joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov byte [ebp - 1], 0
mov eax, dword [esi]
test eax, eax
je 0x401d33
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x401d4b
mov eax, dword [esi + 8]
test eax, eax
je 0x401d4b
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 0xc], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x401d6b
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x401d83
mov eax, dword [esi + 8]
test eax, eax
je 0x401d83
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 0xb], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x401da3
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x401dbb
mov eax, dword [esi + 8]
test eax, eax
je 0x401dbb
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 0xa], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x401ddb
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x401df3
mov eax, dword [esi + 8]
test eax, eax
je 0x401df3
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 9], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x401e13
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x401e2b
mov eax, dword [esi + 8]
test eax, eax
je 0x401e2b
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 8], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x401e4b
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x401e63
mov eax, dword [esi + 8]
test eax, eax
je 0x401e63
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 7], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x401e83
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x401e9b
mov eax, dword [esi + 8]
test eax, eax
je 0x401e9b
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov ecx, dword [esi]
mov byte [ebp - 6], al
xor al, al
mov byte [ebp - 1], al
test ecx, ecx
je 0x401ec8
push ecx
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
mov al, byte [ebp - 1]
mov byte [ebp - 5], al
fld qword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x401ee3
push ecx
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
mov al, byte [ebp - 1]
add esp, 0x10
mov byte [ebp - 5], al
fld qword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov byte [ebp - 1], 0
mov eax, dword [esi]
test eax, eax
je 0x401f13
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x401f2b
mov eax, dword [esi + 8]
test eax, eax
je 0x401f2b
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov ecx, dword [esi]
mov byte [ebp - 8], al
xor al, al
mov byte [ebp - 1], al
test ecx, ecx
je 0x401f59
push ecx
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
mov al, byte [ebp - 1]
mov byte [ebp - 7], al
mov ax, word [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x401f74
push ecx
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
mov al, byte [ebp - 1]
add esp, 0x10
mov byte [ebp - 7], al
mov ax, word [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov byte [ebp - 4], 0
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ecx]
test eax, eax
je 0x401fac
push eax
push 1
push 4
lea eax, [ebp - 4]
push eax
call fcn.004401d0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 8]
test eax, eax
je 0x401fc4
push eax
push 1
lea eax, [ebp - 4]
push 4
push eax
call fcn.0042c7fd
add esp, 0x10
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x401fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov byte [ebp - 1], 0
mov eax, dword [esi]
test eax, eax
je 0x401ff3
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x40200b
mov eax, dword [esi + 8]
test eax, eax
je 0x40200b
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 8], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x40202b
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x402043
mov eax, dword [esi + 8]
test eax, eax
je 0x402043
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 7], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x402063
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x40207b
mov eax, dword [esi + 8]
test eax, eax
je 0x40207b
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov ecx, dword [esi]
mov byte [ebp - 6], al
xor al, al
mov byte [ebp - 1], al
test ecx, ecx
je 0x4020a8
push ecx
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
mov al, byte [ebp - 1]
mov byte [ebp - 5], al
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4020c3
push ecx
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
mov al, byte [ebp - 1]
add esp, 0x10
mov byte [ebp - 5], al
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4020d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov byte [ebp - 1], 0
mov eax, dword [esi]
test eax, eax
je 0x4020f3
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x40210b
mov eax, dword [esi + 8]
test eax, eax
je 0x40210b
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 0xc], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x40212b
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x402143
mov eax, dword [esi + 8]
test eax, eax
je 0x402143
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 0xb], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x402163
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x40217b
mov eax, dword [esi + 8]
test eax, eax
je 0x40217b
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 0xa], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x40219b
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x4021b3
mov eax, dword [esi + 8]
test eax, eax
je 0x4021b3
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 9], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x4021d3
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x4021eb
mov eax, dword [esi + 8]
test eax, eax
je 0x4021eb
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 8], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x40220b
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x402223
mov eax, dword [esi + 8]
test eax, eax
je 0x402223
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 7], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x402243
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
jmp 0x40225b
mov eax, dword [esi + 8]
test eax, eax
je 0x40225b
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 6], al
mov eax, dword [esi]
mov byte [ebp - 1], 0
test eax, eax
je 0x40228a
push eax
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.004401d0
mov al, byte [ebp - 1]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
test eax, eax
je 0x4022a2
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movsd xmm0, qword [ebp + 8]
push esi
mov esi, ecx
movsd qword [ebp - 8], xmm0
mov al, byte [ebp - 8]
mov byte [ebp + 0xc], al
mov eax, dword [esi]
test eax, eax
je 0x40253f
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
jmp 0x402557
mov eax, dword [esi + 8]
test eax, eax
je 0x402557
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov al, byte [ebp - 7]
mov byte [ebp + 0xc], al
mov eax, dword [esi]
test eax, eax
je 0x402573
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
jmp 0x40258b
mov eax, dword [esi + 8]
test eax, eax
je 0x40258b
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov al, byte [ebp - 6]
mov byte [ebp + 0xc], al
mov eax, dword [esi]
test eax, eax
je 0x4025a7
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
jmp 0x4025bf
mov eax, dword [esi + 8]
test eax, eax
je 0x4025bf
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov al, byte [ebp - 5]
mov byte [ebp + 0xc], al
mov eax, dword [esi]
test eax, eax
je 0x4025db
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
jmp 0x4025f3
mov eax, dword [esi + 8]
test eax, eax
je 0x4025f3
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov al, byte [ebp - 4]
mov byte [ebp + 0xc], al
mov eax, dword [esi]
test eax, eax
je 0x40260f
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
jmp 0x402627
mov eax, dword [esi + 8]
test eax, eax
je 0x402627
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov al, byte [ebp - 3]
mov byte [ebp + 0xc], al
mov eax, dword [esi]
test eax, eax
je 0x402643
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
jmp 0x40265b
mov eax, dword [esi + 8]
test eax, eax
je 0x40265b
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov al, byte [ebp - 2]
mov byte [ebp + 0xc], al
mov eax, dword [esi]
test eax, eax
je 0x402677
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
jmp 0x40268f
mov eax, dword [esi + 8]
test eax, eax
je 0x40268f
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov al, byte [ebp - 1]
mov byte [ebp + 0xc], al
mov eax, dword [esi]
test eax, eax
je 0x4026b0
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 8]
test eax, eax
je 0x4026c8
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4026d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bx, word [ebp + 8]
push esi
mov esi, ecx
mov byte [ebp + 8], bl
mov eax, dword [esi]
test eax, eax
je 0x4026f4
push eax
push 1
push 1
lea eax, [ebp + 8]
push eax
call fcn.004408b0
jmp 0x40270c
mov eax, dword [esi + 8]
test eax, eax
je 0x40270c
push eax
push 1
lea eax, [ebp + 8]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [esi]
mov byte [ebp + 8], bh
test eax, eax
je 0x402729
push eax
push 1
push 1
lea eax, [ebp + 8]
push eax
call fcn.004408b0
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [esi + 8]
test eax, eax
je 0x402741
push eax
push 1
lea eax, [ebp + 8]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
pop esi
pop ebx
pop ebp
ret 4

Function at 0x402750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
test eax, eax
je 0x40276b
push eax
push 1
push 4
lea eax, [ebp + 8]
push eax
call fcn.004408b0
pop ebp
ret 4
mov eax, dword [ecx + 8]
test eax, eax
je 0x402783
push eax
push 1
lea eax, [ebp + 8]
push 4
push eax
call fcn.0042cf10
add esp, 0x10
pop ebp
ret 4

Function at 0x402790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [ebp - 4], bl
mov eax, dword [esi]
test eax, eax
je 0x4027b4
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x4027cc
mov eax, dword [esi + 8]
test eax, eax
je 0x4027cc
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [esi]
mov byte [ebp - 4], bh
test eax, eax
je 0x4027e5
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x4027fd
mov eax, dword [esi + 8]
test eax, eax
je 0x4027fd
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [ebp + 0xa]
mov byte [ebp - 4], al
mov eax, dword [esi]
test eax, eax
je 0x402819
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x402831
mov eax, dword [esi + 8]
test eax, eax
je 0x402831
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [ebp + 0xb]
mov byte [ebp + 8], al
mov eax, dword [esi]
test eax, eax
je 0x402853
push eax
push 1
push 1
lea eax, [ebp + 8]
push eax
call fcn.004408b0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
test eax, eax
je 0x40286b
push eax
push 1
lea eax, [ebp + 8]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [ebp - 4], al
mov eax, dword [esi]
test eax, eax
je 0x4028a3
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x4028bb
mov eax, dword [esi + 8]
test eax, eax
je 0x4028bb
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [ebp + 9]
mov byte [ebp - 4], al
mov eax, dword [esi]
test eax, eax
je 0x4028d7
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x4028ef
mov eax, dword [esi + 8]
test eax, eax
je 0x4028ef
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [ebp + 0xa]
mov byte [ebp - 4], al
mov eax, dword [esi]
test eax, eax
je 0x40290b
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x402923
mov eax, dword [esi + 8]
test eax, eax
je 0x402923
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [ebp + 0xb]
mov byte [ebp - 4], al
mov eax, dword [esi]
test eax, eax
je 0x40293f
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x402957
mov eax, dword [esi + 8]
test eax, eax
je 0x402957
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], al
mov eax, dword [esi]
test eax, eax
je 0x402973
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x40298b
mov eax, dword [esi + 8]
test eax, eax
je 0x40298b
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [ebp + 0xd]
mov byte [ebp - 4], al
mov eax, dword [esi]
test eax, eax
je 0x4029a7
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x4029bf
mov eax, dword [esi + 8]
test eax, eax
je 0x4029bf
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [ebp + 0xe]
mov byte [ebp - 4], al
mov eax, dword [esi]
test eax, eax
je 0x4029db
push eax
push 1
push 1
lea eax, [ebp - 4]
push eax
call fcn.004408b0
jmp 0x4029f3
mov eax, dword [esi + 8]
test eax, eax
je 0x4029f3
push eax
push 1
lea eax, [ebp - 4]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
mov eax, dword [ebp + 0xf]
mov byte [ebp + 0xc], al
mov eax, dword [esi]
test eax, eax
je 0x402a14
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 8]
test eax, eax
je 0x402a2c
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x402a80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
test eax, eax
je 0x402a9c
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004401d0
pop ebp
ret 0xc
mov eax, dword [ecx + 8]
test eax, eax
je 0x402ab9
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042c7fd
add esp, 0x10
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x402b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
test eax, eax
je 0x402b8c
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004408b0
pop ebp
ret 0xc
mov eax, dword [ecx + 8]
test eax, eax
je 0x402ba9
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042cf10
add esp, 0x10
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc

Function at 0x402bb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x463070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
push 0x104
lea eax, [esi + 0xc]
mov dword [esi + 4], 0
push eax
call fcn.0042abbe
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [esi + 0x110], eax
dec eax
je 0x402bf8
sub eax, 4
jne 0x402d46
push ebx
push 0x448568
push edi
call fcn.0042c509
mov ebx, eax
add esp, 8
mov dword [esi + 8], ebx
test ebx, ebx
je 0x402d3f
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call fcn.0042bfd0
push ebx
push 1
lea eax, [ebp - 0x10]
push 0xa
push eax
call fcn.0042c7fd
add esp, 0x1c
cmp byte [ebp - 0x10], 0x1f
jne 0x402d2d
cmp byte [ebp - 0xf], 0x8b
jne 0x402d2d
cmp byte [ebp - 0xe], 8
jne 0x402d2d
mov al, byte [ebp - 0xd]
test al, 2
je 0x402c76
push 1
push 2
push dword [esi + 8]
call fcn.0042c938
mov al, byte [ebp - 0xd]
add esp, 0xc
test al, 4
je 0x402ca8
push dword [esi + 8]
lea eax, [ebp - 0xc]
push 1
push 2
push eax
call fcn.0042c7fd
movzx ecx, byte [ebp - 0xb]
movzx eax, byte [ebp - 0xc]
shl ecx, 8
push 1
or ecx, eax
push ecx
push dword [esi + 8]
call fcn.0042c938
mov al, byte [ebp - 0xd]
add esp, 0x1c
test al, 8
je 0x402cec
push dword [esi + 8]
lea eax, [ebp - 0x114]
push 1
push 0x104
push eax
call fcn.0042c7fd
add esp, 0x10
lea eax, [ebp - 0x114]
lea ebx, [esi + 0xc]
push eax
push ebx
call fcn.00401360
add esp, 4
push eax
push str._s_s
push 0x104
push ebx
call fcn.0042b12c
add esp, 0x14
push 2
push 0xfffffffffffffffc
push dword [esi + 8]
call fcn.0042c938
push dword [esi + 8]
lea eax, [ebp - 0x10]
push 1
push 4
push eax
call fcn.0042c7fd
movzx ecx, byte [ebp - 0xd]
add esp, 0x1c
movzx eax, byte [ebp - 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 0x10]
shl ecx, 8
or ecx, eax
mov dword [esi + 4], ecx
push dword [esi + 8]
call fcn.0042c196
add esp, 4
mov dword [esi + 8], 0
cmp dword [esi + 4], 0
pop ebx
je case.0x402d4f.3
mov eax, dword [ebp + 0xc]
dec eax
cmp eax, 5
ja case.0x402d4f.3
jmp dword [eax*4 + 0x402db0]
push 0x448568
push edi
call fcn.00401590
add esp, 4
push eax
call fcn.00440f70
xor ecx, ecx
mov dword [esi], eax
test eax, eax
pop edi
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b2a2
mov esp, ebp
pop ebp
ret 8
push 0x44856c
jmp 0x402d5b
push 0x448578
jmp 0x402d5b
push 0x44857c
jmp 0x402d5b
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0042b2a2
mov esp, ebp
pop ebp
ret 8
Function at 0x402dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402de5
xor al, al
pop ebp
ret
shr eax, 4
not eax
and eax, 1
pop ebp
ret

Function at 0x402e10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
imul ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
je 0x402ebf
lea esp, [esp]
cmp dword [edi + 0x110], 1
jne 0x402e7f
mov eax, dword [edi]
mov byte [ebp + 0xf], 0
test eax, eax
je 0x402e5c
push eax
push 1
push 1
lea eax, [ebp + 0xf]
push eax
call fcn.004401d0
mov ecx, dword [ebp + 8]
mov al, byte [ebp + 0xf]
mov byte [esi + ecx], al
jmp 0x402eb6
mov eax, dword [edi + 8]
test eax, eax
je 0x402e74
push eax
push 1
lea eax, [ebp + 0xf]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov ecx, dword [ebp + 8]
mov al, byte [ebp + 0xf]
mov byte [esi + ecx], al
jmp 0x402eb6
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
mov byte [ebp + 0xc], al
mov eax, dword [edi]
test eax, eax
je 0x402e9e
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
jmp 0x402eb6
mov eax, dword [edi + 8]
test eax, eax
je 0x402eb6
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
inc esi
cmp esi, ebx
jb 0x402e30
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x402f20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
imul ebx, dword [ebp + 0x10]
push esi
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
je 0x402fcf
lea esp, [esp]
cmp dword [edi + 0x110], 1
jne 0x402f8f
mov eax, dword [edi]
mov byte [ebp + 0xf], 0
test eax, eax
je 0x402f63
push eax
push 1
push 1
lea eax, [ebp + 0xf]
push eax
call fcn.004401d0
jmp 0x402f7b
mov eax, dword [edi + 8]
test eax, eax
je 0x402f7b
push eax
push 1
lea eax, [ebp + 0xf]
push 1
push eax
call fcn.0042c7fd
add esp, 0x10
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, byte [ebp + 0xf]
je 0x402fc6
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
mov byte [ebp + 0xc], al
mov eax, dword [edi]
test eax, eax
je 0x402fae
push eax
push 1
push 1
lea eax, [ebp + 0xc]
push eax
call fcn.004408b0
jmp 0x402fc6
mov eax, dword [edi + 8]
test eax, eax
je 0x402fc6
push eax
push 1
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0042cf10
add esp, 0x10
inc esi
cmp esi, ebx
jb 0x402f40
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc

Function at 0x403010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x110], 1
jne 0x40302b
call fcn.00401ef0
mov ecx, dword [ebp + 8]
mov word [ecx], ax
pop ebp
ret 4
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004026d0