joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x404]
sub esp, 0x404
push 0xffffffffffffffff
push 0x10021ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1002b024]
xor eax, ebp
mov dword [ebp + 0x400], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov edi, dword [ebp + 0x414]
mov esi, dword [ebp + 0x40c]
mov dword [ebp - 0x14], eax
xor eax, eax
push 0x3fe
mov ebx, ecx
push eax
lea edx, [ebp + 2]
xor ecx, ecx
push edx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
mov word [ebp], cx
call fcn.100144d0
add esp, 0xc
call fcn.100040e0
cmp dword [esi + 0x14], 0
je 0x10010dcd
mov edi, dword [ebp - 0x14]
cmp dword [edi + 0x14], 0
je 0x10010dcd
cmp dword [ebx + 0x20], 0
je 0x10010dcd
mov dword [ebp - 4], 0
cmp dword [ebx + 0x24], 8
jb 0x10010c71
mov ebx, dword [ebx + 0x10]
jmp 0x10010c74
add ebx, 0x10
push ebx
lea eax, [ebp]
push 0x200
push eax
call fcn.1001302e
mov ebx, 8
add esp, 0xc
cmp dword [esi + 0x18], ebx
jb 0x10010c95
mov esi, dword [esi + 4]
jmp 0x10010c98
add esi, 4
push esi
lea ecx, [ebp]
push 0x200
push ecx
call fcn.10013205
add esp, 0xc
lea edx, [ebp - 0x20]
push edx
push 0x20019
push 0
lea eax, [ebp]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10010ce0
push 0x10026b2c
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 0x28], 0xffffffff
call fcn.10014cdc
lea esi, [edi + 4]
cmp dword [edi + 0x18], ebx
jb 0x10010cec
mov eax, dword [esi]
jmp 0x10010cee
mov eax, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x1c]
push edx
mov edx, dword [ebp - 0x20]
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0
push eax
push edx
call ebx
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x10010db1
cmp dword [ebp - 0x24], 1
jne 0x10010db1
cmp dword [ebp - 0x1c], eax
jbe 0x10010db1
lea eax, [ebp - 0x44]
push eax
call fcn.10004180
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x15]
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x15], 0
call fcn.1000f430
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x38]
jne 0x10010d52
call fcn.1001346d
cmp dword [edi + 0x18], 8
jb 0x10010d5a
mov esi, dword [esi]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push eax
push ecx
push 0
push 0
push esi
push edx
call ebx
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x10010d8f
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x38]
jne 0x10010d83
call fcn.1001346d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
push ecx
call fcn.10005800
lea esi, [ebp - 0x44]
call fcn.10004240
jmp 0x10010db6
mov ebx, 2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x10010dc4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
sete al
jmp 0x10010dcf
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.10012c7f
add ebp, 0x404
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010e00
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x404]
sub esp, 0x404
push 0xffffffffffffffff
push 0x100213a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1002b024]
xor eax, ebp
mov dword [ebp + 0x400], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x40c]
mov ebx, dword [ebp + 0x410]
xor eax, eax
push 0x3fe
mov esi, ecx
push eax
lea ecx, [ebp + 2]
push ecx
mov dword [ebp - 0x14], 0
mov word [ebp], ax
call fcn.100144d0
add esp, 0xc
cmp dword [edi + 0x14], 0
je 0x10010f44
cmp dword [ebx + 0x14], 0
je 0x10010f44
cmp dword [esi + 0x20], 0
je 0x10010f44
mov dword [ebp - 4], 0
cmp dword [esi + 0x24], 8
jb 0x10010e99
mov esi, dword [esi + 0x10]
jmp 0x10010e9c
add esi, 0x10
push esi
lea edx, [ebp]
push 0x200
push edx
call fcn.1001302e
mov esi, 8
add esp, 0xc
cmp dword [edi + 0x18], esi
jb 0x10010ebd
mov edi, dword [edi + 4]
jmp 0x10010ec0
add edi, 4
push edi
lea eax, [ebp]
push 0x200
push eax
call fcn.10013205
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push 0x20006
push 0
lea edx, [ebp]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x10010f13
push 0x10026b2c
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0xffffffff
call fcn.10014cdc
mov eax, 0x10010f0e
ret
cmp dword [ebx + 0x18], esi
jb 0x10010f1d
mov eax, dword [ebx + 4]
jmp 0x10010f20
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10010f3b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x10010f46
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x400]
xor ecx, ebp
call fcn.10012c7f
add ebp, 0x404
mov esp, ebp
pop ebp
ret 8
Function at 0x10012c7f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002b024]
jne 0x10012c89
repz ret
jmp fcn.100141d7

Function at 0x10013979
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x100139aa
call fcn.1001490a
mov dword [eax], esi
call fcn.100148f7
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10013447
add esp, 0x14
push 0x16
pop eax
jmp 0x100139ff
test dword [ebp + 0xc], 0xfffffff9
jne 0x10013986
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100139d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1001491d
pop ecx
call fcn.100148f7
mov eax, dword [eax]
jmp 0x100139ff
test al, 0x10
jne 0x100139fd
test al, 1
je 0x100139fd
test byte [ebp + 0xc], 2
je 0x100139fd
call fcn.1001490a
mov dword [eax], 5
call fcn.100148f7
mov dword [eax], 0xd
jmp 0x100139ce
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10019e2d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10014d9a
and dword [ebp - 4], 0
cmp dword [0x1002d00c], 0
mov ebx, eax
jne 0x10019ede
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10019f8f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10019f8f
push eax
call fcn.10014d28
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1002d00c], eax
call esi
push eax
call fcn.10014d28
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1002d010], eax
call esi
push eax
call fcn.10014d28
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1002d014], eax
call esi
push eax
call fcn.10014d28
pop ecx
mov dword [0x1002d01c], eax
test eax, eax
je 0x10019ede
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10014d28
pop ecx
mov dword [0x1002d018], eax
mov eax, dword [0x1002d018]
cmp eax, ebx
je 0x10019f36
cmp dword [0x1002d01c], ebx
je 0x10019f36
push eax
call fcn.10014da3
push dword [0x1002d01c]
mov esi, eax
call fcn.10014da3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10019f36
test edi, edi
je 0x10019f36
call esi
test eax, eax
je 0x10019f2d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10019f2d
test byte [ebp - 0xc], 1
jne 0x10019f36
or dword [ebp + 0x10], 0x200000
jmp 0x10019f6f
mov eax, dword [0x1002d010]
cmp eax, ebx
je 0x10019f6f
push eax
call fcn.10014da3
pop ecx
test eax, eax
je 0x10019f6f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10019f6f
mov eax, dword [0x1002d014]
cmp eax, ebx
je 0x10019f6f
push eax
call fcn.10014da3
pop ecx
test eax, eax
je 0x10019f6f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002d00c]
call fcn.10014da3
pop ecx
test eax, eax
je 0x10019f8f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10019f91
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4055f0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4c8bb0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x210], ecx
push fcn.00401000
mov ecx, dword [ebp - 0x210]
call fcn.004054d0
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x210]
call fcn.00403790
cmp dword [ebp - 4], 0xffffffff
jne 0x405635
or eax, 0xffffffff
jmp 0x4056fa
mov eax, dword [ebp - 0x210]
movzx ecx, byte [eax + 0x420]
test ecx, ecx
je 0x405688
mov edx, dword [ebp - 0x210]
push edx
call dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
test eax, eax
je 0x405662
or eax, 0xffffffff
jmp 0x4056fa
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0x200
push ecx
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
test eax, eax
je 0x405688
or eax, 0xffffffff
jmp 0x4056fa
cmp dword [ebp - 4], 0xfffffffe
jne 0x4056f8
push 0x4b19a8
lea edx, [ebp - 0x208]
push edx
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x200
lea eax, [ebp - 0x208]
push eax
call fcn.00477d60
add esp, 8
test eax, eax
je 0x4056bf
or eax, 0xffffffff
jmp 0x4056fa
push 0x4b19bc
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x4056e8
or eax, 0xffffffff
jmp 0x4056fa
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049f322
mov esp, ebp
pop ebp
ret

Function at 0x406960
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00406990
add esp, 0xc
push 1
call dword [sym.imp.MSVCR100.dll_exit]
pop ebp
ret
Function at 0x41df00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4adb9b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c8bb0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0xc]
xor ebx, ebx
cmp ecx, ebx
je 0x41df56
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jge 0x41df56
lea edx, [eax + eax*2]
inc eax
mov dword [esi], eax
mov eax, dword [esp + 0x40]
lea ecx, [ecx + edx*8]
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.0041c510
jmp 0x41e02e
mov eax, dword [esi + 8]
add dword [esi + 4], eax
mov edi, dword [esi + 4]
xor ecx, ecx
mov eax, edi
mov edx, 0x18
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], ebx
cmp eax, ebx
je 0x41dfac
push 0x41c500
push 0x41c4e0
push edi
lea ebp, [eax + 4]
push 0x18
push ebp
mov dword [eax], edi
call fcn.0049f46c
jmp 0x41dfae
xor ebp, ebp
mov dword [esp + 0x38], 0xffffffff
cmp ebp, ebx
jne 0x41dfcb
push 0x4b1de0
push 0x6e
push 0x4b3ea8
call fcn.00406960
cmp dword [esi], ebx
jle 0x41dfec
xor edi, edi
mov ecx, dword [esi + 0xc]
add ecx, edi
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [edi + ebp]
call fcn.0041c510
inc ebx
add edi, 0x18
cmp ebx, dword [esi]
jl 0x41dfd1
mov eax, dword [esi]
mov edx, dword [esp + 0x40]
lea ecx, [eax + eax*2]
inc eax
mov dword [esi], eax
push edx
lea eax, [esp + 0x1c]
lea ecx, [ebp + ecx*8]
push eax
call fcn.0041c510
mov eax, dword [esi + 0xc]
test eax, eax
je 0x41e02b
mov ecx, dword [eax - 4]
lea edi, [eax - 4]
push 0x41c500
push ecx
push 0x18
push eax
call fcn.0049f52f
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0xc], ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x41ece0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4c8bb0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00423d50
test eax, eax
je 0x41ed13
call fcn.00423cb0
push eax
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x41ed5c
push 0x4b40e4
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x41ed46
push 0x4b40ec
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x41ed5c
mov edx, dword [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x4b40f0
push 0x4b40f8
push 0x5c
lea ecx, [ebp - 0x210]
push ecx
push 0x4b4100
push 0x4cc6c0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x4cc8c0], 0
push 0x4b410c
push 0x4cc6c0
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x4cc6c0], 0
push 0x201
push 0x4cc6c0
call fcn.0041eb70
add esp, 8
push 0x4b4110
push str.zone
push 0x5c
lea edx, [ebp - 0x210]
push edx
push str._s_c_s_s
push 0x4cc8c8
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
mov byte [0x4ccac8], 0
push 0x4b412c
push 0x4cc8c8
call dword [sym.imp.MSVCR100.dll_strcspn]
add esp, 8
mov byte [eax + 0x4cc8c8], 0
push 0x201
push 0x4cc8c8
call fcn.0041eb70
add esp, 8
cmp dword [0x4ccad4], 0
jne 0x41ee2e
push 0x41ec90
call fcn.0049f639
add esp, 4
mov dword [0x4ccad4], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f322
mov esp, ebp
pop ebp
ret

Function at 0x423730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4c8bb0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4d1f6c], 0
je 0x423796
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s___d__:__d_n
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
mov ecx, dword [0x4d1f68]
push ecx
lea edx, [ebp - 0x408]
push edx
call sub.MSVCR100.dll_strlen
add esp, 4
push eax
push 1
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049f322
mov esp, ebp
pop ebp
ret

Function at 0x423cb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x4b4340
cmp dword [0x4cdaa4], 0
je 0x423ccf
mov eax, 0x4cdaa8
jmp 0x423cf0
push 0x4b4344
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x423ced
mov eax, dword [ebp - 8]
jmp 0x423cf0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x423d60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4cdaa4], 0
je 0x423d81
push 0x4cdaa8
push 0x4d1d30
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x423dbd
push str.WNCZONE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x423dac
push 0x4b4360
push 0x4d1d30
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x423dbd
mov eax, dword [ebp - 4]
push eax
push 0x4d1d30
call sub.MSVCR100.dll_strcpy
add esp, 8
push 0x4b4364
mov ecx, dword [ebp + 8]
push ecx
call fcn.00483040
add esp, 8
push eax
push 0x5c
push 0x4d1d30
push 0x4b436c
push 0x4d1b28
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
push 0x201
push 0x4d1b28
call fcn.00477d60
add esp, 8
cmp dword [0x4d1f3c], 0
jne 0x423e1b
push 0x423c50
call fcn.0049f639
add esp, 4
mov dword [0x4d1f3c], 1
mov esp, ebp
pop ebp
ret
Function at 0x4347b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x191
mov eax, dword [ebp - 4]
sub eax, 1
cmp eax, 0x190
je 0x4347ef
push 0x190
mov ecx, dword [ebp - 4]
sub ecx, 1
push ecx
push str._RCSfile:_outilparutils.cxx_v__
push str.file__s_:_internal_error__size_mismatch:_._noutilpar.inc_size_d__dtbmax.inc_size_d_nAborting._n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0x10
push 0xffffffffffffffff
call dword [sym.imp.MSVCR100.dll_exit]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x459ba0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
test eax, eax
je 0x459c3c
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, esi
imul ecx, edi
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_realloc]
add esp, 8
test eax, eax
jne 0x459caa
push edi
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c136c
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x4c13a8
push 0x4c13dc
mov byte [0x652212], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_reallocation_failed__n
push 0x4c1420
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push esi
push edi
call dword [sym.imp.MSVCR100.dll_calloc]
add esp, 8
test eax, eax
jne 0x459caa
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push str.ReallocateArray_____Cannot_get__d_elements_of__d_bytes..._n
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x40
push eax
call edi
add esp, 0x10
push 0x4c146c
push 0x4c149c
mov byte [0x652212], 1
call esi
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReallocateArray_____memory_allocation_failed__n
push 0x4c14dc
jmp 0x459c21
pop edi
pop esi
pop ebx
ret
Function at 0x45d140
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
test eax, eax
jne 0x45d1b8
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push edi
push 0x4c2240
push 0x4c2270
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.vd_OpenFile_____I_O_file_could_not_be_opened__n
push 0x4c22b0
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
pop ebx
ret
Function at 0x45d3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4c1c60
push eax
mov dword [esp + 0x28], 0
call fcn.0045d140
lea ecx, [esp + 0x28]
mov esi, eax
push ecx
push esi
call fcn.0046d2d0
add esp, 0x10
test al, al
jne 0x45d461
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c1c64
push 0x4c1c8c
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPoly_____premature_end_of_file__n
push 0x4c1cc4
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x45d482
add eax, 0xa
push eax
call fcn.00452be0
mov edx, dword [esp + 0x24]
add edx, 0xa
push edx
call fcn.00452cb0
add esp, 8
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
push esi
call fcn.0046d360
add esp, 0x10
test al, al
jne 0x45d4e3
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c1cd4
push 0x4c1cfc
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadContour_____premature_end_of_file__n
push 0x4c1d34
jmp 0x45d446
mov eax, dword [0x4b95e8]
fld qword [esp + 0x30]
push eax
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.004530e0
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x48]
mov dword [esp + 0x40], eax
mov edi, eax
push edx
lea eax, [esp + 0x54]
push eax
push esi
call fcn.0046d360
add esp, 0x24
test al, al
je 0x45d55f
mov ecx, dword [esp + 0x24]
fld qword [esp + 0x30]
push ecx
sub esp, 0x10
fstp qword [esp + 8]
lea edx, [esp + 0x3c]
fld qword [esp + 0x4c]
fstp qword [esp]
push edx
call fcn.00453160
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x58]
push edx
push esi
call fcn.0046d360
add esp, 0x28
test al, al
jne 0x45d522
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push edi
push ecx
call fcn.004532c0
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [ebp + 0xc]
add esp, 0x10
cmp edi, 0xffffffff
pop edi
setne dl
pop esi
mov byte [eax], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d590
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x4c1d44
or edi, 0xffffffff
push eax
mov dword [esp + 0x30], edi
call fcn.0045d140
lea ecx, [esp + 0x30]
mov esi, eax
push ecx
push esi
call fcn.0046d2d0
add esp, 0x10
test al, al
jne 0x45d620
mov esi, dword [sym.imp.MSVCR100.dll___iob_func]
push 0x4c1d48
push 0x4c1d70
mov byte [0x652212], 1
call esi
mov edi, dword [sym.imp.MSVCR100.dll_fprintf]
add eax, 0x20
push eax
call edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_fflush]
add eax, 0x20
push eax
call ebx
add esp, 0x10
push str.ReadPoints_____premature_end_of_file__n
push 0x4c1da8
call esi
add eax, 0x40
push eax
call edi
call esi
add eax, 0x40
push eax
call ebx
add esp, 0x10
push 2
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [esp + 0x28]
test eax, eax
jle 0x45d634
add eax, 0xa
push eax
call fcn.00452be0
add esp, 4
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
call fcn.0046d330
add esp, 0x10
test al, al
je 0x45d68a
mov edx, dword [esp + 0x2c]
fld qword [esp + 0x30]
push edx
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x4c]
fstp qword [esp]
call fcn.004530e0
mov edi, eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
push esi
call fcn.0046d330
add esp, 0x24
test al, al
jne 0x45d650
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
mov ecx, dword [ebp + 0xc]
add esp, 4
cmp edi, 0xffffffff
pop edi
setne al
pop esi
mov byte [ecx], al
mov byte [0x4d30d8], 1
pop ebx
mov esp, ebp
pop ebp
ret