joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403358
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x403383
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x4033ca
lea eax, [ebp - 0x714]
push eax
call fcn.00401344
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.004012f9
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x4033d5
jmp 0x4033da
jmp fcn.00402cd6
cmp dword [ebp - 0x37c], 0
jne 0x403484
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
invalid
test dword [eax], ebx

Function at 0x403cb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403d1a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004031f4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040269c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403d04
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d21
lea eax, [ebp - 0x10]
call fcn.00403094
ret

Function at 0x4049d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x404ada
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x404a23
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403184
jmp 0x404ac1
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00404984
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.004049a4
mov ebx, eax
test esi, esi
je 0x404a4b
dec esi
test esi, esi
jl 0x404a4b
cmp edi, ebx
jne 0x404a2a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004031c4
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403464
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
cmp eax, 2
jl 0x404ac1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x404ac1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x404ac1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040320c
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403464
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ae1
lea eax, [ebp - 0x110]
call fcn.00403094
ret
Function at 0x404b9c
Capabilities:
Get file attributes

Disassembly:
call fcn.00404490
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x404bb0
dec eax
and al, 0x10
sete al
ret

Function at 0x404cf8
Capabilities:
Get file attributes

Disassembly:
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x404d07
dec eax
and al, 0x10
setne al
ret

Function at 0x404f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x404ffa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405001
lea eax, [ebp - 0x10c]
call fcn.00403094
ret

Function at 0x405008
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x405072
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031c4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404db8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405079
lea eax, [ebp - 0x10c]
call fcn.00403094
ret
Function at 0x405080
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
mov eax, dword [ebp - 8]
call fcn.004033fc
xor eax, eax
push ebp
push 0x4051db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403094
cmp dword [ebp - 4], 0
je 0x4050ee
mov eax, dword [ebp - 4]
call fcn.0040320c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4050ee
lea eax, [ebp - 4]
mov edx, 0x4051f0
call fcn.00403214
cmp dword [ebp - 8], 0
je 0x40511d
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x40511d
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00404728
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.0040312c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403258
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040340c
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
setne al
jmp 0x4051a6
test dword [ebp - 0x14c], 0x10
ja 0x405193
cmp dword [ebx], 0
je 0x405166
mov eax, ebx
mov edx, 0x4051fc
call fcn.00403214
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004031f4
push dword [ebp - 0x154]
mov eax, ebx
mov edx, 3
call fcn.004032cc
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405149
push esi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4051e2
lea eax, [ebp - 0x154]
mov edx, 2
call fcn.004030b8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004030b8
ret

Function at 0x406d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x9c], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406dfc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x97]
push eax
push 0x97
call sub.kernel32.dll_GetLogicalDriveStringsA
xor ebx, ebx
jmp 0x406dd5
mov esi, ebx
and esi, 0xff
lea eax, [ebp + esi - 0x97]
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 5
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x41
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x42
je 0x406dd2
lea eax, [ebp - 0x9c]
mov dl, byte [ebp + esi - 0x97]
call fcn.004031b4
mov edx, dword [ebp - 0x9c]
mov eax, edi
call fcn.00403214
add bl, 4
xor eax, eax
mov al, bl
cmp byte [ebp + eax - 0x97], 0
jne 0x406d79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e03
lea eax, [ebp - 0x9c]
call fcn.00403094
ret
Function at 0x4011e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x485e28]
push esi
mov esi, dword [ebp + 8]
push esi
push 1
mov dword [0x485e2c], eax
lea eax, [ebp - 0x20c]
push 4
push eax
mov dword [ebp - 0x20c], 0
call fcn.004369f9
mov eax, dword [ebp - 0x20c]
add esp, 0x10
test eax, eax
jne 0x40124f
push eax
push str.ERROR_
push str.ItemData_count___0_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424075
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 0x108
mul edx
push ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00423c85
imul ecx, dword [ebp - 0x20c], 0x108
mov ebx, eax
mov dword [ebp - 0x218], ebx
push ecx
push 0
push ebx
call fcn.00425630
imul ecx, dword [ebp - 0x20c], 0x108
push esi
push 1
push ecx
push ebx
call fcn.004369f9
push esi
push 1
lea eax, [ebp - 0x21c]
push 4
push eax
call fcn.004369f9
xor esi, esi
add esp, 0x30
mov dword [ebp - 0x210], esi
cmp dword [ebp - 0x20c], esi
jle 0x40138d
push edi
nop
push 0x108
push ebx
call fcn.004234c0
mov edi, dword [0x485e2c]
add esp, 8
cmp ebx, edi
jae 0x40132e
mov eax, dword [0x485e28]
cmp eax, ebx
ja 0x40132e
mov ecx, ebx
sub ecx, eax
mov eax, 0x3e0f83e1
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x214], eax
cmp edi, dword [0x485e30]
jne 0x40131c
push 1
mov ecx, 0x485e28
call fcn.00401bf0
mov edi, dword [0x485e2c]
mov eax, dword [ebp - 0x214]
test edi, edi
je 0x401361
imul esi, eax, 0x108
add esi, dword [0x485e28]
jmp 0x40134e
cmp edi, dword [0x485e30]
jne 0x401348
push 1
mov ecx, 0x485e28
call fcn.00401bf0
mov edi, dword [0x485e2c]
test edi, edi
je 0x401361
mov esi, ebx
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x485e2c]
mov esi, dword [ebp - 0x210]
inc esi
add edi, 0x108
add ebx, 0x108
mov dword [0x485e2c], edi
mov dword [ebp - 0x210], esi
cmp esi, dword [ebp - 0x20c]
jl 0x4012c0
mov ebx, dword [ebp - 0x218]
pop edi
push 0x108
push ebx
call fcn.00423c77
lea eax, [ebp - 0x208]
mov byte [ebp - 8], 0
push eax
call fcn.00404e40
add esp, 0xc
pop ebx
test eax, eax
jne 0x4013d6
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424075
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x208]
push 0x485e28
push eax
call fcn.00401930
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.00424075
mov esp, ebp
pop ebp
ret
Function at 0x4019f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
jne 0x401a1e
push 0
push str.ERROR_
push str.Empty_options_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0043649b
add esp, 0xc
test eax, eax
je 0x401a53
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 4]
mov eax, 0x3e0f83e1
sub ecx, dword [ebx]
imul ecx
xor ecx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, 0x108
mov dword [ebp + 0xc], eax
mul edx
push esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00423c85
imul ecx, dword [ebp + 0xc], 0x108
mov esi, eax
mov dword [ebp - 8], esi
push ecx
push 0
push esi
call fcn.00425630
mov edx, dword [ebx]
add esp, 0x10
cmp edx, dword [ebx + 4]
je 0x401ac4
mov eax, esi
push edi
mov esi, edx
mov edi, eax
mov ecx, 0x42
add edx, 0x108
rep movsd dword es:[edi], dword [esi]
add eax, 0x108
cmp edx, dword [ebx + 4]
jne 0x401aa5
mov esi, dword [ebp - 8]
pop edi
imul eax, dword [ebp + 0xc], 0x108
push 0xa4c6
push eax
push esi
call fcn.00422bb0
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
push 1
push 4
push eax
call fcn.00436e0a
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x108
push esi
call fcn.00436e0a
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push 1
push 4
push eax
call fcn.00436e0a
push 0x108
push esi
call fcn.00423c77
add esp, 0x44
push dword [ebp - 4]
call fcn.004365a5
add esp, 4
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ceeb
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
call fcn.00403de0
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0
call fcn.004040f0
push edi
push 1
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push 4
push eax
call fcn.004369f9
mov eax, dword [ebp - 0x220]
add esp, 0x10
test eax, eax
jne 0x4024db
push eax
push str.ERROR_
push str.ItemData_count___0_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4025c2
xor ecx, ecx
mov edx, 0x27c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00423c85
imul ecx, dword [ebp - 0x220], 0x27c
mov esi, eax
push ecx
push 0
push esi
call fcn.00425630
imul ecx, dword [ebp - 0x220], 0x27c
push edi
push 1
push ecx
push esi
call fcn.004369f9
push edi
push 1
lea eax, [ebp - 0x22c]
push 4
push eax
call fcn.004369f9
xor edi, edi
add esp, 0x30
cmp dword [ebp - 0x220], edi
jle 0x402579
nop dword [eax + eax]
push 0x27c
push esi
call fcn.004234c0
add esp, 8
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x21c]
push esi
push eax
call fcn.00402280
mov eax, dword [ebp - 0x228]
inc edi
mov dword [eax + 0x14], esi
add esi, 0x27c
cmp edi, dword [ebp - 0x220]
jl 0x402540
lea eax, [ebp - 0x214]
mov byte [ebp - 0x14], 0
push eax
call fcn.00404e40
add esp, 4
test eax, eax
jne 0x4025a9
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4025c2
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00403540
add esp, 0xc
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x21c]
push eax
push dword [eax]
lea eax, [ebp - 0x224]
push eax
call fcn.004041d0
push dword [ebp - 0x21c]
call fcn.00423c72
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424075
mov esp, ebp
pop ebp
ret
Function at 0x403a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
cmp eax, dword [ebx + 4]
je 0x403b5a
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.0043649b
add esp, 0xc
test eax, eax
je 0x403a7a
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 4]
mov eax, 0x19c2d14f
sub ecx, dword [ebx]
imul ecx
xor ecx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, 0x27c
mov dword [ebp - 4], eax
mul edx
push esi
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00423c85
mov edx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
xor eax, eax
cmp edx, dword [ebx + 4]
je 0x403aec
mov ebx, esi
nop
cmp eax, dword [ebp - 4]
jge 0x403b5f
mov esi, edx
mov edi, ebx
mov ecx, 0x9f
add edx, 0x27c
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
inc eax
add ebx, 0x27c
cmp edx, dword [ecx + 4]
jne 0x403ac0
mov esi, dword [ebp - 0xc]
imul eax, dword [ebp - 4], 0x27c
push 0xe2f1
push eax
push esi
call fcn.00422bb0
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push 1
push 4
push eax
call fcn.00436e0a
push dword [ebp - 8]
imul eax, dword [ebp - 4], 0x27c
push 1
push eax
push esi
call fcn.00436e0a
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push 1
push 4
push eax
call fcn.00436e0a
push dword [ebp - 8]
call fcn.004365a5
add esp, 0x40
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push str.ERROR_
push str.Error_in_itemdata_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4044f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x20
call fcn.00423c85
mov esi, eax
mov byte [ebp - 8], 0
lea eax, [ebp - 0x208]
push eax
call fcn.00404e40
add esp, 8
test eax, eax
jne 0x40454f
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424075
mov esp, ebp
pop ebp
ret
push ebx
push 0x46e280
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0043649b
push str.__Index_____AxisX__________AxisY__________Position_____RotateX________RotateY________RotateZ________Scale_r_n
push dword [ebp - 0x20c]
call fcn.00401d70
push edi
push 1
lea eax, [ebp - 0x210]
push 4
push eax
call fcn.004369f9
xor ebx, ebx
add esp, 0x24
cmp dword [ebp - 0x210], ebx
jbe 0x404648
nop word [eax + eax]
push edi
push 0x20
push 1
push esi
call fcn.004369f9
push 0x20
push esi
call fcn.004234c0
mov eax, dword [esi]
add esp, 0x18
cmp eax, 0x2000
ja 0x404648
movss xmm0, dword [esi + 0x1c]
sub esp, 0x38
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x30], xmm0
movss xmm0, dword [esi + 0x18]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x28], xmm0
movss xmm0, dword [esi + 0x14]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x20], xmm0
movss xmm0, dword [esi + 0x10]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
movss xmm0, dword [esi + 0xc]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esi + 8]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esi + 4]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push eax
push str._04d_________010.6f______010.6f______05.1f________010.6f______010.6f______010.6f______5.4f_r_n
push dword [ebp - 0x20c]
call fcn.00401d70
inc ebx
add esp, 0x44
cmp ebx, dword [ebp - 0x210]
jb 0x4045a0
push 0x46e258
push dword [ebp - 0x20c]
call fcn.00401d70
push dword [ebp - 0x20c]
call fcn.004365a5
push esi
call fcn.00424407
add esp, 0x10
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00424075
mov esp, ebp
pop ebp
ret
Function at 0x405000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46cf8b
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0xa8000
call fcn.00423c85
mov esi, eax
mov dword [ebp - 0x118], esi
push edi
push 1
push 0xa8000
push esi
mov dword [ebp - 4], 0
call fcn.004369f9
push edi
push 1
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.004369f9
add esp, 0x24
mov edi, esi
mov ebx, 0x2000
push 0x54
push edi
call fcn.004234c0
add esp, 8
add edi, 0x54
sub ebx, 1
jne 0x405073
lea eax, [ebp - 0x114]
push eax
call fcn.00404e40
add esp, 4
test eax, eax
jne 0x4050b2
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4050c8
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00405ec0
add esp, 8
test esi, esi
je 0x4050d5
push esi
call fcn.00424407
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424075
mov esp, ebp
pop ebp
ret

Function at 0x406090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4060b8
push esi
push str.ERROR_
push str.Error_on_processing_the_item_class
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret
push 0x46e280
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.0043649b
add esp, 0xc
test eax, eax
je 0x4060ed
push 0
push str.ERROR_
push str.Could_not_open_save_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret
push 0xe2f1
push 0xa8000
push dword [esi]
call fcn.00422bb0
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 1
push 0xa8000
push dword [esi]
call fcn.00436e0a
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push 1
push 4
push eax
call fcn.00436e0a
push dword [ebp + 0xc]
call fcn.004365a5
add esp, 0x30
push 0
push str.NOTICE_
push str.File_saved_successfully_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d08b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x485310]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
call fcn.00408f20
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 0
call fcn.00409390
push edi
push 1
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push 4
push eax
call fcn.004369f9
mov eax, dword [ebp - 0x220]
add esp, 0x10
test eax, eax
jne 0x40733b
push eax
push str.ERROR_
push str.ItemData_count___0_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407422
xor ecx, ecx
mov edx, 0x26c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00423c85
imul ecx, dword [ebp - 0x220], 0x26c
mov esi, eax
push ecx
push 0
push esi
call fcn.00425630
imul ecx, dword [ebp - 0x220], 0x26c
push edi
push 1
push ecx
push esi
call fcn.004369f9
push edi
push 1
lea eax, [ebp - 0x22c]
push 4
push eax
call fcn.004369f9
xor edi, edi
add esp, 0x30
cmp dword [ebp - 0x220], edi
jle 0x4073d9
nop dword [eax + eax]
push 0x26c
push esi
call fcn.004234c0
add esp, 8
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x21c]
push esi
push eax
call fcn.00406f70
mov eax, dword [ebp - 0x228]
inc edi
mov dword [eax + 0x14], esi
add esi, 0x26c
cmp edi, dword [ebp - 0x220]
jl 0x4073a0
lea eax, [ebp - 0x214]
mov byte [ebp - 0x14], 0
push eax
call fcn.00404e40
add esp, 4
test eax, eax
jne 0x407409
push eax
push str.ERROR_
push str.Failed_to_save_the_file_
push dword [0x48f0a0]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x407422
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00408360
add esp, 0xc
mov eax, dword [ebp - 0x21c]
lea ecx, [ebp - 0x21c]
push eax
push dword [eax]
lea eax, [ebp - 0x224]
push eax
call fcn.004094f0
push dword [ebp - 0x21c]
call fcn.00423c72
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424075
mov esp, ebp
pop ebp
ret