joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53eff0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5f3008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x410], eax
mov eax, dword [0x616724]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x414], eax
mov eax, dword [0x616928]
push 0
mov dword [edi], 0
lea esi, [eax + 4]
push esi
push 0xffffffffffffffff
push str.SELECT_path_FROM_bkDescTable_WHERE_path___
push dword [eax]
call dword [sym.imp.sqlite3.dll_sqlite3_prepare16]
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x53f0a5
push 0x3e8
call fcn.00560858
add esp, 4
mov esi, eax
push ebx
push 0x13c5
push str.SQLite3_prepare_error
push str._s_Place_d_LastCode_d
push 0x3e8
push esi
call fcn.00407340
add esp, 0x18
push 0x30
push 0x5aa224
push esi
push dword [ebp - 0x410]
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00560853
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x414]
add eax, 0x1800
push eax
lea eax, [ebp - 0x40c]
push 0x200
push eax
call fcn.00565fee
add esp, 0xc
lea ecx, [ebp - 0x40c]
call fcn.0040d890
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x53f128
lea eax, [ebp - 0x40c]
push eax
call ebx
dec eax
cmp word [ebp + eax*2 - 0x40c], 0x2f
lea ecx, [eax - 1]
cmovne ecx, eax
test ecx, ecx
js 0x53f128
nop dword [eax + eax]
movzx eax, word [ebp + ecx*2 - 0x40c]
cmp eax, 0x2f
je 0x53f128
cmp eax, 0x2e
je 0x53f128
cmp eax, 0x23
je 0x53f11e
sub ecx, 1
jns 0x53f100
jmp 0x53f128
xor eax, eax
mov word [ebp + ecx*2 - 0x40c], ax
push 0
lea eax, [ebp - 0x40c]
push eax
call ebx
add eax, eax
push eax
lea eax, [ebp - 0x40c]
push eax
push 1
push dword [esi]
call dword [sym.imp.sqlite3.dll_sqlite3_bind_text16]
add esp, 0x14
test eax, eax
jne 0x53f188
mov eax, dword [esi]
test eax, eax
je 0x53f188
push eax
call dword [sym.imp.sqlite3.dll_sqlite3_column_count]
mov ebx, dword [sym.imp.sqlite3.dll_sqlite3_step]
add esp, 4
push dword [esi]
call ebx
add esp, 4
cmp eax, 0x64
jne 0x53f188
push 0
push dword [esi]
call dword [sym.imp.sqlite3.dll_sqlite3_column_text16]
inc dword [edi]
push dword [esi]
call ebx
add esp, 0xc
cmp eax, 0x64
je 0x53f170
push dword [esi]
call dword [sym.imp.sqlite3.dll_sqlite3_finalize]
mov edi, eax
add esp, 4
test edi, edi
je 0x53f1f8
push 0x3e8
call fcn.00560858
add esp, 4
mov esi, eax
push edi
push 0x13c6
push str.SQLite3_finalize_error
push str._s_Place_d_LastCode_d
push 0x3e8
push esi
call fcn.00407340
add esp, 0x18
push 0x30
push 0x5aa224
push esi
push dword [ebp - 0x410]
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00560853
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0056060a
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056060a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x55f730
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x55f73b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0055f750
Function at 0x5775d5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057744b
Function at 0x406320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
test esi, esi
je 0x4064fd
cmp dword [esi + 0x20], 0
je 0x4064fd
cmp dword [esi + 0x24], 0
je 0x4064fd
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4064fd
cmp dword [eax], esi
jne 0x4064fd
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x406384
cmp eax, 0x39
je 0x406384
cmp eax, 0x45
je 0x406384
cmp eax, 0x49
je 0x406384
cmp eax, 0x5b
je 0x406384
cmp eax, 0x67
je 0x406384
cmp eax, 0x71
je 0x406384
cmp eax, 0x29a
jne 0x4064fd
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x4063bd
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
jne 0x4063cd
mov dword [edi + 4], 0x39
xor eax, eax
jmp 0x4063ed
test ecx, ecx
mov edx, 0x2a
mov eax, 0x71
cmovne eax, edx
xor edx, edx
push 0
xor ecx, ecx
mov dword [edi + 4], eax
call fcn.004051d0
add esp, 4
mov dword [esi + 0x30], eax
mov ecx, edi
lea eax, [edi + 0x94]
mov dword [edi + 0x28], 0
mov dword [edi + 0xb18], eax
lea eax, [edi + 0x988]
mov dword [edi + 0xb24], eax
lea eax, [edi + 0xa7c]
mov dword [edi + 0xb30], eax
xor eax, eax
mov dword [edi + 0xb20], 0x58814c
mov dword [edi + 0xb2c], 0x588670
mov dword [edi + 0xb38], 0x588160
mov word [edi + 0x16b8], ax
mov dword [edi + 0x16bc], eax
call fcn.00408a30
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.004fbc30
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x587baa]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x587ba8]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x587bac]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x587bae]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x40e430
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5250ed
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x593a34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x130], 0
push 0xffffffffffffffff
push 0x52ac18
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.0040ec90
mov dword [ebp - 0x138], eax
xor esi, esi
inc esi
lea edi, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae edi, dword [ebp + 8]
mov dword [ebp - 0x134], edi
cmp esi, dword [ebp + 0x18]
jae 0x40e508
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004fbc30
add esp, 0xc
lea ecx, [ebp - 0x128]
lea esi, [edi + esi*2]
push 0x52ac1c
push 0x52ac18
call fcn.0040e190
test al, al
mov eax, dword [ebp + 0x18]
jne 0x40e623
lea edi, [edi + eax*2]
cmp esi, edi
jae 0x40e508
nop dword [eax]
movzx edx, word [esi]
mov ecx, 2
mov eax, 0x52ac18
nop dword [eax]
cmp word [eax], dx
je 0x40e616
add eax, 2
sub ecx, 1
jne 0x40e4f0
add esi, 2
cmp esi, edi
jb 0x40e4e0
or esi, 0xffffffff
cmp dword [ebp + 0x18], esi
lea eax, [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x18], 0
cmovb ecx, dword [ebp + 0x18]
xorps xmm0, xmm0
cmp dword [ebp + 0x1c], 8
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.0040bdb0
mov edi, dword [ebp - 0x130]
lea eax, [ebp - 0x28]
or edi, 3
cmp dword [ebp - 0x14], 8
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40e573
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 0x129], 1
cmp eax, 0xb7
jne 0x40e57a
mov byte [ebp - 0x129], 0
mov ecx, dword [ebp - 0x14]
and edi, 0xfffffffe
mov dword [ebp - 0x130], edi
cmp ecx, 8
jb 0x40e5bd
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e5b3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e68e
push ecx
push edx
call fcn.004f9acf
add esp, 8
cmp byte [ebp - 0x129], 0
je 0x40e5d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40e65a
cmp esi, dword [ebp - 0x138]
jb 0x40e485
mov byte [ebp - 0x129], 1
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x40e66d
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e663
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e68e
jmp 0x40e663
sub esi, dword [ebp - 0x134]
sar esi, 1
jmp 0x40e50b
lea ecx, [edi + eax*2]
cmp esi, ecx
jae 0x40e508
mov edx, 0x100
movzx eax, word [esi]
cmp ax, dx
jae 0x40e645
cmp byte [ebp + eax - 0x128], 0
jne 0x40e651
add esi, 2
cmp esi, ecx
jb 0x40e633
jmp 0x40e508
sub esi, edi
sar esi, 1
jmp 0x40e50b
mov byte [ebp - 0x129], 0
jmp 0x40e5e8
push ecx
push edx
call fcn.004f9acf
add esp, 8
mov al, byte [ebp - 0x129]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a6e
mov esp, ebp
pop ebp
ret
call fcn.004ff4bf
int3
Function at 0x40e900
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.004fbc30
add esp, 0xc
mov dword [ebp - 0x30], 0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov dword [ebp - 0x34], 0
cmovae eax, dword [ebp + 8]
cmp dword [ebp + 0x34], 8
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x20], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp + 0x1c]
test eax, eax
setne bl
cmp ecx, 8
jb 0x40e994
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e98a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e9e5
push ecx
push edx
call fcn.004f9acf
add esp, 8
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp ecx, 8
jb 0x40e9de
mov edx, dword [ebp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40e9d4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e9e5
push ecx
push edx
call fcn.004f9acf
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004ff4bf
int3
Function at 0x40e9f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525135
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push esi
push edi
mov eax, dword [0x593a34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push 0x52ac20
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0
call fcn.0040bdb0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov edi, dword [ebp + 0x18]
xorps xmm0, xmm0
cmovae eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], eax
movups xmmword [ebp - 0x2c], xmm0
cmp edi, 0x7ffffffe
ja 0x40ec0f
mov dword [ebp - 0x18], 7
cmp edi, 8
jae 0x40ea8e
push 0x10
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
push eax
call fcn.004fb4c0
jmp 0x40ead2
mov esi, edi
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x40eaa2
mov esi, bind
jmp 0x40eaac
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ac70
lea ecx, [edi*2 + 2]
mov dword [ebp - 0x2c], eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], edi
push eax
mov dword [ebp - 0x18], esi
call fcn.004fb4c0
add esp, 0xc
mov dword [ebp - 0x80], 0x3c
lea eax, [ebp - 0x7c]
push 0x38
push 0
push eax
call fcn.004fbc30
add esp, 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x78], 0
cmovae eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x64], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 0x18]
test eax, eax
setne byte [ebp - 0xd]
cmp ecx, 8
jb 0x40eb67
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40eb5d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec14
push ecx
push edx
call fcn.004f9acf
add esp, 8
mov ecx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
cmp ecx, 8
jb 0x40ebb1
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40eba7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec14
push ecx
push edx
call fcn.004f9acf
add esp, 8
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp ecx, 8
jb 0x40ebfb
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ebf1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec19
push ecx
push edx
call fcn.004f9acf
add esp, 8
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0040ac00
call fcn.004ff4bf
call fcn.004ff4bf
int3
Function at 0x40ec20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ebx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ec43
test al, 0x10
jne 0x40ec43
mov bl, 1
jmp 0x40ec45
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x40ec7b
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ec71
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ec80
push ecx
push edx
call fcn.004f9acf
add esp, 8
mov al, bl
pop ebx
pop ebp
ret
call fcn.004ff4bf
int3
Function at 0x4143c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5257fd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x593a34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x13c]
xorps xmm0, xmm0
mov dword [esi + 0x260], 0
mov dword [esi + 0x264], 0
movsd qword [esi + 0x258], xmm0
mov dword [esi + 0x254], 0
mov byte [eax + 0x17], 1
cmp byte [esi + 0x188], 0
je 0x414433
push dword [esi + 8]
mov ecx, dword [esi + 0x13c]
call fcn.0040a6e0
mov eax, dword [esi + 0x138]
mov byte [eax + 0x17], 1
push dword [esi + 8]
mov ecx, dword [esi + 0x138]
call fcn.0040a6e0
mov ecx, dword [esi + 0x248]
mov al, byte [ebp + 8]
mov byte [ecx + 0x94], al
cmp dword [esi + 0x250], 0
je 0x41449e
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [esi + 0x250], eax
je 0x414523
push 0
push dword [esi + 0x250]
push dword [esi + 0x24c]
call fcn.004f8db3
add esp, 0xc
test eax, eax
jne 0x41452a
mov dword [esi + 0x24c], eax
mov dword [esi + 0x250], eax
push 8
call fcn.004f9a9f
add esp, 4
test eax, eax
je 0x4144bd
mov ecx, dword [esi + 0x248]
mov dword [eax], ecx
mov dword [eax + 4], 0x424400
jmp 0x4144bf
xor eax, eax
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x410b40
push 0
push 0
call fcn.00506294
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x414515
cmp dword [esi + 0x250], 0
jne 0x414531
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x24c], ecx
mov dword [esi + 0x250], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [ebp - 0x10], 0
call fcn.004f8f64
push 5
call fcn.004f8f64
push 2
call fcn.004f8f64
call fcn.005060fc
int3
Function at 0x415f10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52591d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x593a34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004f9a9f
mov edi, eax
add esp, 4
test edi, edi
je 0x415fad
push 1
mov dword [ebp - 4], 0
call fcn.004f87d5
add esp, 4
mov dword [edi + 4], eax
jmp 0x415faf
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.00410fd0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx ebx, ax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x416009
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x416009
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov word [esi + 0x40], bx
jne 0x416026
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x416049
cmp byte [ebp + 0xc], 0
je 0x416035
push esi
call fcn.004f8c6d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x416055
mov esi, str.ios_base::badbit_set
jmp 0x416065
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.0040f720
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.0040d1d0
push 0x58ac70
lea eax, [ebp - 0x28]
push eax
call fcn.004fb445
int3
Function at 0x41c670
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526064
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x593a34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
lea ecx, [edx + 0x18]
mov dword [ebp - 0x4c], edx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
movups xmmword [edx + 0x30], xmm0
xor esi, esi
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], 7
mov dword [ebp - 4], eax
mov word [edx + 0x30], si
movups xmmword [edx + 0x48], xmm0
mov dword [edx + 0x58], esi
mov dword [edx + 0x5c], 7
mov word [edx + 0x48], si
lea esi, [edx + 0x60]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edi, [edx + 0x7c]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
push eax
push 0x52ac20
mov byte [ebp - 4], 4
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
call fcn.004142a0
push 0
push 0x52ac20
mov ecx, esi
call fcn.004142a0
mov esi, dword [ebp - 0x44]
push 0xf
push 0x52adcc
lea ecx, [esi + 0x30]
call fcn.004142a0
push 0
push 0x52ac20
lea ecx, [esi + 0x48]
call fcn.004142a0
push 0
push 0x52ac20
mov ecx, edi
mov dword [esi + 0x98], 0
mov word [esi + 0x78], 0
call fcn.004142a0
lea eax, [ebp - 0x40]
mov byte [esi + 0x94], 0
push eax
call fcn.0040efe0
push str._old_metin2.bak
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
call fcn.0041a820
mov ecx, dword [ebp - 0x2c]
add esp, 0x10
cmp ecx, 8
jb 0x41c7d9
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41c7cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41c840
push ecx
push edx
call fcn.004f9acf
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00506658
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 8
jb 0x41c823
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41c819
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41c845
push ecx
push edx
call fcn.004f9acf
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f9a6e
mov esp, ebp
pop ebp
ret
call fcn.004ff4bf
call fcn.004ff4bf
int3
Function at 0x422e70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52591d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x593a34]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004f9a9f
mov edi, eax
add esp, 4
test edi, edi
je 0x422f0d
push 1
mov dword [ebp - 4], 0
call fcn.004f87d5
add esp, 4
mov dword [edi + 4], eax
jmp 0x422f0f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.0040c9b0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x422f6a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x422f6a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x422f86
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x422fa9
cmp byte [ebp + 0xc], 0
je 0x422f95
push esi
call fcn.004f8c6d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x422fb5
mov esi, str.ios_base::badbit_set
jmp 0x422fc5
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.0040f720
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.0040d1d0
push 0x58ac70
lea eax, [ebp - 0x28]
push eax
call fcn.004fb445
int3