joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464f20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x546cf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, dword [esp + 0x64]
push edi
mov dword [esp + 0x18], ecx
movsx edi, word [esi + 6]
movsx ebp, word [esi + 2]
movsx ebx, word [esi + 4]
lea eax, [edi + ebp]
sub edi, ebp
cdq
sub eax, edx
mov ecx, eax
movsx eax, word [esi]
mov dword [esp + 0x10], eax
add eax, ebx
cdq
sub eax, edx
mov ebp, dword [esp + 0x10]
mov esi, eax
sub ebx, ebp
sar ecx, 1
sar esi, 1
inc edi
mov eax, edi
mov dword [esp + 0x14], edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
neg edi
movsx eax, di
movsx edx, cx
add eax, edx
inc ebx
movsx edx, si
mov word [esp + 0x68], dx
mov word [esp + 0x6a], ax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], eax
mov eax, ebx
cdq
sub eax, edx
mov ebp, eax
mov eax, dword [esp + 0x14]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
movsx eax, bx
movsx edx, cx
add eax, edx
sar ebp, 1
mov dword [esp + 0x14], eax
movsx eax, bp
movsx edx, si
add eax, edx
mov word [esp + 0x68], ax
mov ax, word [esp + 0x14]
mov word [esp + 0x6a], ax
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], edx
cdq
sub eax, edx
sar eax, 1
neg eax
mov dword [esp + 0x10], eax
movsx eax, bx
movsx edx, cx
add eax, edx
mov dword [esp + 0x14], eax
movsx eax, word [esp + 0x10]
movsx edx, si
add eax, edx
mov word [esp + 0x68], ax
mov ax, word [esp + 0x14]
mov word [esp + 0x6a], ax
mov edx, dword [esp + 0x68]
mov dword [esp + 0x30], edx
movsx eax, di
movsx edx, cx
add eax, edx
mov dword [esp + 0x14], eax
movsx eax, word [esp + 0x10]
movsx edx, si
add eax, edx
mov word [esp + 0x68], ax
mov ax, word [esp + 0x14]
mov word [esp + 0x6a], ax
mov edx, dword [esp + 0x68]
mov dword [esp + 0x34], edx
movsx eax, di
movsx edx, cx
add eax, edx
movsx edx, bp
movsx edi, si
add edx, edi
mov word [esp + 0x6a], ax
mov word [esp + 0x68], dx
mov eax, dword [esp + 0x68]
mov dword [esp + 0x38], eax
movsx eax, bx
movsx ecx, cx
add eax, ecx
movsx ecx, si
mov word [esp + 0x68], cx
mov word [esp + 0x6a], ax
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0x40]
mov dword [esp + 0x3c], edx
call fcn.004c65b0
mov eax, dword [esp + 0x18]
mov edi, dword [0x67a8e4]
push 3
mov dword [esp + 0x64], 0
mov eax, dword [eax + 0x2f0]
and eax, edi
lea ecx, [eax + eax*2]
lea edx, [esp + ecx*4 + 0x2c]
lea ecx, [esp + 0x44]
push edx
call fcn.004c6670
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 0x1c]
push eax
push eax
push 1
call fcn.0041ae00
mov ecx, dword [eax]
push 1
mov dword [0x69436c], ecx
mov edx, dword [eax + 4]
push 1
mov dword [0x694370], edx
mov eax, dword [eax + 8]
push 1
push 0
push 0
lea ecx, [esp + 0x30]
mov dword [0x694374], eax
call fcn.004c9320
lea ecx, [esp + 0x44]
push eax
push ecx
mov ecx, 0x694360
call fcn.004a3ec0
lea ecx, [esp + 0x40]
mov dword [esp + 0x60], 0xffffffff
call fcn.004c6960
mov ecx, dword [esp + 0x58]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 8
Function at 0x466b00
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 0
mov ecx, dword [0x67a8cc]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
push edx
push 1
push 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 8]
add esp, 0x1c
test eax, eax
je 0x466ba8
mov eax, dword [esi]
and eax, 0xf
dec eax
je 0x466b81
dec eax
je 0x466b61
dec eax
jne 0x466ba8
push 0x1c
call fcn.004784b0
add esp, 4
test eax, eax
je 0x466ba3
mov ecx, dword [esi + 8]
push ecx
mov ecx, eax
call fcn.004cf860
mov dword [esi + 8], eax
pop esi
ret 4
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x466ba3
mov edx, dword [esi + 8]
mov ecx, eax
push edx
call fcn.004cfd90
mov dword [esi + 8], eax
pop esi
ret 4
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x466ba3
mov ecx, dword [esi + 8]
push 0
push ecx
mov ecx, eax
call fcn.004cfb10
mov dword [esi + 8], eax
pop esi
ret 4
xor eax, eax
mov dword [esi + 8], eax
pop esi
ret 4
Function at 0x467890
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x546da8
push eax
mov dword fs:[0], esp
sub esp, 0x20
lea eax, [esp + 4]
push esi
push edi
mov esi, ecx
push eax
call fcn.00468060
mov edx, dword [0x67a8d8]
mov eax, dword [eax]
cmp edx, 0x18
jl 0x4678c8
mov edx, 0x18
movsx edi, word [esi + 0x10]
and eax, 0xffff
mov ecx, eax
movsx eax, word [esi + 0x14]
sub eax, edi
inc eax
cmp ecx, eax
jle 0x4678e0
mov eax, ecx
movsx ecx, word [esi + 0x16]
push edx
movsx edx, word [esi + 0x12]
sub ecx, edx
inc ecx
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.004bb710
lea ecx, [esp + 0x10]
xor edi, edi
lea eax, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x34], edi
mov dword [0x69437c], eax
call fcn.00467df0
mov ecx, esi
call fcn.004679c0
mov cl, byte [0x9660fa]
mov al, 1
test al, cl
jne 0x46794a
mov dl, cl
push fcn.00458ab0
or dl, al
mov word [0x9660fc], di
mov byte [0x9660fa], dl
mov word [0x9660fe], di
call fcn.0053228e
add esp, 4
mov eax, dword [esi + 0x224]
push edi
movsx edx, word [esi + 0x16]
mov word [esp + 0xc], ax
push edi
movsx eax, word [esi + 0x12]
movsx ecx, word [esi + 0x14]
sub edx, eax
lea eax, [esp + 0x10]
inc edx
add esi, 0x1c
push edx
mov word [esp + 0x16], di
movsx edx, word [esi - 0xc]
sub ecx, edx
inc ecx
push ecx
push 0x9660fc
push eax
lea ecx, [esp + 0x28]
push esi
push ecx
call fcn.0047d2c0
add esp, 0x20
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call fcn.004bc350
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x468680
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x67a8cc]
push edi
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esi + 4]
push eax
push 1
push 4
push ecx
call edi
mov edx, dword [0x67a8cc]
lea eax, [esi + 8]
push edx
push 1
push 0x10
push eax
call edi
mov ecx, dword [0x67a8cc]
lea ebx, [esi + 0x18]
push ecx
push 1
push 0x10
push ebx
call edi
add esp, 0x4c
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x468703
push 1
push ebx
mov ecx, eax
call fcn.00495db0
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
pop edi
mov dword [esi + 0x28], eax
pop esi
pop ebx
ret 4
Function at 0x4694c0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x67a8cc]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
push ecx
call edi
mov edx, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 0x1c
push esi
call ebx
mov eax, dword [esi + 0xc]
add esp, 0x1c
test eax, eax
je 0x46958c
cmp dword [0x67a7f0], 0x1d
jl 0x46956a
mov eax, dword [esi]
shr eax, 8
and eax, 0xf
dec eax
je 0x46954d
dec eax
je 0x469532
dec eax
jne 0x46958c
push 0x1c
call fcn.004784b0
add esp, 4
test eax, eax
je 0x469587
mov ecx, dword [esi + 0xc]
push ecx
mov ecx, eax
call fcn.004cf860
jmp 0x469589
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x469587
mov edx, dword [esi + 0xc]
mov ecx, eax
push edx
call fcn.004cfd90
jmp 0x469589
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x469587
mov ecx, dword [esi + 0xc]
push 0
push ecx
mov ecx, eax
call fcn.004cfb10
jmp 0x469589
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x469587
mov edx, dword [esi + 0xc]
push 0
push edx
mov ecx, eax
call fcn.004cfb10
jmp 0x469589
xor eax, eax
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4695b3
push 0x58
call fcn.004784b0
add esp, 4
test eax, eax
je 0x4695ae
mov ecx, dword [esi + 0x10]
push ecx
mov ecx, eax
call fcn.004406b0
jmp 0x4695b0
xor eax, eax
mov dword [esi + 0x10], eax
mov edx, dword [0x67a8e8]
mov eax, dword [esi]
test edx, eax
je 0x46960c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46960c
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call edi
push 0x24
call sub.MFC42u.DLL_operatornew
mov edx, eax
add esp, 0x10
test edx, edx
je 0x4695f0
mov ecx, 9
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
jmp 0x4695f2
xor eax, eax
mov dword [esi + 0x14], eax
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0x24
push eax
call ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret 4
mov dword [esi + 0x14], 0
pop edi
pop esi
pop ebx
ret 4
Function at 0x46d830
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x546ef9
push eax
mov eax, 0x100c
mov dword fs:[0], esp
call fcn.005322e0
mov eax, dword [esp + 0x101c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x1c], esi
call fcn.0043cc70
lea ebp, [esi + 0x1e0]
xor edi, edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0x1e4], edi
mov dword [ebp], edi
mov dword [esi + 0x1e8], edi
mov dword [esi + 0x1ec], edi
mov dword [esi], 0x54f168
mov ecx, dword [0x67a8cc]
lea eax, [esi + 0x1d0]
push ecx
push 1
push 4
push eax
mov dword [esp + 0x1034], edi
call ebx
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x1d4]
push edx
push 1
push 0xc
push eax
call ebx
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 4
push ebp
call ebx
mov edx, dword [0x67a8cc]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
mov edx, dword [ebp]
add esp, 0x34
cmp edx, edi
jle 0x46d9fe
mov dword [esp + 0x1c], edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x1c]
push eax
push edx
push 4
push ecx
call ebx
mov edx, dword [0x67a8cc]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
mov ecx, dword [esi + 0x1d0]
mov dword [esp + 0x28], eax
mov eax, dword [0x67a8ec]
add esp, 0x14
test eax, ecx
jne 0x46d935
cmp dword [ebp], 0
jle 0x46d9fa
mov edi, dword [ebp]
lea ecx, [edi*8]
sub ecx, edi
shl ecx, 3
push ecx
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov byte [esp + 0x1024], 1
je 0x46d991
lea ebx, [edi - 1]
test ebx, ebx
jl 0x46d993
lea edi, [eax + 0xa]
inc ebx
xor eax, eax
lea ecx, [edi + 0x22]
mov word [edi - 4], ax
mov word [edi - 6], ax
mov word [edi], 0xffff
mov word [edi - 2], 0xffff
call fcn.0041add0
add edi, 0x38
dec ebx
jne 0x46d968
mov eax, dword [esp + 0x10]
jmp 0x46d993
xor eax, eax
mov dword [esi + 0x1e4], eax
mov eax, dword [ebp]
xor edi, edi
mov byte [esp + 0x1024], 0
cmp eax, edi
jle 0x46d9fa
mov dword [esp + 0x10], edi
lea ebx, [esp + 0x1c]
mov edx, dword [ebx]
mov eax, dword [0x67a8cc]
push 0
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
mov edx, dword [esi + 0x1e4]
push ecx
mov ecx, dword [esp + 0x20]
push 1
add edx, ecx
push 0x38
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esp + 0x2c]
mov eax, dword [ebp]
add esp, 0x1c
inc edi
add ebx, 4
add ecx, 0x38
cmp edi, eax
mov dword [esp + 0x10], ecx
jl 0x46d9b2
mov eax, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.0043ede0
test byte [esi + 0x1d0], 0xf
je 0x46da1d
mov eax, dword [esi + 8]
and ah, 0xfd
or ah, 1
mov dword [esi + 8], eax
jmp 0x46da29
mov ecx, dword [esi + 8]
and ch, 0xfe
or ch, 2
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x101c]
mov dword [esi + 0xb8], 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1018
ret 4
Function at 0x46de60
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
mov esi, ecx
push eax
call fcn.0043cd50
lea eax, [esi + 0x1d0]
mov edx, 1
or ecx, 0xffffffff
mov word [eax], dx
mov word [eax + 2], dx
mov dword [eax + 4], edx
mov word [esi + 0x1da], 0
mov word [esi + 0x1d8], 0
mov word [esi + 0x1de], cx
mov word [esi + 0x1dc], cx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x1d8], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi], 0x54f25c
mov dword [esi + 0x1dc], ecx
mov ecx, dword [0x67a8cc]
push ecx
push edx
push 8
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov eax, esi
pop esi
ret 4

Function at 0x46e420
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x546f18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0046de60
lea eax, [esi + 0x1e0]
lea edi, [esi + 0x1e4]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi], 0x54f358
mov dword [eax], 0
mov dword [edi], 0
mov ecx, dword [0x67a8cc]
mov dword [esp + 0x1c], 0
push ecx
push 1
push 2
push eax
call ebp
mov edx, dword [0x67a8cc]
push edx
push 1
push 2
push edi
call ebp
mov ebx, dword [edi]
lea eax, [ebx*4]
push eax
call fcn.004784e0
xor edx, edx
add esp, 0x24
cmp eax, edx
je 0x46e4c1
dec ebx
mov ecx, eax
cmp ebx, edx
jl 0x46e4c3
inc ebx
mov word [ecx], dx
mov word [ecx + 2], dx
add ecx, 4
dec ebx
jne 0x46e4b2
jmp 0x46e4c3
xor eax, eax
mov edx, dword [edi]
mov dword [esi + 0x1e8], eax
mov ecx, dword [0x67a8cc]
push ecx
push edx
push 4
push eax
call ebp
add esp, 0x10
mov ecx, esi
call fcn.0043d240
mov eax, dword [edi]
mov ecx, dword [esi + 0x1e8]
push eax
push ecx
mov ecx, esi
call fcn.0046e1e0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x46e940
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x546f58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.0046de60
lea edi, [esi + 0x1e0]
mov dword [esp + 0x18], 0
mov ecx, edi
call fcn.0041add0
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi], 0x54f450
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0xc
push edi
call ebx
mov edx, dword [0x67a8cc]
lea edi, [esi + 0x1ec]
push edx
push 1
push 4
push edi
call ebx
add esp, 0x20
mov ecx, esi
call fcn.0043d240
movsx eax, word [esi + 0x16]
movsx ecx, word [esi + 0x12]
movsx edx, word [esi + 0x10]
sub eax, ecx
movsx ecx, word [esi + 0x14]
sub ecx, edx
inc eax
inc ecx
cmp ecx, eax
jl 0x46e9d2
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [edi]
cmp eax, edx
jle 0x46e9e8
mov dword [edi], edx
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x46ebf0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x546f78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.0046de60
lea edi, [esi + 0x1e0]
mov dword [esp + 0x14], 0
mov ecx, edi
call fcn.0041add0
mov dword [esi], 0x54f548
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0xc
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, esi
call fcn.0043d240
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x46ed70
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x546f98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0046de60
lea edi, [esi + 0x1e0]
mov dword [esp + 0x1c], 0
mov ecx, edi
call fcn.0041add0
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi], 0x54f640
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0xc
push edi
call ebp
mov edx, dword [0x67a8cc]
lea edi, [esi + 0x1ec]
push edx
push 1
push 4
push edi
call ebp
mov ebx, dword [edi]
lea eax, [ebx*4]
push eax
call fcn.004784e0
xor edx, edx
add esp, 0x24
cmp eax, edx
je 0x46ee0c
dec ebx
mov ecx, eax
cmp ebx, edx
jl 0x46ee0e
inc ebx
mov word [ecx], dx
mov word [ecx + 2], dx
add ecx, 4
dec ebx
jne 0x46edfd
jmp 0x46ee0e
xor eax, eax
mov edx, dword [edi]
mov dword [esi + 0x1f0], eax
mov ecx, dword [0x67a8cc]
push ecx
push edx
push 4
push eax
call ebp
add esp, 0x10
mov ecx, esi
call fcn.0043d240
mov eax, dword [edi]
mov ecx, dword [esi + 0x1f0]
push eax
push ecx
mov ecx, esi
call fcn.0046e1e0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x46f3a0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x546ff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.0046de60
mov dword [esi], 0x54f738
mov ecx, dword [0x67a8cc]
push ecx
push 1
lea edx, [esi + 0x1e0]
push 4
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, esi
call fcn.0043d240
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x46f580
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x547018
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.0046de60
lea edi, [esi + 0x1e0]
mov dword [esp + 0x14], 0
mov ecx, edi
call fcn.0041add0
mov dword [esi], 0x54f830
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 0xc
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
call edi
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x1ec]
push edx
push 1
push 4
push eax
call edi
add esp, 0x20
mov ecx, esi
call fcn.0043d240
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x46f6c0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x547038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.0046de60
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi], 0x54f928
mov ecx, dword [0x67a8cc]
lea edx, [esi + 0x1e0]
push ecx
push 1
push 2
push edx
mov dword [esp + 0x24], 0
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esi + 0x1e2]
push eax
push 1
push 2
push ecx
call edi
add esp, 0x20
mov ecx, esi
call fcn.0043d240
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x46f830
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x547058
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.0046de60
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi], 0x54fa20
mov ecx, dword [0x67a8cc]
lea edx, [esi + 0x1e0]
push ecx
push 1
push 2
push edx
mov dword [esp + 0x24], 0
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esi + 0x1e2]
push eax
push 1
push 2
push ecx
call edi
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x1e4]
push edx
push 1
push 4
push eax
call edi
add esp, 0x30
mov ecx, esi
call fcn.0043d240
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x46fce0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x547098
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push 0
push eax
mov dword [esp + 0x10], esi
call fcn.0043cd50
mov dword [esi + 0x1d0], 0
mov dword [esi], 0x54fc10
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x1c]
push ecx
push 1
push 1
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [0x67a8cc]
push 1
push 3
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
mov edi, eax
add esp, 0x20
movsx eax, byte [esp + 0x1c]
dec eax
cmp eax, 3
ja case.default.0x46fd65
jmp dword [eax*4 + 0x46fe00]
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x46fdd3
mov edx, dword [0x67a8e4]
mov ecx, eax
push edx
push edi
call fcn.004cfb10
jmp 0x46fdd5
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x46fdd3
push edi
mov ecx, eax
call fcn.004cfd90
jmp 0x46fdd5
push 0x1c
call fcn.004784b0
add esp, 4
test eax, eax
je 0x46fdd3
push edi
mov ecx, eax
call fcn.004cf860
jmp 0x46fdd5
push 0x20
call fcn.004784b0
add esp, 4
test eax, eax
je 0x46fdd3
push edi
mov ecx, eax
call fcn.004d0610
jmp 0x46fdd5
xor eax, eax
mov dword [esi + 0x1d0], eax
mov ecx, esi
call fcn.0043d240
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0xc]
and al, 0x7f
pop edi
mov dword [esi + 8], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x46ffb0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5470e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.0041b430
mov dword [esi], 0x54fd00
mov ecx, dword [0x67a8cc]
push ecx
push 1
lea edx, [esp + 0x2c]
push 4
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x34]
add esp, 0x10
test eax, eax
je 0x47004d
mov ecx, esi
call fcn.0041ccb0
mov ecx, esi
call fcn.004d9c10
lea ecx, [esp + 8]
call fcn.004d52e0
mov ecx, dword [esp + 0x24]
lea eax, [esi + 0x10]
push eax
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call fcn.004d5300
lea ecx, [esp + 8]
call fcn.004d5630
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 0
call fcn.004d56e0
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xb8], 0x10
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4

Function at 0x470070
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5470f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push eax
mov dword [esp + 0x10], esi
call fcn.0043cd50
or eax, 0xffffffff
mov word [esi + 0x1d6], di
mov word [esi + 0x1d4], di
mov word [esi + 0x1da], ax
mov word [esi + 0x1d8], ax
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x1d4], ecx
mov dword [esi + 0x1dc], edi
mov dword [esi], 0x54fddc
mov dword [esi + 0x1d8], edx
mov eax, dword [0x67a8cc]
push eax
push 1
lea ecx, [esi + 0x1d0]
push 4
push ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, esi
call fcn.0043d240
push edi
mov ecx, esi
call fcn.00470200
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4