joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5c40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call fcn.0045d240
push edi
call fcn.0045d240
push edi
call fcn.0045d240
mov esi, dword [ebp + 0xc]
movzx eax, ax
push edi
mov dword [esi], eax
call fcn.0045d240
movzx eax, ax
push edi
mov dword [esi + 4], eax
call fcn.0045d240
movzx eax, ax
push edi
mov dword [esi + 8], eax
call fcn.0045d070
push dword [edi]
call fcn.00597fff
add esp, 0x1c
mov byte [ebp + 0xf], al
test al, al
jne 0x4f5ca4
pop edi
pop esi
lea eax, [ebx + 2]
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi]
call fcn.00597fff
push edi
mov byte [ebp - 1], al
call fcn.0045d070
mov eax, dword [esi]
mov edi, dword [esi + 8]
add eax, 0xf
push dword [esi + 4]
cdq
and edx, 0xf
lea ecx, [edx + eax]
mov eax, edi
sar ecx, 4
add ecx, ecx
imul eax, ecx
mov dword [esi + 0xc], ecx
push eax
call fcn.00592c0b
add esp, 0x10
mov dword [esi + 0x18], eax
test eax, eax
jne 0x4f5cef
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
mov dword [ebp - 0xc], edx
test edi, edi
jle 0x4f5d5f
movzx edi, byte [ebp + 0xf]
mov dword [ebp + 0xc], edi
nop
mov eax, 1
mov ecx, edx
shl eax, cl
test eax, edi
je 0x4f5d73
mov ebx, dword [esi + 0x18]
xor edi, edi
cmp dword [esi + 4], edi
jle 0x4f5d50
cmp word [ebp - 8], 0
jne 0x4f5d50
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
push dword [ecx]
push 1
push eax
imul eax, edx
invalid

Function at 0x4f62f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push ebx
mov dword [edi], 0
mov dword [esi], 0
call fcn.0045d070
add esp, 4
mov dword [esi], eax
test eax, eax
jle 0x4f6346
cmp eax, 0x3e80
jge 0x4f6346
inc eax
push eax
call fcn.00593e38
mov dword [edi], eax
push dword [ebx]
push 1
push dword [esi]
push eax
call fcn.00595b79
mov ecx, dword [edi]
add esp, 0x14
mov eax, dword [esi]
pop edi
pop esi
mov byte [ecx + eax], 0
pop ebx
pop ebp
ret
pop edi
mov dword [esi], 0
pop esi
pop ebx
pop ebp
ret
Function at 0x4f73b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
push 1
push 0x15
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
jne 0x4f73f3
pop edi
mov eax, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov byte [ebp - 7], 0
lea eax, [ebp - 0x1c]
mov ecx, str.MXPaintPro_NickAvrion
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4f7420
test dl, dl
je 0x4f741c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4f7420
add eax, 2
add ecx, 2
test dl, dl
jne 0x4f7400
xor eax, eax
jmp 0x4f7425
sbb eax, eax
or eax, 1
test eax, eax
je 0x4f746f
mov ecx, str.MXPaint_NickAvrionov
lea eax, [ebp - 0x1c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4f7451
test dl, dl
je 0x4f744d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4f7451
add eax, 2
add ecx, 2
test dl, dl
jne 0x4f7431
xor eax, eax
jmp 0x4f7456
sbb eax, eax
or eax, 1
test eax, eax
je 0x4f746f
pop edi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.0045d030
push edi
call fcn.0045d030
push edi
call fcn.0045d030
push edi
call fcn.0045d030
push edi
mov esi, eax
call fcn.0045d030
imul eax, esi
lea eax, [eax*4 + 0x28]
push eax
push edi
call fcn.0045d3f0
push edi
call fcn.0045d030
push edi
mov dword [ebx], eax
call fcn.0045d030
push edi
mov dword [ebx + 4], eax
call fcn.0045d030
push edi
mov dword [ebx + 8], eax
call fcn.0045d030
push edi
mov dword [ebx + 0xc], eax
call fcn.0045d030
push edi
mov dword [ebx + 0x10], eax
call fcn.0045d030
push 0x10
push edi
mov dword [ebx + 0x14], eax
call fcn.0045d3f0
mov ecx, dword [ebp - 4]
add esp, 0x3c
xor ecx, ebp
xor eax, eax
pop esi
pop edi
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x4f8220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 0x5c], ebx
call fcn.0045d030
add esp, 4
cmp eax, 0xf5c7d1fa
je 0x4f8260
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.0045d210
movzx eax, ax
push esi
mov dword [ebx], eax
call fcn.0045d210
movzx eax, ax
push esi
mov dword [ebx + 4], eax
call fcn.0045d210
push esi
call fcn.0045d210
lea edi, [ebx + 0x10]
add esp, 0x10
mov ebx, 3
nop
push edi
push esi
call fcn.0045ce00
cwde
add esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [edi], xmm0
add edi, 8
dec ebx
jne 0x4f8290
mov edi, dword [ebp - 0x5c]
mov ebx, 3
add edi, 0x28
push edi
push esi
call fcn.0045ce00
cwde
add esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [edi], xmm0
add edi, 8
dec ebx
jne 0x4f82b8
push dword [esi]
call fcn.00597fff
mov ebx, dword [ebp - 0x5c]
add esp, 4
mov word [ebx + 8], ax
cmp ax, 3
je 0x4f8302
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push dword [esi]
call fcn.00597fff
mov word [ebx + 0xa], ax
push dword [esi]
call fcn.00597fff
push dword [esi]
call fcn.00597fff
push 0xe
push esi
call fcn.0045d3f0
push dword [esi]
call fcn.00597fff
push dword [esi]
call fcn.00597fff
add esp, 0x1c
mov edi, 5
lea esp, [esp]
push dword [esi]
call fcn.00597fff
push dword [esi]
lea eax, [ebp - 0x58]
push 1
push 0x50
push eax
call fcn.00595b79
add esp, 0x14
dec edi
jne 0x4f8340
push 0x38
push esi
call fcn.0045d3f0
push dword [esi]
call fcn.00597fff
mov word [ebx + 0xc], ax
push dword [esi]
call fcn.00597fff
add esp, 0x10
mov word [ebx + 0xe], ax
mov edi, 4
push dword [esi]
call fcn.00597fff
push dword [esi]
lea eax, [ebp - 0x58]
push 1
push 0x50
push eax
call fcn.00595b79
add esp, 0x14
dec edi
jne 0x4f8382
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x4f9930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push dword [esi]
push 1
push 0xc
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
jne 0x4f9979
pop edi
mov eax, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push 0xc
lea eax, [ebp - 0x10]
push str.COVER_EDITOR
push eax
call fcn.00596360
add esp, 0xc
test eax, eax
je 0x4f99a5
pop edi
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push ebx
mov dword [edi + 0x3c], 0
lea eax, [ebp - 0x10]
push dword [esi]
xor ebx, ebx
push 1
push 3
push eax
call fcn.00595b79
push dword [esi]
call fcn.00595867
add esp, 0x14
test eax, eax
jne 0x4f9a64
push dword [esi]
call fcn.00597fff
add esp, 4
mov dl, al
cmp byte [ebp - 0x10], 0x89
mov byte [ebp - 0xd], dl
jne 0x4f9a17
cmp byte [ebp - 0xf], 0x50
jne 0x4f9a17
cmp byte [ebp - 0xe], 0x4e
jne 0x4f9a17
cmp dl, 0x47
jne 0x4f9a17
mov ecx, dword [edi + 0x3c]
lea eax, [ecx + 1]
mov dword [edi + 0x3c], eax
cmp ecx, dword [edi + 0x90]
jne 0x4f9a17
push dword [esi]
call fcn.005960c7
mov dl, byte [ebp - 0xd]
add esp, 4
lea ebx, [eax - 4]
movzx ecx, byte [ebp - 0xf]
push dword [esi]
mov byte [ebp - 0x10], cl
movzx ecx, byte [ebp - 0xe]
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xe], dl
call fcn.00595867
add esp, 4
test eax, eax
je 0x4f99d0
test ebx, ebx
je 0x4f9a64
push 0
push ebx
push dword [esi]
call fcn.00595cb4
push 0
push dword [ebp - 0x14]
push edi
push esi
call fcn.005124d0
add esp, 0x1c
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
movdqu xmm0, xmmword [str.NCD_:_No_images__]
mov ecx, dword [ebp - 4]
pop ebx
movdqu xmmword [edi + 0x44], xmm0
mov ax, word [0x5edba8]
xor ecx, ebp
mov word [edi + 0x54], ax
mov eax, 9
pop edi
pop esi
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x4fad60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x14]
push 0x300
push 0
push edi
call fcn.00595760
mov eax, dword [ebp + 0xc]
add esp, 0xc
movzx eax, al
add eax, 0xfffffff1
cmp eax, 0x11
ja case.default.0x4fad92
movzx eax, byte [eax + 0x4faf78]
push ebx
push esi
jmp dword [eax*4 + 0x4faf64]
mov ax, word [ebp + 0x10]
xor ecx, ecx
xor ebx, ebx
cmp cx, ax
jae case.0x4fad92.19
movzx eax, ax
mov dword [ebp + 0xc], eax
push dword [ebp + 8]
call fcn.0045d210
movzx eax, ax
add esp, 4
movsx esi, ax
mov eax, esi
and eax, 0x1f
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
movzx eax, bx
inc ebx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov byte [eax + edi], cl
mov eax, esi
sar eax, 5
and eax, 0x1f
sar esi, 0xa
imul ecx, eax, 0xff
and esi, 0x1f
mov eax, 0x84210843
imul ecx
movzx eax, bx
inc ebx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov byte [eax + edi], cl
mov eax, 0x84210843
imul ecx, esi, 0xff
imul ecx
movzx eax, bx
inc ebx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
dec dword [ebp + 0xc]
mov byte [eax + edi], cl
jne 0x4fadb0
pop esi
pop ebx
pop edi
pop ebp
ret
mov ax, word [ebp + 0x10]
xor ecx, ecx
xor ebx, ebx
cmp cx, ax
jae case.0x4fad92.19
movzx eax, ax
mov dword [ebp + 0xc], eax
lea esp, [esp]
push dword [ebp + 8]
call fcn.0045d210
movzx eax, ax
add esp, 4
movsx esi, ax
mov eax, esi
sar eax, 0xa
and eax, 0x1f
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
movzx eax, bx
inc ebx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov byte [eax + edi], cl
mov eax, esi
sar eax, 5
and esi, 0x1f
and eax, 0x1f
imul ecx, eax, 0xff
mov eax, 0x84210843
imul ecx
movzx eax, bx
inc ebx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov byte [eax + edi], cl
mov eax, 0x84210843
imul ecx, esi, 0xff
imul ecx
movzx eax, bx
inc ebx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
dec dword [ebp + 0xc]
mov byte [eax + edi], cl
jne 0x4fae60
pop esi
pop ebx
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [eax]
mov eax, dword [ebp + 0x10]
push 3
movzx eax, ax
push eax
push edi
call fcn.00595b79
add esp, 0x10
pop esi
pop ebx
pop edi
pop ebp
ret
mov ax, word [ebp + 0x10]
xor ecx, ecx
xor esi, esi
cmp cx, ax
jae case.0x4fad92.19
mov ebx, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 0xc], eax
push dword [ebx]
call fcn.00597fff
movzx ecx, si
inc esi
mov byte [ecx + edi], al
push dword [ebx]
call fcn.00597fff
movzx ecx, si
inc esi
mov byte [ecx + edi], al
push dword [ebx]
call fcn.00597fff
movzx ecx, si
inc esi
mov byte [ecx + edi], al
push dword [ebx]
call fcn.00597fff
add esp, 0x10
dec dword [ebp + 0xc]
jne 0x4faf24
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x4faf90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0xc], 0
xor esi, esi
mov dword [ebp - 8], ebx
jmp 0x4fafb0
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00597fff
add esp, 4
cmp eax, 0xffffffff
je 0x4fb0c5
movsx edi, al
test al, al
js 0x4fb05a
inc edi
test edi, edi
jle 0x4fafb0
mov ecx, dword [ebp + 0x10]
lea esp, [esp]
lea eax, [edi + esi]
cmp eax, ecx
jl 0x4fafed
mov ebx, ecx
sub ebx, esi
jmp 0x4fafef
mov ebx, edi
mov eax, dword [ebp + 8]
push dword [eax]
push 1
push ebx
push dword [ebp - 8]
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x4fb0c5
add dword [ebp - 8], ebx
add esi, ebx
mov ecx, dword [ebp + 0x10]
sub edi, ebx
cmp esi, ecx
jl 0x4fb04e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x18]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x4fb0ca
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp + 0x14]
jge 0x4fb0bc
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
jmp 0x4fb051
mov ebx, dword [ebp - 8]
test edi, edi
jg 0x4fafe0
jmp 0x4fafb0
mov eax, dword [ebp + 8]
and edi, 0x7f
inc edi
push dword [eax]
call fcn.00597fff
add esp, 4
mov byte [ebp - 1], al
test edi, edi
jle 0x4fafb0
mov byte [ebx], al
inc esi
inc ebx
mov dword [ebp - 8], ebx
cmp esi, dword [ebp + 0x10]
jl 0x4fb0b2
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x18]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x4fb0ca
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp + 0x14]
jge 0x4fb0bc
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov al, byte [ebp - 1]
mov dword [ebp - 8], ebx
dec edi
test edi, edi
jg 0x4fb076
jmp 0x4fafb0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fb0e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
cdq
push ebx
sub eax, edx
mov dword [ebp - 0x2c], ecx
push esi
xor ebx, ebx
mov dword [ebp - 0x20], 0
sar eax, 1
mov esi, ecx
push edi
mov dword [ebp - 0x24], eax
jmp 0x4fb120
mov eax, dword [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x19]
push 1
push 1
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x4fb24e
movsx edi, byte [ebp - 0x19]
test edi, edi
js 0x4fb1be
inc edi
test edi, edi
jle 0x4fb120
lea ebx, [ebx]
mov eax, dword [ebp - 0x28]
push dword [eax]
push 1
push 2
push esi
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x4fb24e
movzx eax, word [esi]
push eax
call fcn.0045c6e0
inc ebx
mov word [esi], ax
add esp, 4
cmp ebx, dword [ebp - 0x24]
jl 0x4fb1b1
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x30]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x4fb253
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp + 0x14]
jge 0x4fb23b
mov esi, dword [ebp - 0x2c]
xor ebx, ebx
dec edi
add esi, 2
test edi, edi
jg 0x4fb150
jmp 0x4fb120
mov eax, dword [ebp - 0x28]
and edi, 0x7f
inc edi
push dword [eax]
lea eax, [ebp - 0x18]
push 1
push 2
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x4fb24e
push dword [ebp - 0x18]
call fcn.0045c6e0
add esp, 4
mov word [ebp - 0x18], ax
test edi, edi
jle 0x4fb120
mov ecx, dword [ebp - 0x24]
inc ebx
mov word [esi], ax
cmp ebx, ecx
jl 0x4fb22e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x30]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x4fb253
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp + 0x14]
jge 0x4fb23b
mov esi, dword [ebp - 0x2c]
xor ebx, ebx
mov ax, word [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
dec edi
add esi, 2
test edi, edi
jg 0x4fb1f5
jmp 0x4fb120
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov eax, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x4fb270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
xor ebx, ebx
mov dword [ebp - 0x24], eax
mov esi, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 0
push dword [edx]
call fcn.00597fff
add esp, 4
cmp eax, 0xffffffff
je 0x4fb3d8
movsx edi, al
test al, al
js 0x4fb349
mov edx, dword [ebp - 0x18]
inc edi
test edi, edi
jle 0x4fb2a0
mov ecx, dword [ebp + 0x10]
lea eax, [edi + ebx]
cmp eax, ecx
jl 0x4fb2d9
mov eax, ecx
sub eax, ebx
mov dword [ebp - 0x20], eax
jmp 0x4fb2de
mov eax, edi
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp - 0x18]
sub edi, eax
push dword [ecx]
push eax
push 3
push esi
call fcn.00595b79
mov ecx, dword [ebp - 0x20]
add esp, 0x10
cmp eax, ecx
jne 0x4fb3d8
add ebx, ecx
cmp ebx, dword [ebp + 0x10]
jl 0x4fb337
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x28]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x4fb3dd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp + 0x14]
jge 0x4fb3c5
mov esi, dword [ebp - 0x24]
xor ebx, ebx
jmp 0x4fb33d
lea eax, [ecx + esi]
lea esi, [eax + ecx*2]
test edi, edi
jg 0x4fb2c6
mov edx, dword [ebp - 0x18]
jmp 0x4fb2a0
mov eax, dword [ebp - 0x18]
and edi, 0x7f
inc edi
push dword [eax]
lea eax, [ebp - 0x14]
push 1
push 3
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x4fb3d8
mov edx, dword [ebp - 0x18]
test edi, edi
jle 0x4fb2a0
movzx eax, byte [ebp - 0x14]
inc ebx
mov byte [esi], al
movzx eax, byte [ebp - 0x13]
mov byte [esi + 1], al
movzx eax, byte [ebp - 0x12]
mov byte [esi + 2], al
add esi, 3
cmp ebx, dword [ebp + 0x10]
jl 0x4fb3b8
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x28]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x4fb3dd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp + 0x14]
jge 0x4fb3c5
mov esi, dword [ebp - 0x24]
xor ebx, ebx
dec edi
test edi, edi
jg 0x4fb371
mov edx, dword [ebp - 0x18]
jmp 0x4fb2a0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov eax, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x4fb3f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 8], 0
xor esi, esi
mov dword [ebp - 4], ebx
jmp 0x4fb410
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00597fff
add esp, 4
cmp eax, 0xffffffff
je 0x4fb539
movsx edi, al
test al, al
js 0x4fb4c3
inc edi
test edi, edi
jle 0x4fb410
mov ecx, dword [ebp + 0x10]
lea esp, [esp]
lea eax, [edi + esi]
cmp eax, ecx
jl 0x4fb44d
mov ebx, ecx
sub ebx, esi
jmp 0x4fb44f
mov ebx, edi
mov eax, dword [ebp + 8]
sub edi, ebx
push dword [eax]
push ebx
push 4
push dword [ebp - 4]
call fcn.00595b79
add esp, 0x10
cmp eax, ebx
jne 0x4fb539
mov ecx, dword [ebp + 0x10]
add esi, ebx
cmp esi, ecx
jl 0x4fb4af
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x18]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x4fb53e
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x14]
jge 0x4fb530
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
jmp 0x4fb4ba
mov eax, dword [ebp - 4]
lea eax, [eax + ebx*4]
mov dword [ebp - 4], eax
mov ebx, eax
test edi, edi
jg 0x4fb440
jmp 0x4fb410
mov eax, dword [ebp + 8]
and edi, 0x7f
inc edi
push dword [eax]
lea eax, [ebp - 0xc]
push 1
push 4
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x4fb539
test edi, edi
jle 0x4fb410
mov eax, dword [ebp - 0xc]
inc esi
mov dword [ebx], eax
add ebx, 4
mov dword [ebp - 4], ebx
cmp esi, dword [ebp + 0x10]
jl 0x4fb526
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0x18]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
test ax, ax
jne 0x4fb53e
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x14]
jge 0x4fb530
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 4], ebx
dec edi
test edi, edi
jg 0x4fb4e8
jmp 0x4fb410
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fb660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
mov dword [edi], 8
call fcn.00456000
movzx esi, ax
add esp, 8
test si, si
jne 0x4fb6e5
push ebx
xor ebx, ebx
cmp dword [edi + 0x14], ebx
jle 0x4fb6d3
lea ebx, [ebx]
mov eax, dword [ebp + 8]
push dword [eax]
push 3
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.00595b79
add esp, 0x10
cmp eax, 3
jne 0x4fb6ce
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.004585b0
movzx esi, ax
add esp, 0x10
test si, si
jne 0x4fb6d3
inc ebx
movzx eax, bx
cmp eax, dword [edi + 0x14]
jl 0x4fb690
jmp 0x4fb6d3
mov esi, 4
push 0
push 0
push 0
push dword [ebp + 0xc]
call fcn.00453f80
add esp, 0x10
pop ebx
pop edi
mov ax, si
pop esi
pop ebp
ret
Function at 0x4fb740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
mov dword [edi], 0x20
call fcn.00456000
movzx esi, ax
add esp, 8
test si, si
jne 0x4fb7c5
push ebx
xor ebx, ebx
cmp dword [edi + 0x14], ebx
jle 0x4fb7b3
lea ebx, [ebx]
mov eax, dword [ebp + 8]
push dword [eax]
push 4
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.00595b79
add esp, 0x10
cmp eax, 4
jne 0x4fb7ae
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.004585b0
movzx esi, ax
add esp, 0x10
test si, si
jne 0x4fb7b3
inc ebx
movzx eax, bx
cmp eax, dword [edi + 0x14]
jl 0x4fb770
jmp 0x4fb7b3
mov esi, 4
push 0
push 0
push 0
push dword [ebp + 0xc]
call fcn.00453f80
add esp, 0x10
pop ebx
pop edi
mov ax, si
pop esi
pop ebp
ret

Function at 0x4fb820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
movzx ecx, word [esi + 0x1a]
cmp cx, 8
jne 0x4fb83c
movzx ebx, word [esi + 0x10]
mov dword [ebp + 0x10], ebx
jmp 0x4fb854
mov eax, dword [esi + 0x10]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
imul eax, ecx
movzx eax, ax
mov dword [ebp + 0x10], eax
push esi
push dword [ebp + 0xc]
mov dword [esi], 0
call fcn.00456000
movzx edi, ax
add esp, 8
test di, di
jne 0x4fb8d8
xor ebx, ebx
cmp dword [esi + 0x14], ebx
jle 0x4fb8c3
mov eax, dword [ebp + 0x10]
movzx eax, ax
mov dword [ebp + 0x10], eax
mov edi, edi
mov ecx, dword [ebp + 8]
push dword [ecx]
push 1
push eax
push dword [esi + 0xc]
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x4fb8be
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.004585b0
movzx edi, ax
add esp, 0x10
test di, di
jne 0x4fb8c3
inc ebx
movzx eax, bx
cmp eax, dword [esi + 0x14]
mov eax, dword [ebp + 0x10]
jl 0x4fb880
jmp 0x4fb8c3
mov edi, 4
push dword [ebp + 0x14]
push 8
push 0x200
push dword [ebp + 0xc]
call fcn.00453f80
add esp, 0x10
mov ax, di
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4fc920
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0045d030
mov edi, dword [ebp + 0xc]
push esi
mov dword [edi], eax
call fcn.0045d030
push esi
mov dword [edi + 4], eax
call fcn.0045d030
mov dword [edi + 8], eax
push dword [esi]
call fcn.00597fff
mov byte [edi + 0xc], al
push dword [esi]
call fcn.00597fff
push esi
mov byte [edi + 0xd], al
call fcn.0045d210
mov word [edi + 0xe], ax
lea eax, [edi + 0x10]
push dword [esi]
push 1
push 0x10
push eax
call fcn.00595b79
add esp, 0x28
neg eax
sbb eax, eax
and eax, 0xfffffffc
pop edi
add eax, 4
pop esi
pop ebp
ret