joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fca40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fcc81
sub esp, 0x28
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4fcc50
cmp ecx, 1
jne 0x4fcbfa
xor eax, eax
xor edx, edx
test eax, eax
jne 0x4fcbde
cmp ecx, 8
jg 0x4fcba2
mov dword [esp + 0x24], edx
mov ebx, dword [esp + 0x2c]
xor ebp, ebp
xor esi, esi
xor edi, edi
jmp 0x4fcab3
lea edi, [ebp + 1]
mov edx, dword [esp + 0x20]
shl edx, 8
movzx ebp, byte [ebx + ebp]
or ebp, edx
mov edx, dword [esp + 0x24]
mov edx, ebp
mov ebp, edi
mov edi, esi
mov esi, edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x20], esi
cmp ecx, ebp
jle 0x4fcacc
shl edi, 8
shr esi, 0x18
or esi, edi
cmp ecx, ebp
ja 0x4fca93
jmp 0x4fcc79
mov dword [esp + 0x10], eax
shl ecx, 3
lea ebx, [ecx - 0x20]
mov byte [esp + 0xf], bl
cmp bl, 0x20
sbb ebp, ebp
mov dword [esp + 0x1c], ebp
neg ebx
mov byte [esp + 0xe], bl
cmp bl, 0x20
sbb edx, edx
mov dword [esp + 0x18], edx
lea eax, [ecx - 0x40]
neg eax
mov byte [esp + 0xd], al
cmp al, 0x20
sbb edx, edx
cmp bl, 0x20
sbb ebx, ebx
shr al, 5
movzx eax, al
cmp eax, 1
sbb eax, eax
mov dword [esp + 0x14], eax
movzx ecx, byte [esp + 0xf]
shr esi, cl
and esi, ebp
movzx ecx, byte [esp + 0xd]
shl edi, cl
and edi, edx
or esi, edi
mov edi, ecx
movzx ecx, byte [esp + 0xe]
mov ebp, dword [esp + 0x20]
shl ebp, cl
mov eax, dword [esp + 0x18]
and ebp, eax
or esi, ebp
mov eax, ecx
mov ecx, edi
mov ebp, dword [esp + 0x20]
shl ebp, cl
and ebp, edx
not ebx
or ebx, eax
shr ebp, cl
mov ecx, ebx
mov eax, esi
sar esi, cl
mov ebx, dword [esp + 0x14]
xor ebx, 0xffffffff
and ebx, esi
movzx ecx, byte [esp + 0xf]
mov esi, eax
shl eax, cl
mov ecx, esi
mov esi, dword [esp + 0x1c]
and eax, esi
and ebp, edx
or ebp, eax
or ebx, ebp
mov dword [esp + 0x38], ebx
xchg edi, eax
cmp al, 0x20
xchg edi, eax
sbb eax, eax
not eax
or edi, eax
mov eax, ecx
mov ecx, edi
sar eax, cl
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], eax
add esp, 0x28
ret
lea eax, [0x537d13]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00409050
mov eax, dword [esp + 8]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
lea ecx, [0x56915c]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
add esp, 0x28
ret
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
add esp, 0x28
ret
mov edx, dword [esp + 0x2c]
movzx ebx, byte [edx]
test bl, bl
jne 0x4fcc10
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x4fcc27
cmp bl, 0xff
jne 0x4fcc1e
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x4fcc27
xor eax, eax
xor edx, edx
jmp 0x4fca72
lea eax, [0x53bfdf]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00409050
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x30]
lea eax, [0x56915c]
jmp 0x4fca72
lea eax, [0x536a3a]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.00409050
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x30]
lea eax, [0x56915c]
jmp 0x4fca72
mov eax, ebp
call fcn.0045a700
nop
call fcn.00459120
jmp fcn.004fca40
Function at 0x402be0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
or esi, 0xfd
bswap eax
sbb edi, 0x5f
ror edx, 0x22
dec edi
and eax, 0xdd
add edi, 0x7f
not edi
not ebx
sbb edi, 0xff
mov edi, 0xa1
or edx, 0x24
dec ebx
rcr eax, 0xe2
not edx
sub edi, 0x1d
mov ebx, 0xf8
sub esi, 0xf0
mov ebx, 0xce
rcl ebx, 0x29
inc esi
imul edx
rcr edi, 0x80
not esi
add ebx, 0x36
rol edi, 0x2f
inc esi
rol esi, 0x14
not edx
and esi, 0x46
and eax, 0x97
not esi
and esi, 0x8d
sub esi, 0x6b
rcr eax, 0xac
bswap esi
imul eax
rol ebx, 0xa2
bswap eax
imul edx
not edi
bswap ebx
rol eax, 0x6b
not esi
add esi, 0x79
inc ebx
dec esi
mov eax, 0xd4
or edx, 4
imul ebx
xor ecx, ecx
xor edi, edi
or edi, 0x50
neg edx
add eax, 0x50
or edi, 0x7c
sub eax, 5
neg esi
or esi, 0x7c
and esi, 0x56
neg edx
imul edi
mov esi, 0x8c
not edx
mov edi, 0xd8
sub eax, 0xd8
ror eax, 0xd3
rcr edi, 0x7f
mov eax, 0xf2
and esi, 0xcb
neg esi
dec eax
neg ebx
rcr ebx, 0x8e
not edx
rol edi, 0x8c
dec ebx
rcr edx, 0xbf
or eax, 0xfc
not eax
rcr ebx, 0x62
add ebx, 0x2a
bswap edi
dec eax
mov ebx, 0x43
imul ebx
bswap edx
ror edi, 0x82
add edx, 0xeb
not edi
bswap ebx
rol eax, 0xc4
or eax, 0xe8
or ebx, 0xa2
neg esi
rol esi, 0x1c
neg edx
neg edi
mov ebx, 0xd
imul eax
rol esi, 0xba
bswap esi
mov ecx, dword [ebp + 0xc]
mov esi, 0x96
dec eax
sbb esi, 0x34
dec eax
inc ebx
neg edx
neg eax
dec edx
neg edi
neg ebx
rcl ebx, 0x95
rcr ebx, 0x79
add edi, 0xf8
not edi
not edx
bswap edi
ror esi, 0x88
neg esi
rol edx, 0x3a
not esi
rcl edi, 0x74
bswap eax
sbb esi, 0x39
rol edi, 0x37
sub ebx, 0x7c
neg ebx
inc ebx
sub edx, 0x9b
rcr edi, 0x99
imul edi
dec edx
add esi, 0x28
dec ebx
add edi, 0xf5
dec edi
rcr eax, 0x9b
sub ebx, 0xb0
imul eax
not esi
add esi, 0x21
bswap eax
inc eax
inc eax
rcl ebx, 0x5b
bswap edi
neg eax
bswap ebx
not esi
imul ebx
neg edi
mov edi, dword [ebp + 8]
xor eax, esi
xor ebx, eax
xor eax, ebx
not byte [edi]
xor esi, ebx
xor ebx, eax
mov eax, esi
xor eax, esi
xor esi, ebx
xor eax, esi
mov ebx, ebx
xor esi, esi
mov esi, eax
add byte [edi], 0x36
mov esi, eax
mov eax, ebx
mov eax, esi
xor ebx, esi
mov eax, eax
mov eax, eax
xor eax, esi
xor esi, eax
xor ebx, esi
sub byte [edi], 0x75
xor eax, esi
mov eax, ebx
mov ebx, eax
mov ebx, esi
mov esi, ebx
mov eax, esi
xor eax, esi
mov esi, eax
xor eax, esi
imul byte [edi]
inc edi
loop 0x402d99
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x407c70
Capabilities:
Write file on windows

Disassembly:
call fcn.0040b37c
ret 4
cmp eax, 1
jg 0x407cdb
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407780
mov ecx, eax
call fcn.00406f9a
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x407c5c
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407780
mov ecx, eax
call fcn.00406f9a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0040bb44
add esp, 0x10
cmp edi, eax
jne 0x407cf1
lea eax, [ebp - 0x30]
mov byte [esi + 0x41], 1
cmp dword [ebp - 0x3c], eax
jne 0x407d07
test edi, edi
ja 0x407c82
cmp dword [ebp - 0x18], 0x20
jae 0x407cf1
push 0
push 8
lea ecx, [ebp - 0x2c]
call fcn.00406310
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407780
mov ecx, eax
call fcn.00406f9a
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00407780
mov ecx, eax
call fcn.00406f9a
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2f]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x407c0f
jmp 0x407cf1
cmp eax, 3
jne 0x407cf1
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.00407588
pop ecx
pop ecx
test al, al
jne 0x407d07
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00403610
mov eax, esi
jmp 0x407b75
mov esi, dword [ebp + 8]
jmp 0x407cf4
Function at 0x405cc0
Capabilities:
Read file on windows

Disassembly:
mov dword [0x448e50], 0
jmp fcn.00412bf0

Function at 0x406210
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push 1
push eax
mov dword [ebp - 0xc], 0x60001
mov dword [ebp - 8], 0x100
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
je 0x406240
mov esp, ebp
pop ebp
ret
push 0
push 0
push str.couldnt_register_raw_input_device
call fcn.004060d0
int3

Function at 0x406490
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436fa7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x446d00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
lea ebx, [esi + 4]
mov dword [esi], 0
mov dword [ebx], 0
push 4
push 1
push ebx
mov dword [esi + 8], 0
call fcn.0041c50c
add esp, 0x10
cmp eax, 4
je 0x4064f6
push 0
push 0
push 0x438c40
call fcn.004060d0
add esp, 0xc
mov eax, dword [ebx]
cmp eax, 3
jl 0x406504
cmp eax, 0x3e8
jle 0x406515
push 0
push 0
push str.gyuru::gyuru_ben_pontszam___3__pontszam___MAXPONT_
call fcn.004060d0
add esp, 0xc
mov edi, dword [ebx]
mov ecx, 0x10
add edi, 0xa
mov eax, edi
mov dword [esi], edi
mul ecx
mov ecx, 0xffffffff
mov dword [ebp - 0x14], edi
cmovb eax, ecx
push eax
call fcn.0041928e
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x406567
mov ebx, eax
test edi, edi
je 0x406562
nop dword [eax]
mov ecx, ebx
call fcn.00418c40
add ebx, 0x10
sub edi, 1
jne 0x406550
mov eax, dword [ebp - 0x10]
lea ebx, [esi + 4]
jmp 0x406569
xor eax, eax
xor edx, edx
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 8], eax
cmp dword [esi], edx
jle 0x40659a
xor ecx, ecx
xorps xmm0, xmm0
nop
mov eax, dword [esi + 8]
lea ecx, [ecx + 0x10]
inc edx
movsd qword [ecx + eax - 0x10], xmm0
mov eax, dword [esi + 8]
movsd qword [ecx + eax - 8], xmm0
cmp edx, dword [esi]
jl 0x406580
push dword [ebp + 8]
mov eax, dword [ebx]
shl eax, 4
push eax
push 1
push dword [esi + 8]
call fcn.0041c50c
mov ecx, dword [esi + 4]
add esp, 0x10
shl ecx, 4
cmp eax, ecx
je 0x4065cb
push 0
push 0
push str.gyuru::gyuru_ben_nem_megy_file_olvasasa_
call fcn.004060d0
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4104c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x437427
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x446d00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 0x438258
push edi
call fcn.00412e60
mov esi, eax
add esp, 8
test esi, esi
jne 0x41051c
push eax
push edi
push str.pcxtopal_ban_nem_tudta_megnyitni_file_t_:
call fcn.004060d0
add esp, 0xc
jmp 0x4105f9
push 2
push 0xfffffcff
push esi
call fcn.004130d0
add esp, 0xc
test eax, eax
je 0x41054b
push 0
push edi
push str.Nem_tud_visszalepni_palettahoz_768_at_PCX_ben_:
call fcn.004060d0
push esi
call fcn.00412d70
add esp, 0x10
jmp 0x4105f9
push esi
push 1
lea eax, [ebp - 0x311]
push 1
push eax
call fcn.0041c50c
add esp, 0x10
cmp eax, 1
je 0x41057c
push 0
push edi
push 0x43a2dc
call fcn.004060d0
push esi
call fcn.00412d70
add esp, 0x10
jmp 0x4105f9
cmp byte [ebp - 0x311], 0xc
je 0x41059d
push 0
push edi
push str.Nem_0x0C_a_paletta_elotti_byte_PCX_ben_:
call fcn.004060d0
push esi
call fcn.00412d70
add esp, 0x10
jmp 0x4105f9
push esi
push 1
lea eax, [ebp - 0x310]
push 0x300
push eax
call fcn.0041c50c
add esp, 0x10
cmp eax, 1
je 0x4105d1
push 0
push edi
push str.Nem_tud_olvasni_PCX_ben_:
call fcn.004060d0
push esi
call fcn.00412d70
add esp, 0x10
jmp 0x4105f9
xor eax, eax
nop dword [eax]
nop word [eax + eax]
shr byte [ebp + eax - 0x310], 2
inc eax
cmp eax, 0x300
jl 0x4105e0
push esi
call fcn.00412d70
add esp, 4
push 4
call fcn.00419250
add esp, 4
mov dword [ebp - 0x318], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x410626
lea ecx, [ebp - 0x310]
push ecx
mov ecx, eax
call fcn.00405680
mov dword [ebx], eax
jmp 0x41062c
mov dword [ebx], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419297
mov esp, ebp
pop ebp
ret
Function at 0x4109c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push 0x438258
push ebx
mov dword [ebp - 4], edi
call fcn.00412e60
mov esi, eax
add esp, 8
test esi, esi
jne 0x4109fd
push eax
push ebx
push str.pic8_voxbeolvaso_nem_tudta_megnyitni_file_t_:
call fcn.004060d0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push 1
lea eax, [ebp + 0xb]
mov byte [ebp + 0xb], 0
push 1
push eax
call fcn.0041c50c
add esp, 0x10
cmp eax, 1
je 0x410a24
push 0
push ebx
push str.Nem_tudott_olvasni_file_bol_:
jmp 0x410b15
cmp byte [ebp + 0xb], 0xc
je 0x410a37
push 0
push ebx
push str.VOX_file_elso_karaktere_nem_0x0c_:
jmp 0x410b15
mov eax, dword [ebp - 4]
add edi, 0xa
push esi
add eax, 8
or ecx, 0xffffffff
push 1
push 2
push eax
mov word [edi], cx
mov dword [ebp - 8], eax
mov word [eax], cx
call fcn.0041c50c
add esp, 0x10
cmp eax, 1
jne 0x410b0d
push esi
push eax
push 2
push edi
call fcn.0041c50c
add esp, 0x10
cmp eax, 1
jne 0x410b0d
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
cmp cx, 1
jl 0x410b03
movzx eax, word [edi]
cmp ax, 1
jl 0x410b03
cwde
push eax
movsx eax, cx
mov ecx, dword [ebp - 4]
push eax
call fcn.0040f570
test eax, eax
jne 0x410ab2
push esi
call fcn.00412d70
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor edi, edi
cmp ax, word [ecx + 0xa]
jge 0x410ae7
nop
movsx eax, word [ecx + 8]
push esi
push 1
push eax
mov eax, dword [ecx + 0xc]
push dword [eax + edi*4]
call fcn.0041c50c
add esp, 0x10
cmp eax, 1
jne 0x410b0d
mov ecx, dword [ebp - 4]
inc edi
movsx eax, word [ecx + 0xa]
cmp edi, eax
jl 0x410ac0
push esi
call fcn.00412d70
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
mov dword [eax + 0x20], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push ebx
push str.Meretek_kicsik_VOX_file_ban_:
jmp 0x410b15
push 0
push ebx
push str.Nem_tudott_olvasni_VOX_file_bol_:
call fcn.004060d0
push esi
call fcn.00412d70
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4131b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0x448f14]
mov ebx, 0x17
mov esi, 0x2636
test edi, edi
jne 0x4131e0
push edi
push edi
push 0x43a7a0
call fcn.004060d0
mov edi, dword [0x448f14]
add esp, 0xc
mov dword [ebp - 4], 0x96
xor ecx, ecx
nop dword [eax]
xor byte [edi + ecx], bl
lea eax, [edi + ecx]
movsx eax, bx
inc ecx
cdq
mov ebx, 0xd3f
idiv ebx
imul eax, edx, 0xd3f
add esi, eax
mov eax, esi
shl eax, 5
sub eax, esi
add eax, ebx
movzx ebx, ax
cmp ecx, 0x18
jl 0x4131f0
add edi, 0x18
sub dword [ebp - 4], 1
jne 0x4131e7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4151d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0x1248
mov edi, ecx
push 0
push edi
call fcn.0041a450
push 0x16a8
lea eax, [edi + 0x1248]
push 0
push eax
call fcn.0041a450
movaps xmm0, xmmword [0x43b130]
lea ebx, [edi + 0x28f8]
mov eax, 1
mov dword [edi + 0x28f0], 0
push 0
push 0x446c88
mov dword [edi + 0x28f4], 0
mov word [ebx], ax
movups xmmword [edi + 0x2900], xmm0
mov dword [edi + 0x291a], 0x50504801
mov dword [edi + 0x291e], 0x39524d4b
mov word [edi + 0x2922], 0x2f14
call fcn.0042775e
add esp, 0x20
test eax, eax
jne 0x415454
push esi
push 0x438258
push 0x446c88
call fcn.0041f1c7
mov esi, eax
add esp, 8
test esi, esi
jne 0x41528a
push eax
push 0x446c88
push str.Nem_nyilik_state_file_:
call fcn.004060d0
add esp, 0xc
push esi
push 0x1248
push edi
call fcn.00415630
push esi
lea eax, [edi + 0x1248]
push 0x16a8
push eax
call fcn.00415630
push esi
lea eax, [edi + 0x28f0]
push 4
push eax
call fcn.00415630
push esi
lea eax, [edi + 0x28f4]
push 4
push eax
call fcn.00415630
push esi
push 2
push ebx
call fcn.00415630
add esp, 0x3c
cmp dword [0x445230], 0
jne 0x4152e9
cmp word [ebx], 2
jne 0x4152e9
mov eax, 1
mov word [ebx], ax
push esi
lea eax, [ebp - 4]
push 2
push eax
call fcn.00415630
movsx eax, word [ebp - 4]
push esi
push 2
movd xmm0, eax
lea eax, [ebp - 4]
cvtdq2pd xmm0, xmm0
push eax
mulsd xmm0, qword [0x43b128]
movsd qword [edi + 0x2900], xmm0
call fcn.00415630
movsx eax, word [ebp - 4]
push esi
push 0xa
movd xmm0, eax
lea eax, [edi + 0x2910]
cvtdq2pd xmm0, xmm0
push eax
mulsd xmm0, qword [0x43b128]
movsd qword [edi + 0x2908], xmm0
call fcn.00415630
push esi
lea eax, [edi + 0x291a]
push 1
push eax
call fcn.00415630
push esi
lea eax, [edi + 0x291b]
push 1
push eax
call fcn.00415630
push esi
lea eax, [edi + 0x291c]
push 1
push eax
call fcn.00415630
add esp, 0x48
lea eax, [edi + 0x291d]
push esi
push 1
push eax
call fcn.00415630
push esi
lea eax, [edi + 0x291e]
push 1
push eax
call fcn.00415630
push esi
lea eax, [edi + 0x291f]
push 1
push eax
call fcn.00415630
push esi
lea eax, [edi + 0x2920]
push 1
push eax
call fcn.00415630
push esi
lea eax, [edi + 0x2921]
push 1
push eax
call fcn.00415630
push esi
lea eax, [edi + 0x2922]
push 1
push eax
call fcn.00415630
add esp, 0x48
lea eax, [edi + 0x2923]
push esi
push 1
push eax
call fcn.00415630
push esi
push 4
mov dword [ebp - 8], 0
push 1
lea eax, [ebp - 8]
push eax
call fcn.0041c50c
add esp, 0x1c
cmp eax, 4
je 0x415415
push 0
push 0x446c88
push str.Nem_megy_beolvasas_state_file_ba_:
call fcn.004060d0
add esp, 0xc
cmp dword [0x447cec], 0
mov eax, dword [ebp - 8]
je 0x415429
cmp eax, dword [0x446c80]
jmp 0x415437
cmp eax, dword [0x446c80]
je 0x41544a
cmp eax, dword [0x446c84]
je 0x41544a
push 0
push 0
push str.Corrupt_STATE.DAT_file_
call fcn.00406360
add esp, 0xc
push esi
call fcn.0041f0e0
add esp, 4
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415630
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push 1
push ebx
call fcn.0041c50c
add esp, 0x10
cmp eax, edi
je 0x415660
push 0
push 0
push str.Nem_ment_olvasas_state_file_bol_
call fcn.004060d0
add esp, 0xc
xor esi, esi
mov edx, 0x17
mov ecx, 0x2636
test edi, edi
jle 0x4156a0
mov dword [ebp + 8], 0xd3f
xor byte [ebx + esi], dl
lea eax, [ebx + esi]
movsx eax, dx
inc esi
cdq
idiv dword [ebp + 8]
imul eax, edx, 0xd3f
add ecx, eax
mov eax, ecx
shl eax, 5
sub eax, ecx
add eax, 0xd3f
movzx edx, ax
cmp esi, edi
jl 0x415677
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4156b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x17
push esi
mov esi, dword [ebp + 0xc]
mov ecx, 0x2636
push edi
xor edi, edi
mov dword [ebp + 8], 0xd3f
test esi, esi
jle 0x4156fc
xor byte [ebx + edi], dl
lea eax, [ebx + edi]
movsx eax, dx
inc edi
cdq
idiv dword [ebp + 8]
imul eax, edx, 0xd3f
add ecx, eax
mov eax, ecx
shl eax, 5
sub eax, ecx
add eax, 0xd3f
movzx edx, ax
cmp edi, esi
jl 0x4156d3
push dword [ebp + 0x10]
push esi
push 1
push ebx
call fcn.0042026a
add esp, 0x10
cmp eax, esi
je 0x415720
push 0
push 0
push str.Nem_ment_iras_state_file_ba_
call fcn.004060d0
add esp, 0xc
xor edi, edi
mov edx, 0x17
mov ecx, 0x2636
test esi, esi
jle 0x415759
xor byte [ebx + edi], dl
lea eax, [ebx + edi]
movsx eax, dx
inc edi
cdq
idiv dword [ebp + 8]
imul eax, edx, 0xd3f
add ecx, eax
mov eax, ecx
shl eax, 5
sub eax, ecx
add eax, 0xd3f
movzx edx, ax
cmp edi, esi
jl 0x415730
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4180a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x438258
push dword [ebp + 8]
call fcn.0041f1c7
mov esi, eax
add esp, 8
test esi, esi
je 0x418113
push esi
push 1
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push 1
push eax
call fcn.0041c50c
add esp, 0x10
cmp eax, 1
jne 0x418113
push esi
push 4
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041c50c
add esp, 0x10
cmp eax, 4
jne 0x418113
push esi
push eax
lea eax, [ebp - 4]
push 1
push eax
call fcn.0041c50c
add esp, 0x10
cmp eax, 4
jne 0x418113
push esi
call fcn.0041f0e0
mov eax, dword [ebp - 4]
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418120
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x446d00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
call fcn.00405570
push eax
call fcn.00405520
add esp, 0x10
test eax, eax
jne 0x41821b
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x438258
push eax
call fcn.0041f1c7
mov esi, eax
add esp, 8
test esi, esi
jne 0x418181
lea eax, [esi + 1]
jmp 0x4181fa
push esi
push 1
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0
push 1
push eax
call fcn.0041c50c
add esp, 0x10
cmp eax, 1
je 0x4181ab
mov eax, 1
jmp 0x4181fa
push esi
push 4
lea eax, [ebp - 0x130]
push 1
push eax
call fcn.0041c50c
add esp, 0x10
cmp eax, 4
je 0x4181cb
mov eax, 1
jmp 0x4181fa
push esi
push 4
lea eax, [ebp - 0x130]
push 1
push eax
call fcn.0041c50c
add esp, 0x10
cmp eax, 4
je 0x4181eb
mov eax, 1
jmp 0x4181fa
push esi
call fcn.0041f0e0
mov eax, dword [ebp - 0x130]
add esp, 4
cmp eax, ebx
je 0x41823c
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x134]
call fcn.00405550
add esp, 8
test eax, eax
je 0x418162
push dword [ebp - 0x134]
call fcn.00405510
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419297
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x108]
mov eax, ecx
sub edi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x418246
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419297
mov esp, ebp
pop ebp
ret

Function at 0x418270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x438258
push str.lev_
push dword [ebp + 8]
call fcn.004053c0
add esp, 8
push eax
call fcn.0041f1c7
mov esi, eax
add esp, 8
test esi, esi
je 0x4182e1
push 1
push 0x29
push esi
call fcn.004255e6
add esp, 0xc
test eax, eax
jne 0x4182d8
push esi
push 0xf
push 1
push 0x449be4
call fcn.0041c50c
add esp, 0x10
cmp eax, 0xf
jne 0x4182d8
push esi
mov byte [0x449bf2], 0
call fcn.0041f0e0
add esp, 4
mov eax, 0x449be4
pop esi
pop ebp
ret
push esi
call fcn.0041f0e0
add esp, 4
xor eax, eax
pop esi
pop ebp
ret