joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4676e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
test ebx, ebx
jle 0x46772a
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp + 0xc]
push 3
push 1
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 3
jne 0x467731
mov eax, dword [ebp + 0xc]
mov byte [esi], al
mov al, byte [ebp + 0xe]
mov byte [esi + 1], ah
mov byte [esi + 2], al
add esi, 3
cmp word [ebp + 0x14], 0
je 0x467725
inc esi
inc edi
cmp edi, ebx
jl 0x4676f2
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 4
pop ebx
pop ebp
ret
Function at 0x468bd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
push 1
push 4
push esi
call fcn.00595b79
add esp, 0x10
cmp dword [esi], 0x53504238
je 0x468bfb
pop edi
mov eax, 2
pop esi
pop ebp
ret
push edi
call fcn.0045d240
add esp, 4
mov word [esi + 4], ax
cmp ax, 1
je 0x468c14
cmp ax, 2
jne 0x468bf2
push dword [edi]
lea eax, [esi + 6]
push 1
push 6
push eax
call fcn.00595b79
push edi
call fcn.0045d240
push edi
mov word [esi + 0xc], ax
call fcn.0045d070
push edi
mov dword [esi + 0x10], eax
call fcn.0045d070
push edi
mov dword [esi + 0x14], eax
call fcn.0045d240
push edi
mov word [esi + 0x18], ax
call fcn.0045d240
mov word [esi + 0x1a], ax
push dword [edi]
call fcn.00595867
add esp, 0x28
neg eax
sbb eax, eax
and eax, 4
pop edi
pop esi
pop ebp
ret

Function at 0x468c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call fcn.00597fff
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x468ca1
push dword [edi]
call fcn.00597fff
mov eax, dword [ebp + 0xc]
add esp, 4
pop edi
mov dword [eax], 2
xor eax, eax
pop ebx
pop ebp
ret
test bl, 1
jne 0x468ca7
inc ebx
push esi
lea eax, [ebx + 1]
push eax
push 1
call fcn.00592c0b
mov esi, eax
add esp, 8
test esi, esi
je 0x468cce
push dword [edi]
push 1
push ebx
push esi
call fcn.00595b79
add esp, 0x10
mov byte [esi + ebx], 0
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + 1]
mov dword [eax], ecx
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46a9b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
test esi, esi
jle 0x46a9cd
cmp dword [edi + 4], esi
je 0x46a9d0
pop edi
mov eax, 2
pop esi
pop ebp
ret
mov esi, dword [edi + 4]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push ebx
call fcn.0046a940
movzx eax, ax
add esp, 8
test ax, ax
jne 0x46aa05
push dword [edi]
push 1
push esi
push dword [ebx]
call fcn.00595b79
add esp, 0x10
test eax, eax
jne 0x46aa03
pop ebx
pop edi
mov eax, 4
pop esi
pop ebp
ret
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x46afb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
cmp eax, dword [ebp + 0x14]
jne 0x46b166
push dword [esi]
lea eax, [ebp - 0x170]
push 1
push 2
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x46b166
mov ax, word [ebp - 0x170]
mov ecx, dword [ebp + 0x18]
cmp al, cl
jne 0x46b166
shr ecx, 8
cmp ah, cl
jne 0x46b166
push 0x1f40
call fcn.00593e38
add esp, 4
mov dword [ebp - 0x174], eax
test eax, eax
jne 0x46b03d
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push dword [esi]
push 1
push 0x1f40
push eax
call fcn.00595b79
add esp, 0x10
test eax, eax
je 0x46b166
lea eax, [ebp - 0x16c]
push eax
call fcn.00457d90
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x86]
add esp, 4
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x46b071
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x15c], 0x140
push eax
push ebx
mov dword [ebp - 0x158], 0xc8
mov dword [ebp - 0x154], 0x10001
mov dword [ebp - 0x14c], 0x28
call fcn.00456000
movzx esi, ax
add esp, 8
test si, si
jne 0x46b145
push edi
xor edi, edi
cmp dword [ebp - 0x158], edi
jle 0x46b135
lea ecx, [ecx]
mov eax, edi
mov esi, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
lea eax, [eax + eax*4]
shl eax, 6
and esi, 0x80000007
jns 0x46b0f0
dec esi
or esi, 0xfffffff8
inc esi
add eax, dword [ebp - 0x174]
add esi, eax
xor eax, eax
lea ebx, [ebx]
mov ecx, dword [ebp - 0x160]
lea esi, [esi + 8]
mov dl, byte [esi - 8]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x28
jl 0x46b100
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.004585b0
movzx esi, ax
add esp, 0x10
test si, si
jne 0x46b135
inc edi
cmp edi, dword [ebp - 0x158]
jl 0x46b0d0
push 0
push 0
push 0
push ebx
call fcn.00453f80
add esp, 0x10
pop edi
push dword [ebp - 0x174]
call fcn.00592c4b
add esp, 4
mov ax, si
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x46c790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
test edi, edi
jle 0x46c7f3
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp + 0x13]
push 1
push 1
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
jne 0x46c7ec
mov al, byte [ebp + 0x13]
test al, al
cbw
jns 0x46c7f6
neg ax
movzx ecx, ax
movsx eax, cx
sub edi, eax
jns 0x46c7d4
add ecx, edi
mov eax, dword [ebp + 8]
movsx esi, cx
push dword [eax]
push 1
push esi
push ebx
call fcn.00595b79
add esp, 0x10
test eax, eax
jne 0x46c829
pop esi
mov eax, 4
pop ebx
pop edi
pop ebp
ret
inc ax
movzx esi, ax
movsx eax, si
sub edi, eax
jns 0x46c804
add esi, edi
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00597fff
movzx eax, ax
add esp, 4
cmp ax, 0xffff
je 0x46c7ec
movsx esi, si
push esi
cwde
push eax
push ebx
call fcn.00595760
add esp, 0xc
add ebx, esi
test edi, edi
jg 0x46c7a2
pop esi
pop ebx
xor eax, eax
pop edi
pop ebp
ret

Function at 0x46c980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor eax, eax
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
cmp dword [ebp + 0x18], eax
jle 0x46ca8e
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 1]
push 1
push 1
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
jne 0x46ca89
mov al, byte [ebp - 1]
test al, al
cbw
jns 0x46ca26
neg ax
movzx ebx, ax
test bx, bx
jle 0x46ca14
push dword [ebp + 8]
dec ebx
call fcn.0045d210
mov word [edi], ax
inc esi
add esp, 4
add edi, 2
cmp esi, dword [ebp + 0x14]
jl 0x46ca0f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
mov dword [ebp - 0x10], eax
test ax, ax
jne 0x46ca14
mov edi, dword [ebp + 0x10]
xor esi, esi
inc dword [ebp - 8]
test bx, bx
jg 0x46c9d3
mov ebx, dword [ebp - 8]
cmp ebx, dword [ebp + 0x18]
jl 0x46c9a1
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
inc ax
movzx eax, ax
mov dword [ebp - 0xc], eax
call fcn.0045d210
movzx ecx, ax
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
test ax, ax
jle 0x46ca17
dec eax
mov word [edi], cx
inc esi
mov dword [ebp - 0xc], eax
add edi, 2
cmp esi, dword [ebp + 0x14]
jl 0x46ca7f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
mov dword [ebp - 0x10], eax
test ax, ax
jne 0x46ca84
mov edi, dword [ebp + 0x10]
xor esi, esi
mov eax, dword [ebp - 0xc]
inc ebx
mov ecx, dword [ebp - 0x14]
test ax, ax
jg 0x46ca47
mov dword [ebp - 8], ebx
jmp 0x46ca17
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46caa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
lea eax, [eax + eax*2]
add eax, 3
cdq
and edx, 3
add eax, edx
push edi
and eax, 0xfffffffc
xor edi, edi
mov dword [ebp - 8], eax
cmp dword [ebp + 0x18], ebx
jle 0x46cbd5
mov edi, edi
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp + 0x17]
push 1
push 1
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
jne 0x46cbdf
mov al, byte [ebp + 0x17]
test al, al
cbw
jns 0x46cb54
neg ax
movzx eax, ax
test ax, ax
jle 0x46cbcc
dec eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push dword [eax]
push 1
push 3
push esi
call fcn.00595b79
add esi, 3
add esp, 0x10
mov eax, esi
sub eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jl 0x46cb4a
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.004585b0
movzx ebx, ax
add esp, 0x10
test bx, bx
jne 0x46cbcc
mov esi, dword [ebp + 0x10]
inc edi
mov eax, dword [ebp - 0xc]
test ax, ax
jg 0x46cb06
jmp 0x46cbcc
inc ax
movzx eax, ax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 4]
push 1
push 3
push eax
call fcn.00595b79
mov eax, dword [ebp - 0xc]
add esp, 0x10
test ax, ax
jle 0x46cbcc
mov ecx, dword [ebp - 8]
lea esp, [esp]
dec eax
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp - 4]
mov byte [esi], al
movzx eax, byte [ebp - 3]
mov byte [esi + 1], al
movzx eax, byte [ebp - 2]
mov byte [esi + 2], al
add esi, 3
mov eax, esi
sub eax, dword [ebp + 0x10]
cmp eax, ecx
jl 0x46cbc4
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.004585b0
movzx ebx, ax
add esp, 0x10
test bx, bx
jne 0x46cbcc
mov esi, dword [ebp + 0x10]
inc edi
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
test ax, ax
jg 0x46cb80
cmp edi, dword [ebp + 0x18]
jl 0x46cad0
pop edi
pop esi
mov ax, bx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46cd50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push dword [edi]
push 1
push 4
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
jne 0x46cdec
mov eax, dword [ebp + 8]
cmp al, 0x52
jne 0x46cdec
cmp ah, 0x49
jne 0x46cdec
cmp byte [ebp + 0xa], 0x58
jne 0x46cdec
cmp byte [ebp + 0xb], 0x33
jne 0x46cdec
push esi
push edi
call fcn.0045d210
mov esi, dword [ebp + 0xc]
movzx eax, ax
push edi
mov dword [esi], eax
call fcn.0045d210
movzx ecx, ax
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [esi]
pop esi
test eax, eax
jle 0x46cdec
cmp eax, 0x3e80
jg 0x46cdec
test ecx, ecx
jle 0x46cdec
cmp ecx, 0x3e80
jg 0x46cdec
push dword [edi]
call fcn.00597fff
mov ecx, dword [ebp + 0x14]
mov byte [ecx], al
push dword [edi]
call fcn.00597fff
mov ecx, dword [ebp + 0x18]
mov byte [ecx], al
push dword [edi]
call fcn.00595867
add esp, 0xc
neg eax
sbb eax, eax
and eax, 4
pop edi
pop ebp
ret
mov eax, 2
pop edi
pop ebp
ret
Function at 0x46e110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0045d210
add esp, 4
cmp dword [ebp + 0x10], 0
jl 0x46e1c3
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
push dword [edi]
lea eax, [ebp - 1]
push 1
push 1
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
jne 0x46e1cc
mov al, byte [ebp - 1]
test al, al
je 0x46e1c3
movzx edi, al
and edi, 0x7f
test al, al
mov eax, dword [ebp + 8]
push dword [eax]
push 1
jns 0x46e18e
lea eax, [ebp - 1]
push 1
push eax
call fcn.00595b79
mov al, byte [ebp - 1]
add esp, 0x10
cmp al, byte [ebx]
jbe 0x46e17d
mov byte [ebx], al
test edi, edi
jle 0x46e1b0
mov ecx, edi
mov byte [esi], al
inc esi
dec ecx
je 0x46e1b0
mov al, byte [ebp - 1]
jmp 0x46e183
push edi
push esi
call fcn.00595b79
add esp, 0x10
xor eax, eax
test edi, edi
jle 0x46e1ae
mov edi, edi
mov cl, byte [eax + esi]
cmp cl, byte [ebx]
jbe 0x46e1a9
mov byte [ebx], cl
inc eax
cmp eax, edi
jl 0x46e1a0
add esi, edi
mov eax, dword [ebp + 0x10]
sub eax, edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0x10], eax
test eax, eax
jns 0x46e133
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e720
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0045d210
mov ecx, 0x1234
add esp, 4
cmp ax, cx
je 0x46e742
mov eax, 2
pop edi
pop ebp
ret
push ebx
push esi
push edi
call fcn.0045d210
movzx ecx, ax
mov eax, dword [ebp + 0xc]
push edi
mov dword [eax], ecx
call fcn.0045d210
movzx ecx, ax
mov eax, dword [ebp + 0x10]
push edi
mov dword [eax], ecx
call fcn.0045d210
push edi
call fcn.0045d210
push dword [edi]
call fcn.00597fff
mov edx, dword [ebp + 0x14]
add esp, 0x14
movzx ecx, al
mov esi, 1
movzx eax, al
dec eax
mov word [edx], cx
mov ecx, dword [ebp + 0x18]
mov word [ecx], si
cmp eax, 0x30
ja case.0x46e7a1.10
movzx eax, byte [eax + 0x46e930]
lea ebx, [esi + 1]
jmp dword [eax*4 + 0x46e908]
mov word [edx], si
mov word [ecx], si
jmp 0x46e80e
mov word [edx], bx
mov word [ecx], si
jmp 0x46e80e
mov eax, 4
mov word [edx], ax
mov word [ecx], si
jmp 0x46e80e
mov word [edx], si
mov word [ecx], bx
jmp 0x46e80e
mov word [edx], si
mov eax, 4
jmp 0x46e80b
mov eax, 8
mov word [edx], ax
mov word [ecx], si
jmp 0x46e80e
mov eax, 0x10
mov word [edx], ax
mov word [ecx], si
jmp 0x46e80e
mov eax, 0x18
mov word [edx], ax
mov word [ecx], si
jmp 0x46e80e
mov eax, 8
mov word [edx], ax
mov eax, 3
mov word [ecx], ax
push dword [edi]
call fcn.00597fff
push dword [edi]
call fcn.00597fff
push edi
call fcn.0045d210
mov ecx, dword [ebp + 0x20]
add esp, 0xc
mov word [ecx], ax
test ax, ax
js 0x46e8f3
cmp ax, 5
jg 0x46e8f3
push edi
call fcn.0045d210
movzx eax, ax
add esp, 4
test ax, ax
je 0x46e8dd
push dword [edi]
movsx esi, ax
push 1
push esi
push dword [ebp + 0x1c]
call fcn.00595b79
mov eax, 0x55555556
add esp, 0x10
imul esi
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
test ebx, ebx
jle 0x46e8dd
mov esi, dword [ebp + 0x1c]
add esi, 2
mov edi, edi
movzx eax, byte [esi - 2]
lea esi, [esi + 3]
imul ecx, eax, 0xff
mov eax, 0x4104105
mul ecx
movzx eax, byte [esi - 4]
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov byte [esi - 5], cl
imul ecx, eax, 0xff
mov eax, 0x4104105
mul ecx
movzx eax, byte [esi - 3]
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov byte [esi - 4], cl
imul ecx, eax, 0xff
mov eax, 0x4104105
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov byte [esi - 3], cl
dec ebx
jne 0x46e880
push dword [edi]
call fcn.00595867
add esp, 4
neg eax
sbb eax, eax
and eax, 4
pop esi
pop ebx
pop edi
pop ebp
ret
pop esi
mov ax, bx
pop ebx
pop edi
pop ebp
ret
pop esi
pop ebx
mov eax, 2
pop edi
pop ebp
ret
Function at 0x46ead0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push dword [esi]
push 1
push 6
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
jne 0x46eb4e
lea eax, [ebp - 0xc]
cmp dword [eax], 0x32572642
jne 0x46eb4e
cmp word [eax + 4], 0x3635
jne 0x46eb4e
push esi
call fcn.0045d240
movzx eax, ax
push esi
mov dword [edi], eax
call fcn.0045d240
movzx eax, ax
mov dword [ebx], eax
push dword [esi]
call fcn.00595867
add esp, 0xc
neg eax
sbb eax, eax
and eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret

Function at 0x46ed60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
test ebx, ebx
jle 0x46eddb
lea ecx, [ecx]
mov edi, dword [ebp + 8]
push dword [edi]
call fcn.00597fff
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x46ede2
push dword [edi]
test esi, esi
je 0x46eda0
mov edi, dword [ebp + 0xc]
push 1
push esi
push edi
call fcn.00595b79
add esp, 0x10
add edi, esi
mov dword [ebp + 0xc], edi
jmp 0x46edd5
call fcn.00597fff
push dword [edi]
mov esi, eax
mov dword [ebp + 0x10], esi
call fcn.00597fff
add esp, 8
test esi, esi
jle 0x46edd5
mov edi, dword [ebp + 0xc]
mov ecx, esi
movzx eax, al
imul eax, eax, 0x1010101
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
add dword [ebp + 0xc], esi
rep stosb byte es:[edi], al
sub ebx, esi
test ebx, ebx
jg 0x46ed70
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 4
pop ebx
pop ebp
ret

Function at 0x46f590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push dword [esi]
push 1
push 0xa
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
jne 0x46f65d
lea eax, [ebp - 0x18]
cmp dword [eax], 0x414c4143
jne 0x46f65d
cmp dword [eax + 4], 0x4353554d
jne 0x46f65d
cmp word [eax + 8], 0x4752
jne 0x46f65d
push dword [esi]
push 1
push 0xa
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
jne 0x46f65d
push esi
call fcn.0045d070
push esi
mov dword [edi], eax
call fcn.0045d070
push esi
mov dword [ebx], eax
call fcn.0045d070
push dword [esi]
call fcn.00597fff
mov ecx, dword [ebp - 0x1c]
mov word [ecx], ax
lea eax, [ebp - 0x18]
push dword [esi]
push 1
push 9
push eax
call fcn.00595b79
add esp, 0x20
cmp eax, 1
jne 0x46f65d
push dword [esi]
call fcn.00595867
add esp, 4
neg eax
sbb eax, eax
and eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x46f680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
xor ecx, ecx
add eax, 0xf
mov dword [ebp - 4], ecx
shr eax, 3
push ebx
mov ebx, dword [ebp + 0x10]
and eax, 0x1ffffffe
push esi
mov esi, eax
mov dword [ebp - 8], ebx
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x18], ecx
je 0x46f79b
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call fcn.00597fff
add esp, 4
test al, al
movzx eax, al
jns 0x46f731
push dword [edi]
and eax, 0x7f
inc eax
mov dword [ebp + 0x10], eax
call fcn.00597fff
movzx ecx, al
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edi, edi
cmp eax, esi
mov edi, esi
cmovl edi, eax
push edi
push ecx
push ebx
call fcn.00595760
mov eax, dword [ebp + 0x10]
add esp, 0xc
sub eax, edi
add ebx, edi
mov dword [ebp + 0x10], eax
sub esi, edi
jne 0x46f728
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
mov dword [ebp - 4], eax
test ax, ax
jne 0x46f78a
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
dec dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
test eax, eax
jne 0x46f6e0
jmp 0x46f787
inc eax
mov dword [ebp + 0x10], eax
cmp eax, esi
mov edi, esi
cmovl edi, eax
mov eax, dword [ebp + 8]
push dword [eax]
push 1
push edi
push ebx
call fcn.00595b79
mov eax, dword [ebp + 0x10]
add esp, 0x10
sub eax, edi
add ebx, edi
mov dword [ebp + 0x10], eax
sub esi, edi
jne 0x46f783
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.004585b0
movzx eax, ax
add esp, 0x10
mov dword [ebp - 4], eax
test ax, ax
jne 0x46f78a
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
dec dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x46f735
mov eax, dword [ebp - 4]
cmp dword [ebp + 0x18], 0
jne 0x46f6b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov ax, cx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46f9a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x641a90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push dword [ebx]
push 1
push 8
push eax
call fcn.00595b79
add esp, 0x10
cmp eax, 1
je 0x46f9eb
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
cmp dword [eax], 0x50485048
jne 0x46f9d7
cmp dword [eax + 4], 0x432d3934
jne 0x46f9d7
push esi
push edi
push dword [ebx]
call fcn.00597fff
push dword [ebx]
movzx eax, al
mov edi, eax
shr eax, 4
and edi, 0xf
shl edi, 4
or edi, eax
call fcn.00597fff
push dword [ebx]
movzx esi, al
call fcn.00597fff
mov ecx, esi
shl edi, 0xc
and ecx, 0xf
and eax, 0xf
shl ecx, 8
add esp, 0xc
or ecx, esi
and ecx, 0xfffffff0
or eax, ecx
or eax, edi
cmp eax, 0xc2a20
jne 0x46fa7a
push dword [ebx]
call fcn.00597fff
push dword [ebx]
call fcn.00597fff
push dword [ebx]
lea eax, [ebp - 0x18]
push 1
push 4
push eax
call fcn.00595b79
add esp, 0x18
cmp eax, 1
jne 0x46fa7a
lea eax, [ebp - 0x18]
cmp dword [eax], 0x36315247
je 0x46fa90
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005920c1
mov esp, ebp
pop ebp
ret
push dword [ebx]
call fcn.00597fff
mov esi, dword [ebp - 0x1c]
movzx ecx, al
mov eax, ecx
shr ecx, 4
and eax, 0xf
shl eax, 4
or eax, ecx
mov dword [esi], eax
push dword [ebx]
call fcn.00597fff
movzx ecx, al
mov eax, ecx
shr ecx, 4
and eax, 0xf
or eax, dword [esi]
shl eax, 4
or eax, ecx
mov dword [esi], eax
push dword [ebx]
call fcn.00597fff
movzx edi, al
mov eax, dword [ebp - 0x1c]
mov esi, edi
and esi, 0xf
and edi, 0xf0
mov eax, dword [eax]
shl eax, 8
or esi, eax
mov edx, esi
mov eax, esi
and edx, 0xf
and eax, 0xf0
shl edx, 8
mov ecx, esi
or edx, eax
sar ecx, 8
mov eax, esi
shl edx, 8
and eax, 0xf000
and ecx, 0xf00
or ecx, eax
and esi, 0xf00
mov eax, dword [ebp - 0x1c]
sar ecx, 8
or edx, ecx
or edx, esi
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
push dword [ebx]
call fcn.00597fff
mov edi, dword [ebp - 0x20]
movzx ecx, al
mov eax, ecx
shr ecx, 4
and eax, 0xf
or eax, dword [edi]
shl eax, 4
or eax, ecx
mov dword [edi], eax
push dword [ebx]
call fcn.00597fff
movzx ecx, al
add esp, 0x14
mov eax, dword [edi]
mov esi, ecx
and esi, 0xf
shl eax, 4
or esi, eax
shr ecx, 4
shl esi, 4
or esi, ecx
mov edx, esi
mov eax, esi
and edx, 0xf
and eax, 0xf0
shl edx, 8
or edx, eax
shl edx, 8
mov ecx, esi
mov eax, esi
sar ecx, 8
and eax, 0xf000
and ecx, 0xf00
and esi, 0xf00
or ecx, eax
xor eax, eax
sar ecx, 8
or edx, ecx
mov ecx, dword [ebp - 4]
or edx, esi
xor ecx, ebp
mov dword [edi], edx
pop edi
pop esi
pop ebx
call fcn.005920c1
mov esp, ebp
pop ebp
ret
Function at 0x4708c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0045d030
mov edi, dword [ebp + 0xc]
add esp, 4
mov dword [edi], eax
cmp eax, 0xe880
je 0x4708e6
pop edi
mov eax, 2
pop esi
pop ebp
ret
push esi
call fcn.0045d210
mov word [edi + 4], ax
lea eax, [edi + 6]
push dword [esi]
push 1
push 0xf6
push eax
call fcn.00595b79
push esi
call fcn.0045d030
mov dword [edi + 0xfc], eax
lea eax, [edi + 0x100]
push dword [esi]
push 1
push 0xa0
push eax
call fcn.00595b79
push esi
call fcn.0045d210
push esi
mov word [edi + 0x1a0], ax
call fcn.0045d210
push esi
mov word [edi + 0x1a2], ax
call fcn.0045d210
push esi
mov word [edi + 0x1a4], ax
call fcn.0045d210
push esi
mov word [edi + 0x1a6], ax
call fcn.0045d210
push esi
mov word [edi + 0x1a8], ax
call fcn.0045d210
add esp, 0x40
mov word [edi + 0x1aa], ax
push esi
call fcn.0045d210
push esi
mov word [edi + 0x1ac], ax
call fcn.0045d210
push esi
mov word [edi + 0x1ae], ax
call fcn.0045d210
push esi
mov word [edi + 0x1b0], ax
call fcn.0045d210
mov word [edi + 0x1b2], ax
lea eax, [edi + 0x1b4]
push dword [esi]
push 1
push 0xc
push eax
call fcn.00595b79
push esi
call fcn.0045d030
mov word [edi + 0x1c0], ax
lea eax, [edi + 0x1c2]
push dword [esi]
push 1
push 0x3c
push eax
call fcn.00595b79
push esi
call fcn.0045d030
push esi
mov dword [edi + 0x200], eax
call fcn.0045d030
mov word [edi + 0x204], ax
push dword [esi]
call fcn.00595867
add esp, 0x40
neg eax
sbb eax, eax
and eax, 4
pop edi
pop esi
pop ebp
ret