joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d960
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x44a2cc]
cmp eax, dword [0x44a2c8]
jge 0x41d984
lea edx, [eax + 1]
movsx eax, byte [eax + 0x44a300]
mov dword [0x44a2cc], edx
add esp, 0x1c
ret
mov eax, dword [0x44a2c4]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
mov dword [esp], 0x44a300
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fread
test eax, eax
mov dword [0x44a2c8], eax
mov dword [0x44a2cc], 0
je 0x41d9e0
mov eax, dword [0x44a2c4]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
je 0x41d9d9
mov eax, dword [0x44a2c8]
mov byte [eax + 0x44a300], 0xff
mov eax, dword [0x44a2cc]
jmp 0x41d970
mov eax, 0xffffffff
jmp 0x41d980

Function at 0x41e260
Capabilities:
Write file on windows

Disassembly:
test edx, edx
je 0x41e390
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x41e390
cmp dword [ecx + 0xe4], 0
je 0x41e390
push ebp
push edi
mov ebp, eax
push esi
push ebx
mov esi, edx
sub esp, 0x2c
mov eax, dword [ecx]
mov byte [esp + 0x1c], 0
mov edx, dword [ecx]
test edx, edx
jne 0x41e3b1
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x2b
xor ebx, ebx
mov dword [esp + 4], 1
mov dword [esp], str.static_XkbKeyNameRec_tkeyNames_NUM_KEYS___n
lea edi, [esp + 0x18]
call sub.msvcrt.dll_fwrite
jmp 0x41e2ed
mov dword [esp + 4], str._______6s___
mov dword [esp], ebp
call sub.msvcrt.dll_fprintf
mov eax, ebx
and eax, 3
cmp eax, 3
je 0x41e371
movzx eax, byte [esi + 9]
add ebx, 1
cmp eax, ebx
jb 0x41e344
mov dword [esp + 4], 1
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0xe4]
lea eax, [eax + ebx*4]
mov dword [esp], eax
call fcn.00428730
mov dword [esp + 4], str.__s_
mov dword [esp + 8], eax
mov dword [esp], edi
call sub.msvcrt.dll_sprintf
movzx eax, byte [esi + 9]
mov dword [esp + 8], edi
cmp eax, ebx
jne 0x41e2c4
mov dword [esp + 4], str._______6s___n
mov dword [esp], ebp
add ebx, 1
call sub.msvcrt.dll_fprintf
movzx eax, byte [esi + 9]
cmp eax, ebx
jae 0x41e2ed
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x43ebbb
call sub.msvcrt.dll_fwrite
add esp, 0x2c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
jmp 0x41e2e2
mov dword [0x44c348], 1
mov dword [0x44b754], 0x43eb3b
xor eax, eax
mov dword [0x44c344], 0
ret
mov dword [esp + 8], 3
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.004295c0
mov dword [esp + 4], str.__keycodes_name_is___s____n
mov dword [esp + 8], eax
mov dword [esp], ebp
call sub.msvcrt.dll_fprintf
jmp 0x41e29c
Function at 0x41e3e0
Capabilities:
Write file on windows

Disassembly:
test edx, edx
je 0x41e521
mov ecx, dword [edx + 0x14]
test ecx, ecx
je 0x41e521
cmp dword [ecx + 0xc], 0
je 0x41e521
cmp dword [ecx + 0x10], 0
je 0x41e521
push ebp
push edi
mov ebp, edx
push esi
push ebx
mov esi, eax
sub esp, 0x2c
movzx eax, word [ecx + 0xa]
mov dword [esp + 4], str.define_NUM_SYMBOLS_t_d_n
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp + 0x14]
cmp word [eax + 0xa], 0
jne 0x41e570
cmp byte [ebp + 9], 0
mov eax, 1
jne 0x41e450
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x14]
xor edi, edi
mov ebx, dword [eax + 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x28
mov dword [esp + 4], 1
mov dword [esp], str.static_XkbSymMapRec_tsymMap_NUM_KEYS___n
call sub.msvcrt.dll_fwrite
jmp 0x41e4d2
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 0x43ec1a
call sub.msvcrt.dll_fwrite
movzx eax, word [ebx + 6]
add edi, 1
add ebx, 8
mov dword [esp + 0x10], eax
movzx eax, byte [ebx - 4]
mov dword [esp + 0xc], eax
movzx eax, byte [ebx - 8]
mov dword [esp + 4], str.__2d__0x_x___3d_
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
movzx eax, byte [ebp + 9]
cmp eax, edi
jb 0x41e542
test edi, edi
mov dword [esp + 0xc], esi
je 0x41e500
test edi, 3
je 0x41e480
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x43ec21
call sub.msvcrt.dll_fwrite
jmp 0x41e49c
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], 0x43ec15
call sub.msvcrt.dll_fwrite
jmp 0x41e49c
mov dword [0x44c348], 4
mov dword [0x44b754], 0x43ebbf
xor eax, eax
mov dword [0x44c344], 0
ret
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str._n__n
call sub.msvcrt.dll_fwrite
add esp, 0x2c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [eax + 0xc]
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], str.static_KeySym_tsymCache_NUM_SYMBOLS___n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp + 0x14]
cmp word [eax + 0xa], 0
jne 0x41e5f5
jmp 0x41e641
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 0x43ec1a
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], 1
mov eax, dword [edi + ebx*4]
add ebx, 1
mov dword [esp], eax
call fcn.00428670
mov dword [esp + 4], 0x43ec24
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp + 0x14]
movzx eax, word [eax + 0xa]
cmp eax, ebx
jbe 0x41e641
test ebx, ebx
mov dword [esp + 0xc], esi
je 0x41e620
test bl, 3
je 0x41e5a4
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x43ec21
call sub.msvcrt.dll_fwrite
jmp 0x41e5c0
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], 0x43ec15
call sub.msvcrt.dll_fwrite
jmp 0x41e5c0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str._n__n
call sub.msvcrt.dll_fwrite
cmp byte [ebp + 9], 0
mov eax, 1
je 0x41e443
jmp 0x41e450
Function at 0x423ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
test ecx, ecx
je 0x423c30
mov esi, eax
mov eax, dword [ecx + 0x1c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
lea ecx, [eax + 0x14]
test eax, eax
mov eax, 0
cmovne eax, ecx
xor ebp, ebp
xor ebx, ebx
mov edi, eax
mov eax, ebp
mov ebp, edi
mov edi, eax
jmp 0x423bae
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x16
mov dword [esp + 4], 1
mov dword [esp], str.____virtual_modifiers
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], 2
mov eax, dword [ebp + edi*4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004295c0
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [esp + 0x40]
test eax, eax
je 0x423ba3
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x423ba3
movzx eax, byte [eax + edi + 0x14]
test al, al
je 0x423ba3
cmp dword [esp + 0x40], 2
mov dword [esp + 4], 2
mov dword [esp], eax
je 0x423c12
call fcn.00427b30
mov dword [esp + 4], str.__s
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
add ebx, 1
add edi, 1
cmp edi, 0x10
je 0x423be0
test ebp, ebp
je 0x423ba6
mov edx, dword [ebp + edi*4]
test edx, edx
je 0x423ba6
test ebx, ebx
je 0x423b10
mov dword [esp + 4], esi
mov dword [esp], 0x2c
call sub.msvcrt.dll_fputc
jmp 0x423b30
test ebx, ebx
mov di, 1
je 0x423c08
mov dword [esp + 0xc], esi
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x440928
call sub.msvcrt.dll_fwrite
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00427b30
mov dword [esp + 4], str.____s__
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
jmp 0x423ba3
add esp, 0x2c
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
Function at 0x4250e0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
mov ebx, edx
sub esp, 0x2c
mov esi, dword [esp + 0x44]
mov dword [esp + 0x18], ecx
mov dword [esp], esi
call fcn.0042a030
mov dword [esp + 4], edi
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fputs
cmp esi, 8
je 0x425120
mov dword [esp], 8
call fcn.0042a030
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
movzx eax, word [eax + 4]
cmp eax, dword [esp + 0x40]
je 0x425292
mov dword [esp + 4], 3
mov dword [esp], eax
call fcn.00429700
mov dword [esp + 4], str.corner__s_
mov dword [esp + 8], eax
mov dword [esp], edi
call sub.msvcrt.dll_fprintf
test ebx, ebx
je 0x42518c
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], 0x440d14
mov dword [esp], edi
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x18]
cmp eax, dword [ebx + 0xc]
je 0x4252c5
mov eax, dword [esp + 0x18]
cmp eax, dword [ebx + 0x10]
je 0x4252a0
mov dword [esp + 4], edi
mov dword [esp], 0x7b
xor ebx, ebx
call sub.msvcrt.dll_fputc
mov eax, dword [esp + 0x18]
cmp word [eax], 0
mov esi, dword [eax + 8]
jne 0x42521b
jmp 0x425265
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], str.__n_s
mov dword [esp], edi
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], 2
movsx eax, word [esi + 2]
add ebx, 1
add esi, 4
mov dword [esp], eax
call fcn.00429700
mov dword [esp + 4], 2
mov ebp, eax
movsx eax, word [esi - 4]
mov dword [esp], eax
call fcn.00429700
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov dword [esp + 4], str.___3s___3s__
mov dword [esp], edi
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x18]
movzx eax, word [eax]
cmp ebx, eax
jge 0x425265
test ebx, ebx
je 0x425250
test bl, 3
je 0x4251b0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x440b5e
call sub.msvcrt.dll_fwrite
jmp 0x4251c8
mov dword [esp + 4], edi
mov dword [esp], 0x20
call sub.msvcrt.dll_fputc
jmp 0x4251c8
mov dword [esp + 0xc], edi
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x440d2b
call sub.msvcrt.dll_fwrite
add esp, 0x2c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
test ebx, ebx
jne 0x425172
jmp 0x42518c
mov dword [esp + 0xc], edi
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str.primary
call sub.msvcrt.dll_fwrite
jmp 0x42518c
mov dword [esp + 0xc], edi
mov dword [esp + 8], 8
mov dword [esp + 4], 1
mov dword [esp], str.approx
call sub.msvcrt.dll_fwrite
jmp 0x42518c
Function at 0x427990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push ebx
sub esp, 0x84
cmp dword [esp + 0x94], 1
mov eax, dword [esp + 0x90]
je 0x427a60
cmp eax, 7
jbe 0x427a90
cmp eax, 0xff
je 0x427ab0
lea ebx, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ILLEGAL__02x
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4279db
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
sbb edx, 3
sub edx, ebx
add edx, 1
cmp edx, 0x1ff
ja 0x427af4
mov eax, dword [0x44b848]
mov ecx, 0x200
sub ecx, eax
cmp edx, ecx
mov ecx, 0
cmovae eax, ecx
lea ecx, [eax + edx]
lea esi, [eax + 0x44b880]
mov dword [0x44b848], ecx
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], edx
call sub.msvcrt.dll_memcpy
add esp, 0x84
mov eax, esi
pop ebx
pop esi
ret
cmp eax, 7
jbe 0x427ad0
cmp eax, 0xff
je 0x427b00
lea ebx, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.0x_02x
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
jmp 0x4279d9
mov eax, dword [eax*4 + 0x441be0]
lea ebx, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
jmp 0x4279d9
mov dword [esp + 0x1c], 0x656e6f6e
mov byte [esp + 0x20], 0
lea ebx, [esp + 0x1c]
jmp 0x4279d9
mov eax, dword [eax*4 + 0x441be0]
lea ebx, [esp + 0x1c]
mov dword [esp + 4], str._sMapIndex
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
jmp 0x4279d9
xor esi, esi
jmp 0x427a3f
mov eax, 0x72
mov dword [esp + 0x1c], 0x4e626b58
mov dword [esp + 0x20], 0x646f4d6f
mov dword [esp + 0x24], 0x65696669
mov word [esp + 0x28], ax
lea ebx, [esp + 0x1c]
jmp 0x4279d9
Function at 0x429d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push ebx
sub esp, 0x124
cmp dword [esp + 0x138], 1
mov ecx, dword [esp + 0x134]
je 0x429e40
movzx edx, byte [ecx]
mov eax, edx
shr dl, 7
and eax, 0x7f
cmp al, 1
je 0x429e80
cmp al, 2
movzx esi, al
je 0x429eb0
lea eax, [esi - 3]
lea ebx, [esp + 0x20]
cmp eax, 1
jbe 0x429f15
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x429dbd
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
sbb edx, 3
sub edx, ebx
add edx, 1
cmp edx, 0x1ff
ja 0x429f94
mov eax, dword [0x44b848]
mov ecx, 0x200
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
sub ecx, eax
cmp edx, ecx
mov ecx, 0
cmovb ecx, eax
lea esi, [ecx + 0x44b880]
add ecx, edx
mov dword [0x44b848], ecx
mov dword [esp], esi
call sub.msvcrt.dll_memcpy
add esp, 0x124
mov eax, esi
pop ebx
pop esi
ret
movzx eax, byte [ecx]
test al, al
jne 0x429ef0
mov eax, 0x7d
mov dword [esp + 0x20], 0x2020207b
mov dword [esp + 0x24], 0x20202c30
mov dword [esp + 0x28], 0x20302020
mov word [esp + 0x2c], ax
lea ebx, [esp + 0x20]
jmp 0x429dbb
test dl, dl
lea ebx, [esp + 0x20]
mov edx, str.True
mov eax, str.Permanent
mov dword [esp + 4], str.lock__s
cmove eax, edx
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
jmp 0x429dbb
movzx ecx, byte [ecx + 1]
lea ebx, [esp + 0x20]
mov esi, ebx
mov eax, ecx
and eax, 0x7f
add eax, 1
test cl, cl
js 0x42a000
test dl, dl
mov dword [esp + 8], eax
je 0x429fa0
mov dword [esp + 4], str.permanentRadioGroup__d
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
jmp 0x429dbb
movzx edx, byte [ecx + 1]
lea ebx, [esp + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__3d__0x_02x_
mov dword [esp], ebx
mov dword [esp + 0xc], edx
call sub.msvcrt.dll_sprintf
jmp 0x429dbb
movzx eax, byte [ecx + 1]
mov ecx, dword [esp + 0x130]
xor ebx, ebx
cmp esi, 3
setne bl
add ebx, 1
test ecx, ecx
je 0x429fd0
mov esi, dword [esp + 0x130]
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x429fd0
mov ecx, dword [ecx + 0xe4]
test ecx, ecx
je 0x429fd0
lea eax, [ecx + eax*4]
mov dword [esp + 4], 2
mov byte [esp + 0x1f], dl
mov dword [esp], eax
call fcn.00428730
movzx edx, byte [esp + 0x1f]
test dl, dl
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
je 0x429fb5
lea ebx, [esp + 0x20]
mov dword [esp + 4], str.permanentOverlay_d__s
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
jmp 0x429dbb
add esp, 0x124
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp + 4], str.radioGroup__d
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
jmp 0x429dbb
lea ebx, [esp + 0x20]
mov dword [esp + 4], str.overlay_d__s
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
jmp 0x429dbb
mov dword [esp + 8], eax
mov dword [esp + 4], 0x441314
mov dword [esp], 0x44b7a0
mov byte [esp + 0x1f], dl
call sub.msvcrt.dll_sprintf
mov eax, 0x44b7a0
movzx edx, byte [esp + 0x1f]
jmp 0x429f6f
mov esi, 0x2c65
mov dword [esp + 0x20], 0x6f6c6c61
mov dword [esp + 0x24], 0x6e6f4e77
mov word [esp + 0x28], si
mov byte [esp + 0x2a], 0
lea esi, [esp + 0x2a]
jmp 0x429eca
Function at 0x42b140
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, eax
mov ebx, edx
sub esp, 0x2c
test edx, edx
je 0x42b15d
mov dword [esp], edx
call sub.msvcrt.dll_strlen
test eax, eax
mov edi, eax
jne 0x42b192
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp + 0x1c], 0
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, 4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fwrite
mov edx, eax
mov eax, 2
test edx, edx
js 0x42b18a
lea edx, [edi + 5]
and edx, 0xfffffffc
mov ebp, edx
mov ebx, edx
sub ebp, edi
sub ebp, 2
je 0x42b207
xor edi, edi
lea esi, [esi]
mov dword [esp + 4], esi
mov dword [esp], 0
add edi, 1
call sub.msvcrt.dll_putc
cmp edi, ebp
jne 0x42b1f0
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42b220
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
movzx ebx, byte [ecx + 5]
mov esi, dword [edx]
movzx edx, byte [ecx + 4]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x11], bl
movzx ebx, word [ecx + 6]
cmp dl, 5
mov byte [esp + 0x10], dl
mov word [esp + 0x12], bx
movzx ebx, word [ecx + 8]
mov word [esp + 0x14], bx
ja case.0x42b264.0
jmp dword [edx*4 + 0x441c54]
movzx edx, word [ecx + 0xa]
mov word [esp + 0x16], dx
movzx edx, word [ecx + 0xc]
mov byte [esp + 0x18], dl
movzx edx, word [ecx + 0xe]
mov byte [esp + 0x19], dl
mov edi, eax
mov eax, dword [ecx]
mov dword [esp], esi
mov ebx, ecx
mov dword [esp + 4], eax
call fcn.00422310
mov edx, eax
mov eax, edi
call fcn.0042b140
mov esi, eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
shl eax, 4
add esi, eax
movzx eax, byte [ebx + 4]
cmp al, 3
je 0x42b370
cmp al, 5
je 0x42b394
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, word [ecx + 0xc]
mov byte [esp + 0x16], dl
movzx edx, word [ecx + 0xe]
mov byte [esp + 0x17], dl
movzx edx, word [ecx + 0x10]
mov byte [esp + 0x18], dl
jmp 0x42b289
movzx edx, word [ecx + 0xa]
mov word [esp + 0x16], dx
movzx edx, word [ecx + 0xc]
mov word [esp + 0x18], dx
movzx edx, word [ecx + 0xe]
mov word [esp + 0x1a], dx
movzx edx, word [ecx + 0x10]
mov byte [esp + 0x1c], dl
jmp 0x42b289
xor esi, esi
mov dword [0x44c348], 0xa
mov dword [0x44b754], 0x441c40
mov dword [0x44c344], edx
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + 0x14]
mov eax, edi
call fcn.0042b140
mov edx, dword [ebx + 0x18]
mov ebp, eax
mov eax, edi
call fcn.0042b140
add eax, ebp
add esp, 0x2c
add esi, eax
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + 0x10]
mov eax, edi
call fcn.0042b140
add esi, eax
jmp 0x42b2df
Function at 0x42d200
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x28
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], 1
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 1
jne 0x42d232
test ebx, ebx
je 0x42d232
add dword [ebx], 4
mov eax, dword [esp + 0x1c]
add esp, 0x28
pop ebx
ret

Function at 0x42d240
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x28
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1e]
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 1
jne 0x42d272
test ebx, ebx
je 0x42d272
add dword [ebx], 2
movzx eax, word [esp + 0x1e]
add esp, 0x28
pop ebx
ret

Function at 0x42d280
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
mov esi, ecx
sub esp, 0x3c
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
call fcn.0042d240
movzx ebx, ax
mov eax, dword [esp + 0x2c]
test ebx, ebx
je 0x42d302
cmp ebx, esi
mov dword [esp + 0xc], edi
jle 0x42d360
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp ebx, eax
mov ebp, eax
jg 0x42d2eb
jmp 0x42d37a
add ebp, 1
cmp ebx, ebp
je 0x42d37a
mov dword [esp], edi
call sub.msvcrt.dll_getc
cmp eax, 0xffffffff
jne 0x42d2e0
mov eax, dword [esp + 0x2c]
add eax, ebp
mov dword [esp + 0x2c], eax
cmp ebx, esi
mov ecx, dword [esp + 0x1c]
jl 0x42d350
mov byte [ecx + esi - 1], 0
lea ebp, [eax + 3]
xor ebx, ebx
xor esi, esi
and ebp, 0xfffffffc
sub ebp, eax
test ebp, ebp
jle 0x42d340
nop
mov dword [esp], edi
call sub.msvcrt.dll_getc
cmp eax, 0xffffffff
setne al
add ebx, 1
movzx eax, al
add esi, eax
cmp ebp, ebx
jne 0x42d320
mov eax, dword [esp + 0x2c]
add eax, esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [ecx + ebx], 0
jmp 0x42d30f
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ebp, eax
mov eax, dword [esp + 0x2c]
add eax, ebp
mov dword [esp + 0x2c], eax
jmp 0x42d302
Function at 0x42d390
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov ebp, edx
push esi
push ebx
mov edi, eax
sub esp, 0xac
lea esi, [esp + 0x3c]
mov dword [esp + 0x1c], ecx
mov ecx, 0x64
mov edx, esi
call fcn.0042d280
mov ebx, eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebp
shl eax, 4
mov dword [esp + 8], 0
mov dword [esp + 4], esi
add ebx, eax
call fcn.00422360
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.libX11_6.dll_XkbAddGeomDoodad
test eax, eax
mov ebp, eax
je case.0x42d438.0
movzx edx, byte [esp + 0x2d]
movzx eax, byte [esp + 0x2c]
mov byte [ebp + 5], dl
movzx edx, word [esp + 0x2e]
cmp al, 5
mov byte [ebp + 4], al
mov word [ebp + 6], dx
movzx edx, word [esp + 0x30]
mov word [ebp + 8], dx
ja case.0x42d438.0
jmp dword [eax*4 + 0x441d18]
movzx eax, word [esp + 0x32]
mov ecx, 0x64
mov edx, esi
mov word [ebp + 0xa], ax
movzx eax, word [esp + 0x34]
mov word [ebp + 0xc], ax
movzx eax, word [esp + 0x36]
mov word [ebp + 0xe], ax
movzx eax, byte [esp + 0x38]
mov word [ebp + 0x10], ax
mov eax, edi
call fcn.0042d280
mov dword [esp], esi
add ebx, eax
call fcn.00431618
mov ecx, 0x64
mov dword [ebp + 0x14], eax
mov edx, esi
mov eax, edi
call fcn.0042d280
mov dword [esp], esi
add ebx, eax
call fcn.00431618
mov dword [ebp + 0x18], eax
add esp, 0xac
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, word [esp + 0x32]
mov edx, esi
mov ecx, 0x64
mov word [ebp + 0xa], ax
movzx eax, byte [esp + 0x34]
mov word [ebp + 0xc], ax
movzx eax, byte [esp + 0x35]
mov word [ebp + 0xe], ax
mov eax, edi
call fcn.0042d280
mov dword [esp], esi
add ebx, eax
call fcn.00431618
mov dword [ebp + 0x10], eax
add esp, 0xac
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, word [esp + 0x32]
mov word [ebp + 0xa], ax
movzx eax, byte [esp + 0x34]
mov word [ebp + 0xc], ax
movzx eax, byte [esp + 0x35]
mov word [ebp + 0xe], ax
add esp, 0xac
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [esp + 0x32]
mov word [ebp + 0xc], ax
movzx eax, byte [esp + 0x33]
mov word [ebp + 0xe], ax
movzx eax, byte [esp + 0x34]
mov word [ebp + 0x10], ax
add esp, 0xac
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret