joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fd50
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5457c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0041d450
mov eax, dword [esi + 0xc4]
mov dword [esi], 0x54a344
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esp + 0x1c], 0
mov edi, dword [eax + 0x20]
and edi, 0xfffffffe
mov dword [eax + 0x20], edi
mov ecx, dword [0x67a8cc]
push ecx
lea edi, [esi + 0x1fc]
push 1
push 4
push edi
call ebp
mov edx, dword [0x67a8cc]
lea ebx, [esi + 0x200]
push edx
push 1
push 4
push ebx
call ebp
mov eax, dword [0x67a8cc]
mov ebp, dword [sym.imp.MSVCRT.dll_ftell]
push eax
call ebp
add esp, 0x24
mov ecx, esi
push eax
call fcn.0043e9b0
mov ecx, dword [0x67a8cc]
push ecx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0043ee20
mov edi, dword [edi]
cmp edi, 0x511
jne 0x41fe0c
mov edx, dword [ebx]
mov ecx, dword [esi + 0x18]
push edx
call fcn.004e0760
jmp 0x41fe9a
cmp edi, 0x303
jne 0x41fe2e
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov edi, eax
mov eax, dword [ebx]
mov ecx, edi
push eax
call fcn.00485ac0
mov dword [ebx], edi
jmp 0x41fe9a
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0xe9
jl 0x41fe54
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0xea
jle 0x41fe91
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0x102
je 0x41fe91
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0x115
je 0x41fe91
push 1
push 0x2392
call fcn.00493e00
mov ecx, eax
call fcn.00490450
test eax, eax
je 0x41fe9a
mov eax, dword [esi + 8]
or ah, 8
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test ah, 3
jne 0x41fea8
or ah, 3
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x421190
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.0041d450
lea edi, [esi + 0x1fc]
lea ebx, [esi + 0x200]
mov ecx, esi
mov dword [esp + 0x18], 0
mov dword [edi], 0
mov dword [ebx], 0
mov dword [esi + 0x208], 0xffffffff
call fcn.0043d3d0
mov edx, dword [eax]
lea ecx, [esi + 0x20c]
mov dword [esi + 0x20c], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [esi], 0x54a434
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0xc4]
mov ecx, dword [eax + 0x20]
and ecx, 0xfffffffe
mov dword [eax + 0x20], ecx
mov ecx, esi
call fcn.0043d3d0
mov cl, byte [eax + 5]
cmp cl, 0xff
je 0x421238
cmp cl, 0xfd
je 0x421238
cmp cl, 0xfb
jne 0x42123c
mov byte [eax + 3], 2
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 1
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
call edi
mov edx, dword [0x67a8cc]
push edx
push 1
push 1
push ebx
call edi
mov eax, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_ftell]
push eax
call edi
add esp, 0x24
mov ecx, esi
push eax
call fcn.0043e9b0
mov ecx, dword [0x67a8cc]
push ecx
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.0043ee20
mov eax, dword [esi + 8]
test ah, 3
jne 0x421299
or ah, 3
mov dword [esi + 8], eax
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0xe9
jl 0x4212bf
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0xea
jle 0x4212fc
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0x102
je 0x4212fc
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0x115
je 0x4212fc
push 1
push 0x2392
call fcn.00493e00
mov ecx, eax
call fcn.00490450
test eax, eax
je 0x421305
mov eax, dword [esi + 8]
or ah, 8
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x421840
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0041d450
mov eax, dword [esi + 0xc4]
mov dword [esi], 0x54a524
lea ebx, [esi + 0x1fc]
mov dword [esp + 0x1c], 0
mov edi, dword [eax + 0x20]
and edi, 0xfffffffe
mov dword [eax + 0x20], edi
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 4
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
push 0x24
call fcn.004784b0
mov ebp, dword [sym.imp.MSVCRT.dll_ftell]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4218cd
mov edx, dword [0x67a8cc]
push 0
push edx
call ebp
add esp, 4
mov ecx, edi
push eax
call fcn.00495d60
jmp 0x4218cf
xor eax, eax
mov dword [esi + 0xcc], eax
mov al, byte [ebx]
test al, 0x70
je 0x421912
push 0x24
call fcn.004784b0
mov edi, eax
add esp, 4
test edi, edi
je 0x421908
mov eax, dword [0x67a8cc]
push 1
push eax
call ebp
add esp, 4
mov ecx, edi
push eax
call fcn.00495d60
mov dword [esi + 0x12c], eax
jmp 0x421926
xor eax, eax
mov dword [esi + 0x12c], eax
jmp 0x421926
mov ecx, dword [0x67a8cc]
push 1
push 0x10
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
test byte [ebx], 0xc
jne 0x421941
mov edx, dword [0x67a8cc]
push 1
push 0x10
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
jmp 0x421970
push 0x24
call fcn.004784b0
mov edi, eax
add esp, 4
test edi, edi
je 0x421968
mov eax, dword [0x67a8cc]
push 1
push eax
call ebp
add esp, 4
mov ecx, edi
push eax
call fcn.00495d60
jmp 0x42196a
xor eax, eax
mov dword [esi + 0x114], eax
mov ecx, dword [0x67a8cc]
push ecx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0043e9b0
mov edx, dword [0x67a8cc]
push edx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0043ee20
mov eax, dword [esi + 8]
test ah, 3
jne 0x4219a6
or ah, 3
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x421ca0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x40
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [0x67a8cc]
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push edi
call esi
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x28]
push eax
push 1
push 0x10
push ecx
call esi
mov edx, dword [0x67a8cc]
lea eax, [edi + 8]
push edx
push 1
push 4
push eax
call esi
mov ecx, dword [0x67a8cc]
lea edx, [edi + 0xc]
push ecx
push 1
push 4
push edx
call esi
mov eax, dword [0x67a8cc]
add esp, 0x4c
lea ecx, [edi + 0x10]
push eax
push 1
push 4
push ecx
call esi
mov edx, dword [0x67a8cc]
lea eax, [edi + 0x14]
push edx
push 1
push 4
push eax
call esi
mov ecx, dword [0x67a8cc]
lea edx, [edi + 0x18]
push ecx
push 1
push 4
push edx
call esi
mov eax, dword [0x67a7f0]
add esp, 0x30
cmp eax, 0x1c
jl 0x421e08
mov eax, dword [0x67a8cc]
lea ebx, [edi + 0x1c]
push eax
push 1
push 4
push ebx
call esi
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x2c]
push ecx
push 1
push 0x30
push edx
call esi
mov eax, dword [0x67a7f0]
add esp, 0x20
cmp eax, 0x1d
jl 0x421e08
mov eax, dword [0x67a904]
mov ecx, dword [ebx]
test eax, ecx
je 0x421daa
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x421da5
lea ecx, [esp + 0x1c]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
jmp 0x421da7
xor eax, eax
mov dword [edi + 0x20], eax
mov edx, dword [0x67a914]
mov eax, dword [ebx]
test edx, eax
je 0x421dd9
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x421dd4
lea ecx, [esp + 0x2c]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
jmp 0x421dd6
xor eax, eax
mov dword [edi + 0x24], eax
mov edx, dword [0x67a918]
mov eax, dword [ebx]
test edx, eax
je 0x421e08
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x421e03
lea ecx, [esp + 0x3c]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
jmp 0x421e05
xor eax, eax
mov dword [edi + 0x28], eax
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x421e30
lea edx, [esp + 0xc]
push 0
push edx
mov ecx, eax
call fcn.00495db0
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
xor eax, eax
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
Function at 0x422240
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x54586b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
mov eax, dword [esp + 0x418]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x18], esi
call fcn.0041d450
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], eax
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0x204], eax
rep stosd dword es:[edi], eax
mov dword [esi], 0x54a614
mov ecx, dword [0x67a8cc]
push ecx
lea ebx, [esi + 0x1fc]
push 1
push 4
push ebx
mov dword [esp + 0x430], eax
call ebp
mov edx, dword [0x67a8cc]
lea edi, [esi + 0x200]
push edx
push 1
push 4
push edi
call ebp
mov eax, dword [0x67a8cc]
mov ecx, dword [edi]
push eax
push ecx
lea edx, [esp + 0x40]
push 4
push edx
call ebp
mov al, byte [ebx]
add esp, 0x30
test al, 6
jne 0x4222eb
mov eax, dword [esi + 0xc4]
and dword [eax + 0x20], 0xfffffffe
jmp 0x4222f7
mov eax, dword [esi + 8]
and ah, 0xfd
or ah, 1
mov dword [esi + 8], eax
mov ecx, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_ftell]
push ecx
call ebx
add esp, 4
mov ecx, esi
push eax
call fcn.0043e9b0
mov edx, dword [0x67a8cc]
push edx
call ebx
add esp, 4
mov ecx, esi
push eax
call fcn.0043ee20
mov ebx, dword [edi]
lea eax, [ebx + ebx*4]
lea ecx, [ebx + eax*2]
lea edx, [ecx*4 + 4]
push edx
call fcn.004784e0
add esp, 4
test eax, eax
je 0x42235b
push 0x4221f0
push 0x41a340
lea ebp, [eax + 4]
push ebx
push 0x2c
push ebp
mov dword [eax], ebx
call fcn.0053230f
jmp 0x42235d
xor ebp, ebp
mov eax, dword [edi]
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 0x204], ebp
jle 0x42239d
mov dword [esp + 0x10], ebx
lea ebp, [esp + 0x18]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x204]
push eax
add ecx, edx
call fcn.00421ca0
mov ecx, dword [esp + 0x10]
mov eax, dword [edi]
inc ebx
add ebp, 4
add ecx, 0x2c
cmp ebx, eax
mov dword [esp + 0x10], ecx
jl 0x422373
mov eax, dword [esi + 8]
test ah, 3
jne 0x4223ab
or ah, 3
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x418]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x414
ret 4
Function at 0x422720
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5458b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov esi, ecx
push ebp
mov dword [esp + 0x14], esi
call fcn.0043cc70
xor edi, edi
push 0x5dde80
lea ecx, [esi + 0x1e0]
mov dword [esp + 0x20], edi
mov dword [esi + 0x1d4], edi
call fcn.004b89a0
mov eax, dword [esi + 0xc4]
mov ebx, 1
push 0x24
push eax
mov byte [esp + 0x24], bl
mov dword [esi + 0x1f4], edi
mov dword [esi + 0x1f8], edi
mov dword [esi], 0x54a764
call fcn.004784c0
mov dword [esi + 0xc4], edi
mov ecx, dword [0x67a8cc]
add ebp, 8
push edi
push ebp
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push ebx
lea eax, [esi + 0x1d0]
push 4
push eax
call edi
add esp, 0x24
cmp word [esi + 0x1d2], bx
jae 0x4227d3
mov word [esi + 0x1d2], bx
cmp byte [esi + 0x1d1], bl
jae 0x4227e1
mov byte [esi + 0x1d1], bl
mov ecx, dword [0x67a8cc]
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, esi
push eax
call fcn.0043ede0
cmp dword [0x67a7f0], 0x19
jl 0x42282b
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x1d8]
push edx
push ebx
push 4
push eax
call edi
mov ecx, dword [0x67a8cc]
lea edx, [esi + 0x1dc]
push ecx
push ebx
push 4
push edx
call edi
add esp, 0x20
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xb8], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x422db0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545908
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0043cc70
lea ebp, [esi + 0x1e0]
xor ebx, ebx
lea edi, [esi + 0x1e4]
mov dword [esi + 0x1d4], ebx
mov word [ebp], bx
push 0x24
mov dword [edi], ebx
mov ecx, dword [esi + 0xc4]
push ecx
mov dword [esp + 0x24], ebx
mov dword [esi], 0x54a854
call fcn.004784c0
mov dword [esi + 0xc4], ebx
mov edx, dword [0x67a8cc]
mov ebx, 1
push edx
push ebx
push 4
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esi + 0x1d0]
push eax
push ebx
push 4
push ecx
call edi
add esp, 0x28
cmp word [esi + 0x1d2], bx
jae 0x422e4f
mov word [esi + 0x1d2], bx
cmp byte [esi + 0x1d1], bl
jae 0x422e5d
mov byte [esi + 0x1d1], bl
mov edx, dword [0x67a8cc]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, esi
push eax
call fcn.0043ede0
cmp dword [0x67a7f0], 0x19
jl 0x422eb3
mov eax, dword [0x67a8cc]
lea ecx, [esi + 0x1d8]
push eax
push ebx
push 4
push ecx
call edi
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x1dc]
push edx
push ebx
push 4
push eax
call edi
mov ecx, dword [0x67a8cc]
push ecx
push ebx
push 2
push ebp
call edi
add esp, 0x30
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xb8], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x423690
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545948
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.0043cc70
xor eax, eax
mov ebx, 1
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1dc], eax
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1e4], ebx
mov dword [esi + 0x1e8], ebx
mov dword [esi + 0x1ec], ebx
mov dword [esi], 0x54a944
mov ecx, dword [0x67a8cc]
push ebx
push 4
push ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push ebx
lea eax, [esi + 0x1d0]
push 2
push eax
call edi
mov ecx, dword [0x67a8cc]
lea edx, [esi + 0x1d2]
push ecx
push ebx
push 2
push edx
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esi + 0x1d4]
push eax
push ebx
push 4
push ecx
call edi
mov edx, dword [0x67a8cc]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x40
mov ecx, esi
push eax
call fcn.0043ede0
cmp dword [0x67a7f0], 0x19
jl 0x423785
mov eax, dword [0x67a8cc]
lea ecx, [esi + 0x1f0]
push eax
push ebx
push 4
push ecx
call edi
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x1f4]
push edx
push ebx
push 4
push eax
call edi
add esp, 0x20
mov ecx, dword [esi + 8]
and ch, 0xfd
or ch, 1
mov dword [esi + 8], ecx
mov ecx, esi
call fcn.00423d00
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xb8], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x42aa50
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x67a7f0]
push esi
cmp eax, 0x1b
push edi
mov esi, ecx
jl 0x42aaf0
mov eax, dword [esp + 0xc]
mov ecx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
push ecx
call edi
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x214]
push edx
push 1
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
mov ecx, esi
call fcn.0042a9d0
test eax, eax
je 0x42aae0
push 0x24
call fcn.004784b0
mov edi, eax
add esp, 4
test edi, edi
je 0x42aad3
mov ecx, dword [0x67a8cc]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, edi
push eax
call fcn.00495d60
mov dword [esi + 0x12c], eax
pop edi
pop esi
ret 4
xor eax, eax
pop edi
mov dword [esi + 0x12c], eax
pop esi
ret 4
mov edx, dword [0x67a8cc]
push 1
push 0x10
push edx
call edi
add esp, 0xc
pop edi
pop esi
ret 4
Function at 0x42ab00
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x67a7f0]
sub esp, 0x80
cmp eax, 0x1c
push ebx
push esi
mov esi, ecx
jl 0x42acaa
push edi
xor ebx, ebx
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x2c], ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x90]
mov dword [esp + 0x1c], eax
mov ecx, 0xb
mov dword [esp + 0x20], eax
lea edi, [esp + 0x60]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x74], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
push 0x18
push ecx
push edx
mov dword [esp + 0x30], eax
call fcn.0047a710
mov ecx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0xc
lea eax, [esp + 0x14]
push 0x14
push eax
push ecx
call edi
add esp, 4
push eax
call fcn.0047a710
mov eax, dword [0x67a8cc]
add esp, 0xc
lea edx, [esp + 0x60]
push 0x2c
push edx
push eax
call edi
add esp, 4
push eax
call fcn.0047a710
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x4c]
push ecx
push 1
push 0x20
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 0x214]
add esp, 0x1c
test ah, 4
pop edi
je 0x42ac19
push 0x24
call fcn.004784b0
add esp, 4
cmp eax, ebx
je 0x42abeb
lea ecx, [esp + 0x3c]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
jmp 0x42abed
xor eax, eax
push 0x24
mov dword [esi + 0x224], eax
call fcn.004784b0
add esp, 4
cmp eax, ebx
je 0x42ac11
lea edx, [esp + 0x4c]
push 1
push edx
mov ecx, eax
call fcn.00495db0
jmp 0x42ac13
xor eax, eax
mov dword [esi + 0x228], eax
test byte [esp + 0x24], 1
je 0x42ac4e
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
or ecx, 0x80000000
push esi
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.004470d0
add esp, 0xc
mov ecx, esi
mov dword [esi + 0x21c], eax
call fcn.00429f30
mov edx, dword [0x67a8e4]
mov eax, dword [esp + 0x5c]
test edx, eax
je 0x42acaa
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, esi
mov dword [esp + 8], eax
call fcn.0042a9e0
test eax, eax
je 0x42ac91
mov eax, dword [esi + 0x214]
shr eax, 0x18
cmp eax, ebx
jg 0x42ac8c
mov ecx, 0x6969c0
call fcn.004b3e00
add word [esp + 0xe], ax
lea edx, [esp + 8]
lea eax, [esp + 0x5c]
push edx
push esi
push eax
call fcn.00447470
add esp, 0xc
mov dword [esi + 0x220], eax
pop esi
pop ebx
add esp, 0x80
ret 4

Function at 0x42add0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x67a7f0]
sub esp, 0x10
cmp eax, 0x1d
push esi
mov esi, ecx
jl 0x42ae49
mov eax, dword [esp + 0x18]
mov ecx, dword [0x67a8cc]
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
lea eax, [esp + 0x10]
push edx
push 1
push 0x10
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 0x214]
add esp, 0x1c
test ah, 8
je 0x42ae49
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x42ae41
lea ecx, [esp + 4]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
mov dword [esi + 0x22c], eax
pop esi
add esp, 0x10
ret 4
xor eax, eax
mov dword [esi + 0x22c], eax
pop esi
add esp, 0x10
ret 4
Function at 0x42ccf0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545ae3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x18], esi
call fcn.00429c10
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 0x24c], ebx
mov dword [esi + 0x250], ebx
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0x254], ebx
mov dword [esi + 0x258], ebx
mov dword [esi + 0x25c], ebx
mov dword [esi + 0x260], ebx
mov dword [esi + 0x264], ebx
mov dword [esi + 0x268], ebx
mov dword [esi + 0x26c], ebx
mov dword [esi + 0x270], ebx
mov dword [esi + 0x274], eax
mov dword [esi + 0x278], eax
mov dword [esi], 0x54ac48
mov dword [esi + 0x248], eax
mov ecx, dword [0x67a8cc]
push ecx
push 1
lea edx, [esi + 0x1d0]
push 0x10
push edx
mov dword [esp + 0x34], ebx
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x3c]
push eax
push 1
push 2
push ecx
call edi
movsx eax, word [esp + 0x4c]
mov edx, eax
mov ebp, dword [sym.imp.MSVCRT.dll_ftell]
shl edx, 5
add edx, eax
mov eax, dword [0x5dde60]
add esp, 0x20
lea ecx, [eax + edx*4]
mov dword [esi + 0x1e0], ecx
mov edx, dword [0x67a8cc]
push 1
push edx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0042b280
mov eax, dword [0x67a8cc]
push eax
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0042aa50
mov ecx, dword [0x67a8cc]
push ecx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0042ab00
mov edx, dword [0x67a8cc]
push edx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0042add0
mov eax, dword [0x67a8cc]
push eax
push 1
lea ecx, [esi + 0x240]
push 8
push ecx
call edi
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x24c]
push edx
push 1
push 4
push eax
call edi
add esp, 0x20
mov ecx, esi
call fcn.0042cf50
test eax, eax
jbe 0x42ce63
mov eax, dword [esi + 0x1e8]
cmp eax, 0xa
jl 0x42ce5d
mov eax, 0xa
mov dword [esi + 0x1e8], eax
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x10]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x20], ebx
call edi
mov eax, dword [esi + 0x214]
add esp, 0x10
test ah, 0x40
je 0x42cebd
cmp dword [esp + 0x10], ebx
jle 0x42cebd
push 0x20
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x42ceb1
mov edx, dword [esp + 0x10]
mov ecx, eax
push edx
call fcn.00430ec0
jmp 0x42ceb3
xor eax, eax
mov byte [esp + 0x24], bl
mov dword [esi + 0x250], eax
call fcn.004d2870
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x27c], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x42fb80
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545b98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00429c10
push 0x84
mov dword [esp + 0x18], 0
mov dword [esi], 0x54ae78
call fcn.004784b0
add esp, 4
test eax, eax
je 0x42fbd0
mov ecx, eax
call fcn.004161a0
jmp 0x42fbd2
xor eax, eax
push 1
lea ecx, [edi + 8]
push 0
push ecx
mov ecx, eax
mov dword [esi + 0x1e0], eax
call fcn.00416690
mov edx, dword [0x67a8cc]
add edi, 0x34
push 0
push edi
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [0x67a8cc]
add esp, 0xc
mov ecx, esi
push eax
push 1
push 0x10
call fcn.0043d3d0
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push eax
call edi
mov ecx, dword [0x67a8cc]
lea edx, [esi + 0x1d0]
push ecx
push 1
push 0x10
push edx
call edi
mov eax, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x20
push 1
push eax
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.0042b280
mov ecx, dword [0x67a8cc]
push ecx
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.0042aa50
mov edx, dword [0x67a8cc]
push edx
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.0042add0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x42ff10
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545bd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.00429c10
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi], 0x54af90
mov ecx, dword [0x67a8cc]
lea edx, [esi + 0x1d0]
push ecx
push 1
push 0x10
push edx
mov dword [esp + 0x24], 0
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x2c]
push eax
push 1
push 2
push ecx
call edi
movsx eax, word [esp + 0x3c]
mov ecx, dword [0x5dde68]
mov edi, dword [sym.imp.MSVCRT.dll_ftell]
add eax, ecx
add esp, 0x20
mov edx, eax
shl edx, 5
add edx, eax
mov eax, dword [0x5dde60]
lea ecx, [eax + edx*4]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x1e0], ecx
mov eax, dword [0x67a8cc]
push edx
push eax
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.0042b280
mov ecx, dword [0x67a8cc]
push ecx
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.0042aa50
mov edx, dword [0x67a8cc]
push edx
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.0042add0
mov eax, dword [esi + 0x214]
test ah, 0x20
je 0x42fffa
mov eax, dword [0x67a8cc]
push eax
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.0042acc0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8