
mov ebx, dword [esp + 0x3e]
mov dword [esi + 0xc], 0
sub edx, ebx
inc edx
movsx eax, dx
movsx ecx, cx
imul eax, ecx
push eax
mov word [esi + 4], dx
call fcn.004225a0
mov edx, dword [esp + 0xc4]
mov dword [esi + 8], eax
lea edi, [edx - 0x80]
push edi
call fcn.004225e0
push ebp
mov ebx, eax
push 1
push edi
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
mov edi, dword [esi + 8]
add esp, 0x2c
cmp word [esi + 4], 0
mov ecx, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 0
jle 0x412c14
xor ebp, ebp
mov al, byte [ecx]
inc ecx
mov dl, al
and dl, 0xc0
cmp dl, 0xc0
jne 0x412be4
mov dl, byte [ecx]
and al, 0x3f
inc ecx
mov bl, al
dec al
mov dword [esp + 0x20], ecx
test bl, bl
mov byte [esp + 0x18], al
je 0x412be8
mov esi, dword [esp + 0x18]
mov al, dl
and esi, 0xff
mov bl, al
add edi, ebp
inc esi
mov bh, bl
mov ecx, esi
mov eax, ebx
mov edx, ecx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
add ebp, esi
mov esi, dword [esp + 0x1c]
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
jmp 0x412be8
mov byte [edi + ebp], al
inc ebp
mov eax, dword [esp + 0x66]
and eax, 0xffff
cmp ebp, eax
jl 0x412b87
movsx edx, word [esi + 2]
mov eax, dword [esp + 0x14]
add edi, edx
movsx edx, word [esi + 4]
inc eax
mov dword [esp + 0x10], edi
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x412b85
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret

Function at 0x412c30
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push edi
push 4
push 1
push eax
call ebx
push edi
push 4
lea ecx, [esp + 0x24]
push 1
push ecx
call ebx
push 0x10
call fcn.004225a0
mov esi, eax
mov byte [esi], 1
mov dx, word [esp + 0x38]
mov word [esi + 2], dx
mov ax, word [esp + 0x30]
movsx ecx, ax
movsx edx, dx
imul ecx, edx
shl ecx, 1
push ecx
mov word [esi + 4], ax
mov dword [esi + 0xc], 0
call fcn.004225a0
movsx ecx, word [esi + 4]
movsx edx, word [esi + 2]
imul ecx, edx
push edi
push 1
shl ecx, 1
push ecx
push eax
mov dword [esi + 8], eax
call ebx
add esp, 0x38
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x412cb0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push edi
push 4
push 1
push eax
call ebx
push edi
push 4
lea ecx, [esp + 0x24]
push 1
push ecx
call ebx
push 0x10
call fcn.004225a0
mov esi, eax
mov byte [esi], 2
mov dx, word [esp + 0x38]
mov word [esi + 2], dx
mov ax, word [esp + 0x30]
movsx ecx, ax
movsx edx, dx
imul ecx, edx
shl ecx, 1
push ecx
mov word [esi + 4], ax
mov dword [esi + 0xc], 0
call fcn.004225a0
movsx ecx, word [esi + 4]
movsx edx, word [esi + 2]
imul ecx, edx
push edi
push 1
shl ecx, 1
push ecx
push eax
mov dword [esi + 8], eax
call ebx
add esp, 0x38
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x412e30
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x10
call fcn.004225a0
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
push ebx
push 1
push 2
lea edi, [esi + 2]
mov byte [esi], 0
push edi
call ebp
push ebx
lea eax, [esi + 4]
push 1
push 2
push eax
call ebp
movsx eax, word [esi + 4]
movsx ecx, word [edi]
imul eax, ecx
push eax
mov dword [esi + 0xc], 0
call fcn.004225a0
mov edx, dword [esp + 0x40]
mov dword [esi + 8], eax
lea edi, [edx - 4]
push edi
call fcn.004225e0
push ebx
push 1
push edi
push eax
mov dword [esp + 0x50], eax
call ebp
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x50]
push edi
push eax
push ecx
call fcn.00412d30
add esp, 0x48
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x412eb0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x10
call fcn.004225a0
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
push edi
push 1
push 2
lea eax, [esi + 2]
mov byte [esi], 3
push eax
call ebx
push edi
push 1
lea ecx, [esi + 4]
push 2
push ecx
call ebx
push edi
push 1
lea edx, [esp + 0x3c]
push 4
push edx
call ebx
mov dword [esi + 0xc], 0
mov eax, dword [esp + 0x44]
push eax
call fcn.004225a0
mov ecx, dword [esp + 0x54]
mov dword [esi + 8], eax
lea ebp, [ecx - 8]
push ebp
call fcn.004225e0
push edi
push 1
push ebp
push eax
mov dword [esp + 0x64], eax
call ebx
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x64]
add esp, 0x4c
push ebp
push edx
push eax
call fcn.00412d30
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x412f40
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x10
call fcn.004225a0
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
push ebx
push 1
push 2
lea edi, [esi + 2]
mov byte [esi], 1
push edi
call ebp
push ebx
lea eax, [esi + 4]
push 1
push 2
push eax
call ebp
movsx eax, word [esi + 4]
movsx ecx, word [edi]
imul eax, ecx
shl eax, 1
push eax
mov dword [esi + 0xc], 0
call fcn.004225a0
mov edx, dword [esp + 0x40]
mov dword [esi + 8], eax
lea edi, [edx - 4]
push edi
call fcn.004225e0
push ebx
push 1
push edi
push eax
mov dword [esp + 0x50], eax
call ebp
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x50]
push edi
push eax
push ecx
call fcn.00412d30
add esp, 0x48
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x412fc0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x10
call fcn.004225a0
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov esi, eax
push ebx
push 1
push 2
lea edi, [esi + 2]
mov byte [esi], 2
push edi
call ebp
push ebx
lea eax, [esi + 4]
push 1
push 2
push eax
call ebp
movsx eax, word [esi + 4]
movsx ecx, word [edi]
imul eax, ecx
shl eax, 1
push eax
mov dword [esi + 0xc], 0
call fcn.004225a0
mov edx, dword [esp + 0x40]
mov dword [esi + 8], eax
lea edi, [edx - 4]
push edi
call fcn.004225e0
push ebx
push 1
push edi
push eax
mov dword [esp + 0x50], eax
call ebp
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x50]
push edi
push eax
push ecx
call fcn.00412d30
add esp, 0x48
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret