joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430b00
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 1
mov esi, ecx
push eax
call fcn.0042ff10
mov ecx, dword [esp + 0xc]
mov dword [esi], 0x54b3f0
mov edx, dword [0x67a8cc]
push 0
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push eax
push 1
lea ecx, [esp + 0x24]
push 4
push ecx
mov dword [esp + 0x2c], 0
call edi
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x24c]
push edx
push 1
push 4
push eax
call edi
mov ecx, dword [0x67a8cc]
lea edx, [esi + 0x250]
push ecx
push 1
push 4
push edx
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esi + 0x254]
push eax
push 1
push 4
push ecx
call edi
add esp, 0x4c
mov eax, esi
pop edi
pop esi
ret 8

Function at 0x430ec0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push esi
push edi
mov edi, ecx
push 0
push eax
lea esi, [edi + 4]
mov word [esi], 1
mov word [esi + 2], 1
mov dword [esi + 4], 1
mov ecx, dword [0x67a8cc]
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push edi
call ebx
mov eax, dword [0x67a8cc]
push eax
push 1
push 8
push esi
call ebx
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x38]
push ecx
push 1
push 0x20
push edx
call ebx
push 0x24
call fcn.004784b0
add esp, 0x40
test eax, eax
je 0x430f42
lea ecx, [esp + 0xc]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
jmp 0x430f44
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x1c]
lea edx, [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [edx + 8], eax
mov eax, edi
pop edi
pop esi
mov dword [edx + 0xc], ecx
pop ebx
add esp, 0x20
ret 4
Function at 0x431d30
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545c56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0041d450
lea eax, [esi + 0x1fc]
lea edi, [esi + 0x204]
xor ebx, ebx
or ebp, 0xffffffff
mov dword [eax], eax
mov dword [eax + 4], eax
lea ecx, [esi + 0x20c]
mov dword [esp + 0x1c], ebx
mov word [edi + 2], bx
mov word [edi], bx
mov word [edi + 6], bp
mov word [edi + 4], bp
call fcn.004bb6f0
mov dword [esi + 0x224], ebx
mov dword [esi + 0x228], ebx
mov dword [esi + 0x22c], ebx
mov dword [esi + 0x230], ebp
mov dword [esi + 0x234], ebx
mov dword [esi + 0x238], ebx
mov dword [esi + 0x23c], ebx
mov dword [esi + 0x240], ebx
mov word [esi + 0x246], bx
mov word [esi + 0x244], bx
mov word [esi + 0x24a], bp
mov word [esi + 0x248], bp
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x244], ecx
mov dword [esi + 0x24c], ebx
mov dword [esi + 0x250], ebx
mov dword [esi], 0x54b73c
mov dword [esi + 0x248], edx
mov eax, dword [0x67a7f0]
cmp eax, 0x19
mov byte [esp + 0x1c], 1
jge 0x431e48
push 0x24
call fcn.004784b0
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x431e3e
mov eax, dword [0x67a8cc]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, ebp
push eax
call fcn.00495d60
mov dword [esi + 0xec], eax
jmp 0x431e5c
xor eax, eax
mov dword [esi + 0xec], eax
jmp 0x431e5c
mov ecx, dword [0x67a8cc]
push 1
push 0x10
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov edx, dword [0x67a8cc]
push edx
push 1
push 8
push edi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [0x67a8d8]
add esp, 0x10
cmp eax, 0x18
jl 0x431e80
mov eax, 0x18
movsx ecx, word [edi + 2]
push ebx
push eax
movsx eax, word [edi + 6]
movsx edx, word [edi + 4]
sub eax, ecx
lea ecx, [esi + 0x20c]
inc eax
push eax
movsx eax, word [edi]
sub edx, eax
inc edx
push edx
call fcn.004bb810
mov ecx, dword [esi + 8]
mov eax, esi
and ecx, 0xfffffdfb
pop edi
or ecx, 0x901
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x433520
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x67a8cc]
sub esp, 0x10
push esi
push edi
mov esi, ecx
push eax
push 1
lea ecx, [esp + 0x10]
push 0x10
push ecx
xor edi, edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, esi
call fcn.004334a0
test eax, eax
je 0x43358f
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43357a
lea edx, [esp + 8]
push edi
push edx
mov ecx, eax
call fcn.00495db0
mov dword [esi + 0xcc], eax
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret 4
xor eax, eax
pop edi
mov dword [esi + 0xcc], eax
mov eax, 1
pop esi
add esp, 0x10
ret 4
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4393c0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545d88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x20], esi
call fcn.00431d30
lea eax, [esi + 0x254]
xor ebp, ebp
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esp + 0x28], ebp
mov dword [eax], ebp
mov dword [esi], 0x54b988
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 8
push eax
call edi
mov eax, dword [0x67a7f0]
add esp, 0x10
cmp eax, 0x16
jl 0x439438
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x228]
push edx
push 1
push 4
push eax
call edi
add esp, 0x10
mov ecx, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_ftell]
push ecx
call ebx
add esp, 4
mov ecx, esi
push eax
call fcn.0043e9b0
mov edx, dword [0x67a8cc]
push edx
call ebx
add esp, 4
mov ecx, esi
push eax
call fcn.0043ee20
cmp dword [0x67a7f0], 0x1a
jl 0x439576
mov ecx, dword [0x67a8cc]
lea eax, [esi + 0x22c]
push 0x10
push eax
push ecx
call ebx
add esp, 4
push eax
call fcn.0047a710
mov edx, dword [0x67a8cc]
push edx
call ebx
add esp, 0x10
mov ecx, esi
push eax
call fcn.00433520
mov eax, dword [0x67a8cc]
lea ecx, [esi + 0x23c]
push eax
push 1
push 4
push ecx
call edi
mov edx, dword [0x67a8cc]
lea eax, [esp + 0x28]
push edx
push 1
push 4
push eax
mov dword [esp + 0x38], ebp
call edi
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x34]
push ecx
push 1
push 4
push edx
mov dword [esp + 0x44], ebp
call edi
mov eax, dword [0x67a8cc]
lea ecx, [esp + 0x40]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x50], ebp
call edi
mov edx, dword [0x67a8cc]
add esp, 0x40
lea eax, [esp + 0x30]
mov dword [esp + 0x30], ebp
push edx
push 1
push 4
push eax
call edi
mov cl, byte [esi + 0x224]
mov al, 0x80
add esp, 0x10
test al, cl
jne 0x439526
test byte [esi + 0x228], al
je 0x439532
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, esi
call fcn.0041c180
mov eax, dword [esi + 0x224]
mov ecx, dword [0x67a924]
test ecx, eax
jne 0x43954a
test dword [esi + 0x228], ecx
je 0x439554
mov edx, dword [esp + 0x10]
mov dword [esi + 0x250], edx
mov ecx, dword [0x67a928]
test ecx, eax
jne 0x439566
test dword [esi + 0x228], ecx
je 0x439576
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x439576
push eax
mov ecx, esi
call fcn.0043e4a0
mov ecx, esi
call fcn.0043d3d0
mov ecx, eax
call fcn.004c9d30
mov dword [esi + 0x2dc], eax
mov ecx, 0x20
xor eax, eax
lea edi, [esi + 0x25c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x43a8f0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545da8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.00431d30
lea eax, [esi + 0x254]
xor ecx, ecx
lea ebp, [esi + 0x25c]
lea ebx, [esi + 0x260]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [eax], ecx
mov dword [esp + 0x1c], ecx
mov dword [ebp], ecx
mov dword [ebx], ecx
mov dword [esi + 0x268], ecx
mov dword [esi + 0x26c], ecx
mov dword [esi], 0x54baa4
mov ecx, dword [0x67a8cc]
push ecx
push 1
push 8
push eax
call edi
mov edx, dword [0x67a8cc]
push edx
push 1
push 2
push ebx
call edi
mov eax, dword [0x67a8cc]
push eax
push 1
push 2
push ebp
call edi
movsx eax, word [esi + 0x20a]
movsx ecx, word [esi + 0x206]
sub eax, ecx
add esp, 0x30
movsx ecx, word [esi + 0x258]
inc eax
cdq
idiv ecx
mov dword [esi + 0x264], eax
mov eax, dword [0x67a7f0]
cmp eax, 0x16
jl 0x43a9d4
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x228]
push edx
push 1
push 4
push eax
call edi
mov al, byte [esi + 0x22b]
add esp, 0x10
test al, al
je 0x43a9d4
and eax, 0xff
mov dword [esi + 0x264], eax
mov ecx, dword [0x67a8cc]
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, esi
push eax
call fcn.0043e9b0
mov edx, dword [0x67a8cc]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, esi
push eax
call fcn.0043ee20
cmp dword [0x67a7f0], 0x1a
jl 0x43aa5a
mov ecx, dword [0x67a8cc]
lea eax, [esi + 0x22c]
push 0x10
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
push eax
call fcn.0047a710
mov edx, dword [0x67a8cc]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x10
mov ecx, esi
push eax
call fcn.00433520
mov eax, dword [0x67a8cc]
lea ecx, [esi + 0x23c]
push eax
push 1
push 4
push ecx
call edi
add esp, 0x10
mov edx, dword [ebp]
imul edx, dword [ebx]
push edx
call fcn.00478e60
mov ecx, dword [ebp]
mov edi, eax
imul ecx, dword [ebx]
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x26c], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x43ca50
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x67a8cc]
push edi
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call ebx
mov eax, dword [0x67a8cc]
lea edi, [esi + 4]
push eax
push 1
push 0x10
push edi
call ebx
mov al, byte [esi]
add esp, 0x2c
test al, 3
je 0x43cabc
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43cab7
push 1
push edi
mov ecx, eax
call fcn.00495db0
mov dword [esi + 0x14], eax
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
mov dword [esi + 0x14], eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x43d240
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
mov ecx, dword [0x67a8cc]
xor eax, eax
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esp + 0x11], eax
push ecx
push 4
lea edx, [esp + 0x18]
mov word [esp + 0x1d], ax
push 1
push edx
mov byte [esp + 0x20], 0
mov byte [esp + 0x27], al
call edi
add esp, 0x10
mov esi, str.flag
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43d2a9
test cl, cl
je 0x43d2a5
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43d2a9
add eax, 2
add esi, 2
test cl, cl
jne 0x43d281
xor eax, eax
jmp 0x43d2ae
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43d32d
mov eax, dword [0x67a8cc]
lea esi, [ebp + 0x1a0]
push eax
push 1
push 4
push esi
call edi
mov ecx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_ftell]
push ecx
call edi
add esp, 0x14
mov ecx, ebp
push eax
call fcn.0043ede0
mov ecx, ebp
call fcn.0043f060
mov edx, dword [0x67a8e4]
mov eax, dword [esi]
test edx, eax
je 0x43d32d
push 0x24
call fcn.004784b0
mov esi, eax
add esp, 4
test esi, esi
je 0x43d325
mov eax, dword [0x67a8cc]
push 1
push eax
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.00495d60
pop edi
mov dword [ebp + 0x12c], eax
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor eax, eax
mov dword [ebp + 0x12c], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x43e4a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
test eax, eax
push esi
mov esi, ecx
je 0x43e51b
push 0
push eax
mov eax, dword [0x67a8cc]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x10]
push ecx
push 1
push 0x14
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x20]
add esp, 0x1c
mov dword [esi + 0x1a0], eax
mov ecx, dword [0x67a8e4]
test eax, ecx
je 0x43e51b
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43e513
lea ecx, [esp + 8]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
mov dword [esi + 0x12c], eax
pop esi
add esp, 0x14
ret 4
xor eax, eax
mov dword [esi + 0x12c], eax
pop esi
add esp, 0x14
ret 4

Function at 0x43e9b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x67a7f0]
push esi
cmp eax, 0x18
mov esi, ecx
jl 0x43e9f5
mov eax, dword [esp + 8]
mov ecx, dword [0x67a8cc]
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
add esi, 0x184
push edx
push 1
push 0x10
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4
Function at 0x43ea00
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x67a7f0]
push ebx
push esi
cmp eax, 0x19
push edi
mov esi, ecx
jl 0x43eae0
mov edi, dword [esp + 0x14]
mov eax, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push edi
push eax
mov dword [esp + 0x18], 0
call ebx
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x18]
push ecx
push 1
push 4
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x28]
add esp, 0x1c
test eax, eax
jle 0x43eae0
push 0x2c
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43ea72
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, eax
call fcn.004405a0
jmp 0x43ea74
xor eax, eax
mov dword [esi + 0x19c], eax
mov cl, byte [eax]
test cl, 1
je 0x43eaac
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43eaa4
mov edx, dword [esi + 0x19c]
push 0
add edx, 0xc
mov ecx, eax
push edx
call fcn.00495db0
jmp 0x43eaa6
xor eax, eax
mov dword [esi + 0xe4], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xa8]
test eax, eax
je 0x43eac2
mov eax, dword [esi + 8]
and al, 0xfb
mov dword [esi + 8], eax
mov ecx, dword [0x67a8cc]
add edi, 4
push 0
push edi
push ecx
call ebx
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4

Function at 0x43eaf0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x67a7f0]
push ebx
push esi
cmp eax, 0x19
push edi
mov esi, ecx
jl 0x43ebb5
mov edi, dword [esp + 0x14]
mov eax, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push edi
push eax
mov dword [esp + 0x18], 0
call ebx
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x18]
push ecx
push 1
push 4
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x28]
add esp, 0x1c
test eax, eax
jle 0x43ebb5
push 0x58
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43eb5e
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, eax
call fcn.004406b0
jmp 0x43eb60
xor eax, eax
mov dword [esi + 0x194], eax
mov cl, byte [eax]
test cl, 1
je 0x43eb98
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43eb90
mov edx, dword [esi + 0x194]
push 1
add edx, 0x10
mov ecx, eax
push edx
call fcn.00495db0
jmp 0x43eb92
xor eax, eax
mov dword [esi + 0xf4], eax
mov eax, dword [0x67a8cc]
add edi, 4
push 0
push edi
push eax
call ebx
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x43ebc0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x67a7f0]
push ebx
push esi
cmp eax, 0x19
push edi
mov esi, ecx
jl 0x43ec9d
mov edi, dword [esp + 0x14]
mov eax, dword [0x67a8cc]
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push edi
push eax
mov dword [esp + 0x18], 0
call ebx
mov ecx, dword [0x67a8cc]
lea edx, [esp + 0x18]
push ecx
push 1
push 4
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x28]
add esp, 0x1c
test eax, eax
jle 0x43ec9d
push 0x58
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43ec32
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, eax
call fcn.004406b0
jmp 0x43ec34
xor eax, eax
mov dword [esi + 0x198], eax
mov cl, byte [eax]
test cl, 1
je 0x43ec80
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43ec64
mov edx, dword [esi + 0x198]
push 1
add edx, 0x10
mov ecx, eax
push edx
call fcn.00495db0
jmp 0x43ec66
xor eax, eax
mov ecx, eax
mov dword [esi + 0xec], eax
call fcn.004c9e50
test al, al
je 0x43ec80
mov eax, dword [esi + 8]
or ah, 0x40
mov dword [esi + 8], eax
mov eax, dword [0x67a8cc]
add edi, 4
push 0
push edi
push eax
call ebx
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4

Function at 0x43ecb0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x67a7f0]
sub esp, 0x110
cmp eax, 0x19
push ebp
push esi
mov esi, ecx
jl 0x43edd0
mov eax, dword [esp + 0x11c]
mov ecx, dword [0x67a8cc]
xor ebp, ebp
push ebp
push eax
push ecx
mov dword [esp + 0x14], ebp
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
lea eax, [esp + 0x14]
push edx
push 1
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x24]
add esp, 0x1c
cmp eax, ebp
jle 0x43edd0
push ebx
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.00440b20
mov eax, dword [esp + 0x18]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0xe8]
mov edx, dword [esi]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x11c]
mov ecx, esi
push eax
call dword [edx + 0xe8]
mov dword [esp + 0x11c], eax
mov edi, 0x67a8e4
lea ebx, [esp + 0x1c]
add esi, 0xc8
cmp ebp, dword [esp + 0x14]
jae 0x43eda1
mov ecx, dword [esp + 0x18]
mov eax, dword [edi]
test ecx, eax
je 0x43ed93
push 0x24
call fcn.004784b0
add esp, 4
test eax, eax
je 0x43ed80
mov edx, ebx
push 1
push edx
mov ecx, eax
inc ebp
add ebx, 0x10
call fcn.00495db0
jmp 0x43ed82
xor eax, eax
mov edx, dword [esp + 0x11c]
mov dword [esi], eax
test dword [edi], edx
je 0x43ed93
or dword [eax + 0x20], 4
add edi, 4
add esi, 8
cmp edi, 0x67a924
jl 0x43ed50
mov eax, dword [esp + 0x124]
mov ecx, dword [0x67a8cc]
add eax, 4
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov eax, 1
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x110
ret 4
pop esi
xor eax, eax
pop ebp
add esp, 0x110
ret 4
Function at 0x4405a0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 0
mov ecx, dword [0x67a8cc]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
push edx
push 1
push 0x2c
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi]
add esp, 0x1c
test ah, 0x20
je 0x440629
test eax, 0x1000000
push 0x24
je 0x4405fc
call fcn.004784b0
add esp, 4
test eax, eax
je 0x44061e
mov ecx, dword [esi + 0x24]
push ecx
mov ecx, eax
call fcn.004cfd90
mov dword [esi + 0x24], eax
mov eax, esi
pop esi
ret 4
call fcn.004784b0
add esp, 4
test eax, eax
je 0x44061e
mov edx, dword [esi + 0x24]
push 0
push edx
mov ecx, eax
call fcn.004cfb10
mov dword [esi + 0x24], eax
mov eax, esi
pop esi
ret 4
xor eax, eax
mov dword [esi + 0x24], eax
mov eax, esi
pop esi
ret 4
mov dword [esi + 0x24], 0
mov eax, esi
pop esi
ret 4

Function at 0x4406b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
mov ecx, dword [0x67a8cc]
xor edi, edi
push edi
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
push edx
push 1
push 0x58
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi]
mov dword [esi + 0x54], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov eax, dword [0x67a924]
add esp, 0x1c
test eax, ecx
je 0x4407bb
cmp dword [esi + 0x28], edi
je 0x440748
push 0x58
call fcn.004784b0
add esp, 4
cmp eax, edi
je 0x440716
mov ecx, dword [esi + 0x28]
push ecx
mov ecx, eax
call fcn.004406b0
jmp 0x440718
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x54], edi
test byte [eax], 1
je 0x440748
push 0x24
call fcn.004784b0
add esp, 4
cmp eax, edi
je 0x440743
mov edx, dword [esi + 0x28]
push 1
add edx, 0x10
mov ecx, eax
push edx
call fcn.00495db0
jmp 0x440745
xor eax, eax
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov ecx, dword [0x67a930]
test eax, ecx
je 0x4407be
test dword [0x67a934], eax
je 0x44077e
push 0x24
call fcn.004784b0
add esp, 4
cmp eax, edi
je 0x440779
lea ecx, [esi + 0x2c]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
jmp 0x44077b
xor eax, eax
mov dword [esi + 0x4c], eax
mov edx, dword [0x67a938]
mov eax, dword [esi]
test edx, eax
je 0x4407be
push 0x24
call fcn.004784b0
add esp, 4
cmp eax, edi
je 0x4407af
lea ecx, [esi + 0x3c]
push 1
push ecx
mov ecx, eax
call fcn.00495db0
mov dword [esi + 0x50], eax
mov eax, esi
pop edi
pop esi
ret 4
xor eax, eax
pop edi
mov dword [esi + 0x50], eax
mov eax, esi
pop esi
ret 4
mov dword [esi + 0x28], edi
mov eax, esi
pop edi
pop esi
ret 4
Function at 0x440b20
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x67a8cc]
push edi
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x67a8cc]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call edi
mov eax, dword [0x67a8cc]
lea ebx, [esi + 4]
push eax
push 1
push 4
push ebx
call edi
mov ecx, dword [0x67a8cc]
mov edx, dword [esi]
push ecx
push edx
lea eax, [esi + 8]
push 0x10
push eax
call edi
mov ecx, dword [0x67a8cc]
add esi, 0x108
push ecx
push 1
push 4
push esi
call edi
mov edx, dword [0x67a960]
mov eax, dword [ebx]
add esp, 0x4c
test eax, edx
jne 0x440b98
mov dword [esi], 0
pop edi
pop esi
pop ebx
ret 4
Function at 0x4417c0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545f28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.00440c20
xor edi, edi
xor eax, eax
mov di, word [esi + 0x1d0]
mov dword [esp + 0x14], eax
mov dword [esi + 0x1e4], eax
mov dword [esi], 0x54c128
lea ecx, [edi*4]
push ecx
call fcn.00478e60
mov dword [esi + 0x1e4], eax
mov edx, dword [0x67a8cc]
push edx
push edi
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 0x1e4]
add esp, 0x14
mov ecx, dword [eax]
mov dword [esi + 0xbc], ecx
mov ecx, esi
call fcn.0043d3d0
mov ecx, eax
call fcn.004c9d30
push eax
mov ecx, esi
call fcn.0043d3d0
mov ecx, eax
call fcn.004c9eb0
mov edx, dword [esi + 8]
mov ecx, dword [esp + 0xc]
and dh, 0xfd
mov eax, esi
or dh, 1
pop edi
mov dword [esi + 8], edx
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4427e0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x545fe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.004417c0
lea ebx, [esi + 0x1e8]
xor ebp, ebp
mov dword [esi + 0x1ec], ebp
push 0x24
mov dword [ebx], ebp
mov dword [esi + 0x1f4], ebp
mov dword [esi + 0x1f8], ebp
mov dword [esp + 0x20], ebp
mov dword [esi], 0x54c410
call fcn.004784b0
mov edi, eax
add esp, 4
cmp edi, ebp
mov ebp, dword [sym.imp.MSVCRT.dll_ftell]
je 0x44285e
mov ecx, dword [0x67a8cc]
push 1
push ecx
call ebp
add esp, 4
mov ecx, edi
push eax
call fcn.00495d60
jmp 0x442860
xor eax, eax
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0xcc], eax
mov edx, dword [0x67a8cc]
push edx
push 1
push 2
push ebx
call edi
mov eax, dword [0x67a8cc]
push eax
call ebp
add esp, 0x14
mov ecx, esi
push eax
call fcn.0043e9b0
mov ecx, dword [0x67a8cc]
push ecx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0043ee20
cmp dword [0x67a7f0], 0x1a
jl 0x4428c1
mov edx, dword [0x67a8cc]
lea eax, [esi + 0x1ec]
push edx
push 1
push 4
push eax
call edi
add esp, 0x10
mov edi, dword [esi + 0xcc]
mov ecx, edi
call fcn.004c9d30
push eax
mov ecx, edi
call fcn.004c9eb0
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0xe9
jl 0x4428fc
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0xea
jle 0x442939
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0x102
je 0x442939
call fcn.00488f40
mov ecx, eax
call fcn.004752c0
cmp eax, 0x115
je 0x442939
push 1
push 0x2392
call fcn.00493e00
mov ecx, eax
call fcn.00490450
test eax, eax
je 0x442942
mov eax, dword [esi + 8]
or ah, 8
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4