joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cab0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 0
mov ecx, dword [0x659a18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
push edx
push 1
push 0x2c
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi]
add esp, 0x1c
test ah, 0x20
je 0x43cb3e
test eax, 0x1000000
je 0x43cb0f
push 0x298
call fcn.00470250
add esp, 4
test eax, eax
je 0x43cb33
mov ecx, dword [esi + 0x24]
push ecx
mov ecx, eax
call fcn.004baf10
mov dword [esi + 0x24], eax
mov eax, esi
pop esi
ret 4
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x43cb33
mov edx, dword [esi + 0x24]
push 0
push edx
mov ecx, eax
call fcn.004bac90
mov dword [esi + 0x24], eax
mov eax, esi
pop esi
ret 4
xor eax, eax
mov dword [esi + 0x24], eax
mov eax, esi
pop esi
ret 4
mov dword [esi + 0x24], 0
mov eax, esi
pop esi
ret 4

Function at 0x43cbc0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
mov ecx, dword [0x659a18]
xor edi, edi
push edi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
push edx
push 1
push 0x58
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi]
mov dword [esi + 0x54], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov eax, dword [0x659a74]
add esp, 0x1c
test eax, ecx
je 0x43cccb
cmp dword [esi + 0x28], edi
je 0x43cc58
push 0x58
call fcn.00470250
add esp, 4
cmp eax, edi
je 0x43cc26
mov ecx, dword [esi + 0x28]
push ecx
mov ecx, eax
call fcn.0043cbc0
jmp 0x43cc28
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x54], edi
test byte [eax], 1
je 0x43cc58
push 0x24
call fcn.00470250
add esp, 4
cmp eax, edi
je 0x43cc53
mov edx, dword [esi + 0x28]
push 1
add edx, 0x10
mov ecx, eax
push edx
call fcn.00489020
jmp 0x43cc55
xor eax, eax
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov ecx, dword [0x659a80]
test eax, ecx
je 0x43ccce
test dword [0x659a84], eax
je 0x43cc8e
push 0x24
call fcn.00470250
add esp, 4
cmp eax, edi
je 0x43cc89
lea ecx, [esi + 0x2c]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x43cc8b
xor eax, eax
mov dword [esi + 0x4c], eax
mov edx, dword [0x659a88]
mov eax, dword [esi]
test edx, eax
je 0x43ccce
push 0x24
call fcn.00470250
add esp, 4
cmp eax, edi
je 0x43ccbf
lea ecx, [esi + 0x3c]
push 1
push ecx
mov ecx, eax
call fcn.00489020
mov dword [esi + 0x50], eax
mov eax, esi
pop edi
pop esi
ret 4
xor eax, eax
pop edi
mov dword [esi + 0x50], eax
mov eax, esi
pop esi
ret 4
mov dword [esi + 0x28], edi
mov eax, esi
pop edi
pop esi
ret 4

Function at 0x43d030
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push edi
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 4]
push eax
push 1
push 4
push ecx
call edi
mov edx, dword [0x659a18]
mov eax, dword [esi]
push edx
push eax
add esi, 8
push 0x10
push esi
call edi
add esp, 0x3c
pop edi
pop esi
ret 4
Function at 0x43dc20
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x530138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.0043d090
xor edi, edi
xor eax, eax
mov di, word [esi + 0x1d0]
mov dword [esp + 0x14], eax
mov dword [esi + 0x1e4], eax
mov dword [esi], 0x534e34
lea ecx, [edi*4]
push ecx
call fcn.00470b90
mov dword [esi + 0x1e4], eax
mov edx, dword [0x659a18]
push edx
push edi
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 0x1e4]
add esp, 0x14
mov ecx, dword [eax]
mov dword [esi + 0xbc], ecx
mov ecx, esi
call fcn.0043a330
mov ecx, eax
call fcn.004b53f0
push eax
mov ecx, esi
call fcn.0043a330
mov ecx, eax
call fcn.004b5570
mov edx, dword [esi + 8]
mov ecx, dword [esp + 0xc]
and dh, 0xfd
mov eax, esi
or dh, 1
pop edi
mov dword [esi + 8], edx
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x43ded0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x530178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0043dc20
xor edi, edi
mov dword [esi], 0x534f24
mov dword [esi + 0x1ec], edi
mov ecx, dword [0x659a18]
push ecx
mov dword [esp + 0x28], edi
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, esi
push eax
call fcn.0043b300
lea ebp, [esi + 0x1e8]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
xor edx, edx
lea ecx, [esp + 0x14]
mov dword [ebp], edi
mov eax, dword [0x659a18]
mov dword [esp + 0x15], edx
push eax
push 4
mov word [esp + 0x21], dx
push 1
push ecx
mov byte [esp + 0x24], 0
mov byte [esp + 0x2b], dl
call ebx
add esp, 0x10
mov edi, str.wflg
lea eax, [esp + 0x14]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x43df8a
test cl, cl
je 0x43df86
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x43df8a
add eax, 2
add edi, 2
test cl, cl
jne 0x43df66
xor eax, eax
jmp 0x43df8f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43dfa3
mov eax, dword [0x659a18]
push eax
push 1
push 4
push ebp
call ebx
add esp, 0x10
mov eax, dword [ebp]
mov ecx, dword [0x659a58]
test eax, ecx
je 0x43e022
and eax, dword [0x659a54]
neg eax
sbb eax, eax
xor ebp, ebp
mov bp, word [esi + 0x1d0]
neg eax
sub ebp, eax
lea ecx, [ebp*4]
push ecx
call fcn.00470b90
add esp, 4
xor edi, edi
test ebp, ebp
mov dword [esi + 0x1ec], eax
jle 0x43e022
push 0xc
call fcn.00470250
add esp, 4
test eax, eax
je 0x43dffa
mov ecx, eax
call fcn.00479c30
jmp 0x43dffc
xor eax, eax
mov edx, dword [esi + 0x1ec]
mov dword [edx + edi*4], eax
mov eax, dword [esi + 0x1e4]
mov edx, dword [esi + 0x1ec]
mov ecx, dword [eax + edi*4]
push ecx
mov ecx, dword [edx + edi*4]
call fcn.00479c90
inc edi
cmp edi, ebp
jl 0x43dfe3
lea ecx, [esi + 0x1f0]
xor eax, eax
pop edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x43ea00
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5301f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0043dc20
lea ebx, [esi + 0x1e8]
xor ebp, ebp
mov dword [esi + 0x1ec], ebp
push 0x24
mov dword [ebx], ebp
mov dword [esi + 0x1f4], ebp
mov dword [esi + 0x1f8], ebp
mov dword [esp + 0x20], ebp
mov dword [esi], 0x535104
call fcn.00470250
mov edi, eax
add esp, 4
cmp edi, ebp
mov ebp, dword [sym.imp.MSVCRT.dll_ftell]
je 0x43ea7e
mov ecx, dword [0x659a18]
push 1
push ecx
call ebp
add esp, 4
mov ecx, edi
push eax
call fcn.00488fd0
jmp 0x43ea80
xor eax, eax
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0xcc], eax
mov edx, dword [0x659a18]
push edx
push 1
push 2
push ebx
call edi
mov eax, dword [0x659a18]
push eax
call ebp
add esp, 0x14
mov ecx, esi
push eax
call fcn.0043aef0
mov ecx, dword [0x659a18]
push ecx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0043b340
cmp dword [0x659958], 0x1a
jl 0x43eae1
mov edx, dword [0x659a18]
lea eax, [esi + 0x1ec]
push edx
push 1
push 4
push eax
call edi
add esp, 0x10
mov edi, dword [esi + 0xcc]
mov ecx, edi
call fcn.004b53f0
push eax
mov ecx, edi
call fcn.004b5570
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xe9
jl 0x43eb1c
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xea
jle 0x43eb59
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x102
je 0x43eb59
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x115
je 0x43eb59
push 1
push 0x2392
call fcn.00487160
mov ecx, eax
call fcn.00483920
test eax, eax
je 0x43eb62
mov eax, dword [esi + 8]
or ah, 8
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x43ee60
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x530218
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0043d090
mov cx, word [esi + 0x10]
mov dx, word [esi + 0x12]
mov word [esp + 0x34], cx
mov word [esp + 0x36], dx
mov ecx, dword [esp + 0x34]
xor eax, eax
mov dword [esi + 0x210], ecx
or ecx, 0xffffffff
lea edi, [esi + 0x21c]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov word [esi + 0x216], ax
mov word [esi + 0x214], ax
mov word [esi + 0x21a], cx
mov word [esi + 0x218], cx
mov dword [edi], eax
mov dword [esi], 0x5351f4
mov edx, dword [0x659a18]
mov dword [esp + 0x2c], eax
push edx
push 1
lea eax, [esi + 0x1e4]
push 0x14
push eax
call ebp
mov ecx, dword [0x659a18]
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x14
mov ebx, eax
mov ecx, esi
push ebx
call fcn.0043b300
cmp dword [0x659958], 0x19
jl 0x43ef79
mov edx, dword [0x659a18]
add ebx, 8
push 0
push ebx
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [0x659a18]
push eax
push 1
push 4
push edi
call ebp
mov ecx, dword [0x659a18]
lea edx, [esp + 0x30]
push ecx
push 1
push 0x10
push edx
call ebp
mov al, byte [edi]
add esp, 0x2c
test al, 1
je 0x43ef79
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x43ef71
lea ecx, [esp + 0x14]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x43ef73
xor eax, eax
mov dword [esi + 0x104], eax
cmp dword [0x659958], 0x1a
jl 0x43ef99
mov edx, dword [0x659a18]
lea eax, [esi + 0x1f8]
push edx
push 1
push 0x10
push eax
call ebp
add esp, 0x10
mov ecx, dword [esi + 0x10]
or eax, 0xffffffff
mov edx, dword [esi + 0x14]
mov dword [esi + 0x208], eax
mov dword [esi + 0x20c], eax
mov eax, dword [esi + 8]
and ah, 0xfd
mov dword [esi + 0x214], ecx
mov ecx, dword [esp + 0x24]
or ah, 1
mov dword [esi + 8], eax
mov dword [esi + 0x218], edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x43f7a0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x530238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0043d090
lea edi, [esi + 0x1e4]
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 0x1e8], ebx
mov dword [edi], ebx
mov word [esi + 0x1f6], bx
mov word [esi + 0x1f4], bx
mov word [esi + 0x1fa], ax
mov word [esi + 0x1f8], ax
mov dword [esi], 0x5352e0
mov ecx, dword [0x659a18]
mov dword [esp + 0x24], ebx
push ecx
push 1
push 2
push edi
call dword [sym.imp.MSVCRT.dll_fread]
mov ebp, dword [edi]
lea edx, [ebp*4]
push edx
call fcn.00470280
add esp, 0x14
cmp eax, ebx
je 0x43f846
lea edx, [ebp - 1]
mov ecx, eax
cmp edx, ebx
jl 0x43f848
inc edx
mov word [ecx], bx
mov word [ecx + 2], bx
add ecx, 4
dec edx
jne 0x43f837
jmp 0x43f848
xor eax, eax
mov edx, dword [edi]
mov dword [esi + 0x1e8], eax
mov ecx, dword [0x659a18]
push ecx
push edx
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x14
mov ecx, esi
push eax
call fcn.0043b300
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x1e8]
mov edx, dword [esi + 0x10]
mov dword [esi + 0x1ec], ebx
mov dword [esi + 0x1f0], ebx
mov dword [esp + 0x18], ecx
movsx ecx, word [eax]
movsx eax, word [eax + 2]
mov edi, ecx
mov dword [esp + 0x14], edx
sub edi, edx
mov edx, eax
add word [esp + 0x18], di
mov ebp, dword [esp + 0x16]
sub edx, ebp
mov word [esp + 0x14], cx
add word [esp + 0x1a], dx
mov ecx, dword [esp + 0x18]
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
movsx edx, word [esi + 0x16]
movsx eax, word [esi + 0x12]
movsx ecx, word [esi + 0x14]
sub edx, eax
inc edx
push edx
movsx edx, word [esi + 0x10]
sub ecx, edx
inc ecx
push ecx
push ebx
push ebx
lea ecx, [esp + 0x24]
call fcn.004b4a60
mov ecx, dword [eax]
pop edi
mov dword [esi + 0x34], ecx
mov ecx, dword [esi + 0x14]
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x10]
mov dword [esi + 0x38], edx
mov edx, dword [esi + 8]
and dh, 0xfd
mov dword [esi + 0x1f4], eax
or dh, 1
mov dword [esi + 0x1f8], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], edx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x441af0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5302f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.00439c20
xor eax, eax
lea edx, [esi + 0x1d0]
mov dword [esi + 0x1e4], eax
mov dword [esi], 0x535564
mov ecx, dword [0x659a18]
mov dword [esp + 0x10], eax
push ecx
push 1
push 0x1c
push edx
call dword [sym.imp.MSVCRT.dll_fread]
lea ecx, [esi + 0x1f0]
xor eax, eax
add esp, 0x10
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov ecx, esi
call fcn.0043a330
mov ecx, eax
call fcn.004b53f0
push eax
mov ecx, esi
call fcn.0043a330
mov ecx, eax
call fcn.004b5570
mov edx, dword [esi + 8]
mov ecx, dword [esp + 8]
and dh, 0xfd
mov dword [esi + 0xb8], 1
or dh, 1
mov eax, esi
mov dword [esi + 8], edx
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x441dc0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
push eax
call fcn.00439c20
lea eax, [esi + 0x1d0]
mov dword [eax], 0
mov dword [esi], 0x53564c
mov ecx, dword [0x659a18]
push ecx
push 1
push 8
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, 0x20
xor eax, eax
lea edi, [esi + 0x1d8]
add esp, 0x10
rep stosd dword es:[edi], eax
mov edx, dword [esi + 8]
mov dword [esi + 0xb8], 1
and dh, 0xfd
mov eax, esi
or dh, 1
pop edi
mov dword [esi + 8], edx
pop esi
ret 4
Function at 0x445960
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5303e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [esp + 0x40]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.00439c20
lea ebp, [esi + 0x1d0]
xor ebx, ebx
lea ecx, [esi + 0x200]
mov dword [esp + 0x48], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x2c], ebx
call fcn.004a81e0
lea edi, [esi + 0x218]
mov ecx, 8
xor eax, eax
mov byte [esp + 0x48], 1
mov dword [edi + 0x10], ebx
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x244]
mov dword [esi + 0x238], ebx
call fcn.0047df80
mov dword [esi], 0x5359d8
mov ecx, dword [0x659a18]
push ecx
push 1
push 0x30
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [0x659958]
add esp, 0x10
cmp eax, 6
jge 0x445a0b
mov edx, dword [esi + 0x1e0]
mov dword [esi + 0x1fc], edx
cmp dword [0x659958], 0x13
jl 0x445b8d
mov eax, dword [0x659a18]
mov ebp, dword [sym.imp.MSVCRT.dll_ftell]
push eax
call ebp
mov edi, eax
mov al, byte [esi + 0x1d1]
add esp, 4
test al, 1
je 0x445a57
push 0x24
call fcn.00470250
add esp, 4
cmp eax, ebx
je 0x445a4f
push 1
push edi
mov ecx, eax
call fcn.00488fd0
jmp 0x445a51
xor eax, eax
mov dword [esi + 0x10c], eax
test byte [esi + 0x1d1], 2
je 0x445a85
push 0x24
call fcn.00470250
add esp, 4
cmp eax, ebx
je 0x445a7d
lea ecx, [edi + 0x10]
push 1
push ecx
mov ecx, eax
call fcn.00488fd0
jmp 0x445a7f
xor eax, eax
mov dword [esi + 0x104], eax
add edi, 0x20
mov ecx, esi
push edi
call fcn.0043b300
cmp dword [0x659958], 0x1a
jl 0x445b8d
xor edx, edx
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], edx
lea eax, [esi + 0x218]
push 0x20
mov dword [esp + 0x20], edx
push eax
mov eax, dword [0x659a18]
mov dword [esp + 0x28], edx
push eax
mov dword [esp + 0x30], edx
call ebp
add esp, 4
push eax
call fcn.00472400
mov edx, dword [0x659a18]
add esp, 0xc
lea ecx, [esp + 0x28]
push 0x18
push ecx
push edx
call ebp
add esp, 4
push eax
call fcn.00472400
mov ecx, dword [0x659a18]
add esp, 0xc
lea eax, [esp + 0x14]
push 0x14
push eax
push ecx
call ebp
add esp, 4
push eax
call fcn.00472400
mov edx, dword [0x659a18]
lea eax, [esp + 0x5c]
push edx
push 1
push 4
push eax
mov dword [esp + 0x6c], ebx
call dword [sym.imp.MSVCRT.dll_fread]
movsx ecx, word [esi + 0x1d2]
mov eax, dword [0x659a34]
add esp, 0x1c
test ecx, eax
je 0x445b53
mov edx, dword [esp + 0x50]
mov ecx, esi
push edx
call fcn.0041c640
test byte [esp + 0x28], 1
je 0x445b8d
mov ecx, esi
call fcn.004464e0
test eax, eax
jne 0x445b6d
or dword [esp + 0x28], 0x80000000
lea eax, [esp + 0x14]
push esi
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00443080
add esp, 0xc
mov ecx, esi
mov dword [esi + 0x238], eax
call fcn.00445c80
push ebx
mov ecx, esi
call fcn.00446ea0
mov edx, dword [esi + 8]
mov ecx, dword [esp + 0x40]
and dh, 0xfd
mov eax, esi
or dh, 1
pop edi
mov dword [esi + 8], edx
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x449070
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fopen]
push 0x56c98c
push str._tmp_gst_state.dat
xor ebx, ebx
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x4490a5
push 0x56c990
push str._tmp_gst_state.dat
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x4490ca
mov eax, dword [esp + 0x10]
push esi
push 3
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
ret 4
pop edi
mov eax, ebx
pop esi
pop ebx
ret 4

Function at 0x449180
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2000
call fcn.0051c710
push esi
push edi
call fcn.00431b40
mov eax, dword [esp + 0x200c]
movsx ecx, word [eax + 2]
movsx edx, word [eax]
movsx esi, word [eax + 6]
movsx eax, word [eax + 4]
sub esi, ecx
sub eax, edx
inc esi
inc eax
push esi
push eax
push ecx
mov ecx, dword [esp + 0x201c]
push edx
push ecx
lea edx, [esp + 0x101c]
push str.gst_launch_1.0_rtspsrc_location_s_protocols0x00000004___rtph264depay___vpudec___imxv4l2sink_syncfalse_overlay_left_d_overlay_top_d_overlay_width_d_overlay_height_d_
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x1c
mov esi, 0x14
push 0x64
call edi
dec esi
jne 0x4491da
push 0x56c9bc
push 0x56c9b8
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1000
lea eax, [esp + 0x18]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
lea ecx, [esp + 0x24]
push str.gst_launch_1.0
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0x24
test eax, eax
pop edi
pop esi
je 0x44924e
cmp byte [eax], 0
je 0x44924e
mov eax, 1
add esp, 0x2000
ret 8
xor eax, eax
add esp, 0x2000
ret 8
Function at 0x449390
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x659a18]
push edi
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
push edx
push 1
push 0x81d8
push esi
call dword [sym.imp.MSVCRT.dll_fread]
lea ebx, [esi + 0xb8]
mov ecx, 6
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esi + 0x80d8]
mov dword [esi + 0xd0], eax
mov dword [esi + 0x80d4], 0xffffffff
rep stosd dword es:[edi], eax
mov ecx, 0x2000
lea edi, [esi + 0xd4]
rep stosd dword es:[edi], eax
mov eax, dword [0x659a34]
mov ecx, dword [esi]
add esp, 0x1c
test eax, ecx
je 0x449428
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x449424
lea ecx, [esi + 0x28]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x449426
xor eax, eax
mov dword [ebx], eax
mov edx, dword [0x659a38]
mov eax, dword [esi]
test edx, eax
je 0x449459
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x449451
lea ecx, [esi + 0x58]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x449453
xor eax, eax
mov dword [esi + 0xbc], eax
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x449476
lea edx, [esi + 0x68]
push 1
push edx
mov ecx, eax
call fcn.00489020
jmp 0x449478
xor eax, eax
push 0x24
mov dword [esi + 0xc0], eax
call fcn.00470250
add esp, 4
test eax, eax
je 0x44949e
lea ecx, [esi + 0x88]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x4494a0
xor eax, eax
push 0x24
mov dword [esi + 0xc4], eax
call fcn.00470250
add esp, 4
test eax, eax
je 0x4494c6
lea edx, [esi + 0x98]
push 1
push edx
mov ecx, eax
call fcn.00489020
jmp 0x4494c8
xor eax, eax
mov ecx, dword [esi]
mov dword [esi + 0xc8], eax
mov eax, dword [0x659a44]
test eax, ecx
je 0x44950b
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x449503
lea ecx, [esi + 0xa8]
push 1
push ecx
mov ecx, eax
call fcn.00489020
mov dword [esi + 0xcc], eax
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
mov dword [esi + 0xcc], eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x44a0f0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x530516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.00439c20
lea edi, [esi + 0x1d4]
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x1c], ebp
call fcn.00449380
mov eax, dword [esi + 0xc4]
mov dword [esi + 0x83ac], ebp
mov dword [esi + 0x83b0], ebp
mov dword [esi], 0x535ba8
mov ebx, dword [eax + 0x20]
lea edx, [esi + 0x1d0]
and ebx, 0xfffffffe
mov byte [esp + 0x1c], 1
mov dword [eax + 0x20], ebx
mov ecx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push edx
call ebx
mov eax, dword [0x659a18]
lea ecx, [esp + 0x34]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x44], ebp
call ebx
mov edx, dword [0x659a18]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x24
mov ecx, esi
push eax
call fcn.0043b300
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
call fcn.00449390
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x44b060
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
call fcn.0043d090
lea ecx, [esi + 0x1e4]
xor edx, edx
lea eax, [esi + 0x200]
mov dword [ecx], edx
mov dword [esi + 0x1ec], edx
mov dword [esi + 0x1f0], edx
mov dword [esi + 0x1f4], edx
mov dword [esi + 0x1f8], edx
mov dword [esi + 0x1fc], 0xffffffff
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x20c], edx
mov dword [esi], 0x535f48
mov edx, dword [0x659a18]
push edx
push 1
push 8
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 8]
add esp, 0x10
movsx ecx, word [esi + 0x1e8]
and ah, 0xfd
mov dword [esi + 0x208], ecx
or eax, 0x101
mov dword [esi + 8], eax
mov eax, esi
pop esi
ret 4