joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498af0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2000
call fcn.005322e0
test byte [ecx + 0x5c], 1
je 0x498b3f
mov edx, dword [esp + 0x2004]
push esi
mov esi, dword [esp + 0x2010]
lea ecx, [esp + 4]
lea eax, [esi + esi]
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__read]
mov eax, dword [esp + 0x2018]
push esi
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.0047a450
add esp, 0x18
pop esi
add esp, 0x2000
ret 0xc
mov edx, dword [esp + 0x200c]
mov eax, dword [esp + 0x2008]
mov ecx, dword [esp + 0x2004]
push edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
add esp, 0x2000
ret 0xc

Function at 0x498df0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor bl, bl
xor esi, esi
test edi, edi
jle 0x498e34
push ebp
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov al, byte [esi + ebp]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
xor bl, al
push ecx
push edx
movsx eax, al
push edi
push esi
push eax
call fcn.00498c50
add esp, 0x1c
mov byte [esi + ebp], al
inc esi
cmp esi, edi
jl 0x498e04
pop ebp
mov ecx, dword [esp + 0x20]
xor eax, eax
test ecx, ecx
jle 0x498e4a
mov edx, dword [esp + 0x1c]
xor bl, byte [eax + edx]
inc eax
cmp eax, ecx
jl 0x498e3e
mov al, bl
pop edi
pop esi
or al, 0x80
pop ebx
ret

Function at 0x498e60
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
xor ebp, ebp
xor esi, esi
test ebx, ebx
jle 0x498eb1
push edi
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ax, word [edi]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [0x67a960]
push ecx
mov ecx, dword [esp + 0x28]
xor ebp, eax
or edx, ecx
and eax, 0xffff
push edx
push ebx
push esi
push eax
call fcn.00498c50
add esp, 0x1c
mov word [edi], ax
inc esi
add edi, 2
cmp esi, ebx
jl 0x498e74
pop edi
mov ecx, dword [esp + 0x20]
xor eax, eax
test ecx, ecx
jle 0x498ecb
mov edx, dword [esp + 0x1c]
movzx dx, byte [eax + edx]
xor ebp, edx
inc eax
cmp eax, ecx
jl 0x498ebb
mov ax, bp
pop esi
pop ebp
pop ebx
ret
Function at 0x49dea0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x67a8cc]
push ebx
push esi
push eax
mov esi, ecx
push 1
push 0x10
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov ebx, dword [esp + 0x1c]
push ebx
call fcn.0049de80
add esp, 0x14
mov dword [esi + 0x10], eax
test eax, eax
jne 0x49df0c
push edi
mov ecx, esi
call fcn.004c9d30
mov edi, eax
add edi, 0xc
push edi
call fcn.00478e60
mov dword [esi + 0x10], eax
mov dword [eax], 1
mov ecx, dword [esi + 0x10]
add esp, 4
mov dword [ecx + 4], edi
mov edx, dword [esi + 0x10]
mov ecx, dword [0x698c2c]
push edx
push ebx
call fcn.004b5300
mov esi, dword [esi + 0x10]
pop edi
mov eax, dword [esi]
inc eax
mov dword [esi], eax
pop esi
pop ebx
ret 4
mov esi, dword [esi + 0x10]
mov eax, dword [esi]
inc eax
mov dword [esi], eax
pop esi
pop ebx
ret 4
Function at 0x4a0ed0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, ecx
push esi
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
test ecx, ecx
push edi
mov dword [ebp + 0x24], 1
jle 0x4a0f74
xor edi, edi
test ecx, ecx
jle 0x4a0f5e
mov eax, dword [esp + 0x20]
add eax, 0xfffffffc
mov dword [esp + 0x14], eax
jmp 0x4a0f04
mov ecx, dword [esp + 0x18]
mov bx, word [esi + 2]
movsx eax, word [esi + 6]
movsx edx, bx
sub eax, edx
inc eax
imul eax, edi
cdq
idiv ecx
test edi, edi
jle 0x4a0f2a
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x4a0f2a
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov cx, word [esi + 4]
mov dx, word [esi]
add eax, ebx
movsx ebx, ax
movsx ecx, cx
push ebx
push ecx
movsx eax, ax
movsx ecx, dx
push eax
push ecx
mov ecx, ebp
call fcn.0049fff0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc edi
add ecx, 4
cmp edi, eax
mov dword [esp + 0x14], ecx
jl 0x4a0f00
movsx eax, word [esi + 6]
movsx edx, word [esi + 4]
push eax
push edx
push eax
mov ecx, ebp
movsx eax, word [esi]
push eax
call fcn.0049fff0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jle 0x4a0fe8
xor edi, edi
test ebx, ebx
jle 0x4a0fd1
mov cx, word [esi]
movsx eax, word [esi + 4]
movsx edx, cx
sub eax, edx
inc eax
imul eax, edi
cdq
idiv ebx
test edi, edi
jle 0x4a0fab
mov edx, dword [esp + 0x20]
test edx, edx
je 0x4a0fab
mov eax, dword [esp + 0x18]
add eax, edi
mov eax, dword [edx + eax*4 - 8]
mov dx, word [esi + 2]
add eax, ecx
mov cx, word [esi + 6]
movsx ecx, cx
push ecx
movsx ecx, ax
movsx edx, dx
movsx eax, ax
push ecx
push edx
push eax
mov ecx, ebp
call fcn.0049fff0
inc edi
cmp edi, ebx
jl 0x4a0f82
movsx ecx, word [esi + 6]
movsx eax, word [esi + 4]
movsx edx, word [esi + 2]
push ecx
push eax
push edx
push eax
mov ecx, ebp
call fcn.0049fff0
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x4a0ff0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ecx
mov ebx, 1
test ebp, ebp
mov dword [edi + 0x24], ebx
jle 0x4a1074
cmp ebp, ebx
jle 0x4a1074
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov bp, word [esi + 2]
movsx eax, word [esi + 6]
movsx ecx, bp
sub eax, ecx
inc eax
imul eax, ebx
cdq
idiv dword [esp + 0x18]
test ebx, ebx
jle 0x4a103e
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x4a103e
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov cx, word [esi + 4]
mov dx, word [esi]
add eax, ebp
movsx ebp, ax
movsx ecx, cx
push ebp
push ecx
movsx eax, ax
movsx ecx, dx
push eax
push ecx
mov ecx, edi
call fcn.0049fff0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ebx
add ecx, 4
cmp ebx, eax
mov dword [esp + 0x14], ecx
jl 0x4a1016
mov ebp, eax
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x4a10d7
mov ebx, 1
cmp eax, ebx
jle 0x4a10d7
mov cx, word [esi]
movsx eax, word [esi + 4]
movsx edx, cx
sub eax, edx
inc eax
imul eax, ebx
cdq
idiv dword [esp + 0x1c]
test ebx, ebx
jle 0x4a10ad
mov edx, dword [esp + 0x20]
test edx, edx
je 0x4a10ad
lea eax, [ebx + ebp]
mov eax, dword [edx + eax*4 - 8]
mov dx, word [esi + 2]
add eax, ecx
mov cx, word [esi + 6]
movsx ecx, cx
push ecx
movsx ecx, ax
movsx edx, dx
movsx eax, ax
push ecx
push edx
push eax
mov ecx, edi
call fcn.0049fff0
mov eax, dword [esp + 0x1c]
inc ebx
cmp ebx, eax
jl 0x4a1085
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4a10f7
mov ecx, dword [eax]
mov dword [edi + 4], ecx
mov edx, dword [eax + 4]
mov dword [edi + 8], edx
cmp word [edi + 4], 0
jne 0x4a10f7
mov word [edi + 6], 0
mov ax, word [esi]
movsx ecx, word [esi + 2]
movsx edx, ax
push ecx
push edx
mov ecx, edi
call fcn.004a00a0
mov ax, word [esi + 4]
movsx ecx, word [esi + 2]
movsx edx, ax
push ecx
push edx
mov ecx, edi
call fcn.004a00c0
mov ax, word [esi + 4]
movsx ecx, word [esi + 6]
movsx edx, ax
push ecx
push edx
mov ecx, edi
call fcn.004a00c0
mov ax, word [esi]
movsx ecx, word [esi + 6]
movsx edx, ax
push ecx
push edx
mov ecx, edi
call fcn.004a00c0
mov ax, word [esi]
movsx ecx, word [esi + 2]
movsx edx, ax
push ecx
push edx
mov ecx, edi
call fcn.004a00c0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x4abc50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x67a8e4]
sub esp, 0x90
push ebx
mov ebx, ecx
test dword [ebx + 0x44], eax
jne 0x4abe2e
push 0
push str.libusb_1.0
call fcn.00478db0
add esp, 8
test eax, eax
jne 0x4abc91
push str.libusb.so_not_found__n
call fcn.0040cc80
add esp, 4
xor eax, eax
pop ebx
add esp, 0x90
ret
push 0
push str.libzkfp
call fcn.00478db0
add esp, 8
mov dword [ebx + 0x48], eax
test eax, eax
jne 0x4abcc4
call dword [sym.imp.MSVCRT.dll__errno]
push str.libzkfp.so_not_found__n
call fcn.0040cc80
add esp, 4
xor eax, eax
pop ebx
add esp, 0x90
ret
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 0x54], str.ZKFPM_Init
mov dword [esp + 0x58], str.ZKFPM_Terminate
mov dword [esp + 0x5c], str.ZKFPM_GetDeviceCount
mov dword [esp + 0x60], str.ZKFPM_OpenDevice
mov dword [esp + 0x64], str.ZKFPM_CloseDevice
mov dword [esp + 0x68], str.ZKFPM_SetParameters
mov dword [esp + 0x6c], str.ZKFPM_GetParameters
mov dword [esp + 0x70], str.ZKFPM_AcquireFingerprint
mov dword [esp + 0x74], str.ZKFPM_DBInit
mov dword [esp + 0x78], str.ZKFPM_DBFree
mov dword [esp + 0x7c], str.ZKFPM_DBMerge
mov dword [esp + 0x80], str.ZKFPM_DBAdd
mov dword [esp + 0x84], str.ZKFPM_DBDel
mov dword [esp + 0x88], str.ZKFPM_DBClear
mov dword [esp + 0x8c], str.ZKFPM_DBCount
mov dword [esp + 0x90], str.ZKFPM_DBIdentify
mov dword [esp + 0x94], str.ZKFPM_DBMatch
mov dword [esp + 0x98], 0x59ddd8
rep stosd dword es:[edi], eax
xor esi, esi
mov eax, dword [esp + esi + 0x54]
test eax, eax
je 0x4abda0
cmp byte [eax], 0
je 0x4abda0
mov ecx, dword [ebx + 0x48]
push eax
push ecx
call fcn.00478df0
add esp, 8
mov dword [esp + esi + 0xc], eax
add esi, 4
cmp esi, 0x48
jl 0x4abd82
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [ebx], edx
mov edx, dword [esp + 0x18]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 8], ecx
mov ecx, dword [esp + 0x20]
mov dword [ebx + 0xc], edx
mov edx, dword [esp + 0x24]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x14], ecx
mov ecx, dword [esp + 0x2c]
mov dword [ebx + 0x18], edx
mov edx, dword [esp + 0x30]
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [ebx + 0x24], edx
mov edx, dword [esp + 0x3c]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x40]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [esp + 0x44]
mov dword [ebx + 0x30], edx
mov edx, dword [esp + 0x48]
mov dword [ebx + 0x34], eax
mov eax, dword [esp + 0x4c]
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], eax
mov ecx, dword [0x67a8e4]
mov eax, dword [ebx + 0x44]
or eax, ecx
pop edi
mov dword [ebx + 0x44], eax
pop esi
mov eax, 1
pop ebx
add esp, 0x90
ret
Function at 0x4abe40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x804
push esi
push edi
mov edi, ecx
call dword [edi + 0x20]
test eax, eax
mov dword [edi + 0x50], eax
je 0x4abf26
mov eax, dword [str.zkfpm.dat]
push 0x585050
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4abf26
push ebx
push ebp
push esi
push 1
lea ecx, [edi + 0x68]
push 0x20
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
xor ebx, ebx
mov ebp, 0x20
mov eax, ebx
cdq
and edx, 0x1f
add eax, edx
mov edx, ebx
sar eax, 5
and edx, 0x8000001f
jns 0x4abeab
dec edx
or edx, 0xffffffe0
inc edx
mov eax, dword [edi + eax*4 + 0x68]
mov ecx, dword [edx*4 + 0x67a8e4]
test ecx, eax
je 0x4abf07
push 0
push ebp
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
push 1
lea ecx, [esp + 0x24]
push 4
push ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.MSVCRT.dll_fread]
mov edx, dword [esp + 0x2c]
push esi
push edx
lea eax, [esp + 0x38]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x40]
push ecx
mov ecx, dword [edi + 0x50]
lea eax, [ebx + 1]
push edx
push eax
push ecx
call dword [edi + 0x2c]
add esp, 0x3c
add ebp, 0x804
inc ebx
cmp ebp, 0x80420
jl 0x4abe91
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x804
ret

Function at 0x4abf30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov eax, dword [edi + 0x50]
test eax, eax
je 0x4ac06c
mov eax, dword [str.zkfpm.dat]
mov ebp, dword [sym.imp.MSVCRT.dll_fopen]
push 0x585938
push eax
call ebp
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4abf88
mov ecx, dword [str.zkfpm.dat]
push 0x58593c
push ecx
call ebp
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4ac06c
mov ebp, dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
push 1
lea edx, [edi + 0x68]
push 0x20
push edx
call ebp
mov eax, dword [esp + 0x82c]
add esp, 0x10
test eax, eax
je 0x4ac062
xor esi, esi
mov eax, esi
mov ecx, esi
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
and ecx, 0x8000001f
jns 0x4abfc7
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edx, dword [edi + eax*4 + 0x68]
mov eax, dword [ecx*4 + 0x67a8e4]
test eax, edx
je 0x4abfe1
inc esi
cmp esi, 0x100
jl 0x4abfad
jmp 0x4ac05e
mov eax, esi
push 0
shl eax, 9
add eax, esi
lea ecx, [eax*4 + 0x20]
push ecx
push ebx
call dword [sym.imp.MSVCRT.dll_fseek]
push ebx
push 1
lea edx, [esp + 0x834]
push 4
push edx
call ebp
mov eax, dword [esp + 0x83c]
mov ecx, dword [esp + 0x838]
push ebx
push eax
push 1
push ecx
call ebp
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x84c]
mov edx, 0x800
sub edx, eax
push ebx
push edx
lea eax, [esp + 0x4c]
push 1
push eax
call ebp
mov ecx, dword [esp + 0x50]
add esp, 0x3c
inc esi
mov dword [esp + 0x10], 1
mov dword [ecx + 0x64], esi
mov esi, dword [esp + 0x10]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret 8
Function at 0x4aca30
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x10]
mov al, byte [esi]
imul edi, dword [esp + 0x14]
test al, 0xf0
je 0x4aca97
mov eax, dword [esi + 0x2250]
test eax, eax
jne 0x4aca68
lea eax, [esi + 0x2150]
push 0x585050
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [esi + 0x2250], eax
mov eax, dword [esi + 0x2250]
test eax, eax
je 0x4aca97
mov ecx, dword [esp + 0xc]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 0x144]
add esp, 0x10
add ecx, eax
mov dword [esi + 0x144], ecx
pop edi
pop esi
ret 0xc
mov eax, edi
pop edi
pop esi
ret 0xc
Function at 0x4acfe0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov eax, dword [esi + 0x50]
mov ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx]
test cl, 2
je 0x4ad00b
pop edi
pop esi
pop ebp
mov dword [0x6950c4], 3
xor eax, eax
pop ebx
pop ecx
ret
test cl, 1
jne 0x4ad022
pop edi
pop esi
pop ebp
mov dword [0x6950c4], 0xa
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [eax + 0x40]
test edx, edx
je 0x4ad046
mov edi, 0x588464
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x588464
push esi
call edx
add esp, 0xc
jmp 0x4ad06a
mov eax, dword [eax + 0x38]
mov edi, 0x588464
push eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 1
push 0x588464
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov edx, eax
mov edi, 0x588464
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
je 0x4ad091
pop edi
pop esi
pop ebp
mov dword [0x6950c4], 2
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi], ebp
test edi, edi
mov dword [esi + 4], ecx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edx
je 0x4ad0da
mov eax, dword [edi + 0xc]
mov ecx, dword [edi]
push eax
push ecx
call fcn.004aeaf0
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x4ad0e1
pop edi
pop esi
pop ebp
mov dword [0x6950c4], 7
pop ebx
pop ecx
ret
mov dword [esi + 0x14], 0
push esi
push ebp
call fcn.004ad570
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.004ad570
add esp, 0x10
test edi, edi
je 0x4ad100
mov eax, dword [edi + 4]
dec eax
jmp 0x4ad105
mov eax, 7
add bl, 0xf
mov ecx, edi
shl bl, 4
neg ecx
mov dl, byte [esp + 0x28]
mov byte [esp + 0x1a], 0
sbb cl, cl
mov byte [esp + 0x19], dl
and ecx, 0x80
or bl, cl
or bl, al
mov eax, dword [esi + 0x50]
mov byte [esp + 0x18], bl
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4ad145
lea eax, [esp + 0x18]
push 3
push eax
push esi
call ecx
add esp, 0xc
jmp 0x4ad15b
mov ecx, dword [eax + 0x38]
lea edx, [esp + 0x18]
push ecx
push 3
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
test edi, edi
je 0x4ad1c3
mov eax, dword [edi]
xor ebp, ebp
test eax, eax
jle 0x4ad1c3
xor ebx, ebx
mov eax, dword [edi + 0xc]
add eax, ebx
mov cl, byte [eax]
mov byte [esp + 0x18], cl
mov dl, byte [eax + 1]
mov byte [esp + 0x19], dl
mov al, byte [eax + 2]
mov byte [esp + 0x1a], al
mov eax, dword [esi + 0x50]
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4ad19b
lea edx, [esp + 0x18]
push 3
push edx
push esi
call ecx
add esp, 0xc
jmp 0x4ad1b1
mov eax, dword [eax + 0x38]
lea ecx, [esp + 0x18]
push eax
push 3
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 3
jne 0x4ad07f
add ebx, eax
mov eax, dword [edi]
inc ebp
cmp ebp, eax
jl 0x4ad169
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov ecx, dword [eax]
pop ebx
or ecx, 2
mov dword [eax], ecx
mov eax, 1
pop ecx
ret
Function at 0x4ad480
Capabilities:
Write file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
jne 0x4ad491
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov edi, dword [esi + 0x50]
test byte [edi], 1
jne 0x4ad4a9
pop edi
pop esi
mov dword [0x6950c4], 0xa
xor eax, eax
pop ebp
ret
mov ebp, dword [edi + 0x38]
mov byte [esp + 0x10], 0x3b
mov eax, dword [edi + 0x40]
test eax, eax
je 0x4ad4c7
lea ecx, [esp + 0x10]
push 1
push ecx
push esi
call eax
add esp, 0xc
jmp 0x4ad4dd
mov edx, dword [edi + 0x38]
lea eax, [esp + 0x10]
push edx
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4ad4f4
push eax
call fcn.004aeba0
add esp, 4
mov dword [esi + 0x30], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ad50b
push eax
call fcn.004aeba0
add esp, 4
mov dword [esi + 0x14], 0
test edi, edi
je 0x4ad52f
mov eax, dword [edi + 0x6144]
test eax, eax
je 0x4ad524
push 1
push eax
call fcn.00478eb0
add esp, 8
push 1
push edi
call fcn.00478eb0
add esp, 8
push 0x54
push esi
call fcn.00478eb0
add esp, 8
test ebp, ebp
je 0x4ad55c
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
test eax, eax
je 0x4ad55c
pop edi
pop esi
mov dword [0x6950c4], 9
xor eax, eax
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebp
ret

Function at 0x4ad570
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov byte [esp + 4], al
mov ecx, dword [edx + 0x50]
sar eax, 8
mov byte [esp + 5], al
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x4ad5a5
lea ecx, [esp + 4]
push 2
push ecx
push edx
call eax
add esp, 0xc
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
ret
mov edx, dword [ecx + 0x38]
lea eax, [esp + 4]
push edx
push 2
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
ret

Function at 0x4ad5d0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x30]
mov esi, dword [edi + 0x50]
test eax, eax
jne 0x4ad5ec
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4ad69d
mov ebx, dword [eax + 4]
cmp ebx, 2
jge 0x4ad5f9
mov ebx, 2
mov byte [esp + 0x10], bl
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4ad613
lea ecx, [esp + 0x10]
push 1
push ecx
push edi
call eax
add esp, 0xc
jmp 0x4ad629
mov edx, dword [esi + 0x38]
lea eax, [esp + 0x10]
push edx
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov eax, 1
mov ecx, ebx
shl eax, cl
lea ecx, [ebx + 1]
mov edx, 1
shl edx, cl
mov byte [esi + 0x44], 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
inc eax
mov dword [esi + 0x10], eax
inc eax
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x6144]
push eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x24], 0x1001
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004acde0
mov ecx, dword [esi + 0xc]
push ecx
push edi
call fcn.004ad840
add esp, 0xc
test eax, eax
jne 0x4ad694
pop edi
pop esi
mov dword [0x6950c4], 8
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
mov dword [0x6950c4], 5
xor eax, eax
pop ebx
ret
Function at 0x4ad940
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
cmp ebx, 0x1000
push edi
mov al, byte [esi]
jne 0x4ad9e8
mov edi, dword [esp + 0x10]
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
test al, al
je 0x4ad9ad
mov ecx, dword [edi + 0x50]
mov edx, dword [ecx + 0x40]
test edx, edx
je 0x4ad981
and eax, 0xff
inc eax
push eax
push esi
push edi
call edx
add esp, 0xc
jmp 0x4ad994
mov ecx, dword [ecx + 0x38]
and eax, 0xff
inc eax
push ecx
push eax
push 1
push esi
call ebx
add esp, 0x10
xor edx, edx
mov dl, byte [esi]
inc edx
cmp eax, edx
je 0x4ad9ad
pop edi
pop esi
mov dword [0x6950c4], 2
xor eax, eax
pop ebx
ret
mov byte [esi], 0
mov eax, dword [edi + 0x50]
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4ad9c5
push 1
push esi
push edi
call ecx
add esp, 0xc
jmp 0x4ad9d3
mov eax, dword [eax + 0x38]
push eax
push 1
push 1
push esi
call ebx
add esp, 0x10
cmp eax, 1
je 0x4ada49
pop edi
pop esi
mov dword [0x6950c4], 2
xor eax, eax
pop ebx
ret
cmp al, 0xff
jne 0x4ada39
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x50]
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4ada08
push 0x100
push esi
push edx
call ecx
add esp, 0xc
jmp 0x4ada1d
mov ecx, dword [eax + 0x38]
push ecx
push 0x100
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
xor edx, edx
mov dl, byte [esi]
inc edx
cmp eax, edx
je 0x4ada36
pop edi
pop esi
mov dword [0x6950c4], 2
xor eax, eax
pop ebx
ret
mov byte [esi], 0
mov dl, byte [esi]
inc dl
mov al, dl
mov byte [esi], dl
and eax, 0xff
mov byte [eax + esi], bl
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x4adba0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [edx + 0x50]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x4adbbf
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push ecx
push edx
call eax
add esp, 0xc
ret
mov edx, dword [ecx + 0x38]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push edx
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
ret

Function at 0x4af440
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x4af46f
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0x24
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
pop esi
ret 4

Function at 0x4af680
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.004b0620
mov ecx, eax
call fcn.004b0600
test eax, eax
jne 0x4af6a0
cmp dword [0x67b4ec], 1
jne 0x4af6f1
mov eax, dword [str.stage.dat]
push 0x585050
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4af6f1
push esi
push 1
push 0xc
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
add edi, 4
push edi
push 0x2668
call fcn.00493e00
mov ecx, eax
call fcn.004906f0
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
ret