joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bd80
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x530c8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x18], esi
call fcn.00439c20
xor ebx, ebx
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0x1e4], ebx
mov dword [esi + 0x1e8], ebx
mov dword [esi], 0x537860
mov ecx, dword [0x659a18]
push ecx
lea ebp, [esi + 0x1d0]
push 1
push 4
push ebp
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 0x1d4]
push edx
push 1
push 4
push eax
call edi
mov ecx, dword [0x659a18]
lea edx, [esi + 0x1d8]
push ecx
push 1
push 4
push edx
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 0x1dc]
push eax
push 1
push 4
push ecx
call edi
mov edx, dword [0x659a18]
add esp, 0x40
lea eax, [esi + 0x1e0]
push edx
push 1
push 4
push eax
call edi
mov ecx, dword [0x659a18]
lea edx, [esp + 0x3c]
push ecx
push 1
push 4
push edx
mov dword [esp + 0x4c], ebx
call edi
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x24
mov ecx, esi
push eax
call fcn.0043b300
mov ecx, dword [0x659a18]
lea edx, [esp + 0x10]
push ecx
push 1
push 4
push edx
mov dword [esp + 0x20], ebx
call edi
mov eax, dword [esp + 0x3c]
add esp, 0x10
cmp eax, ebx
je 0x45beb6
push 0x1c
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 1
je 0x45be9e
mov ecx, eax
call fcn.004399d0
jmp 0x45bea0
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x24], bl
push ecx
mov ecx, eax
mov dword [esi + 0x1e4], eax
call fcn.00439a00
mov edx, dword [0x659a3c]
mov eax, dword [ebp]
test edx, eax
je 0x45bef9
cmp dword [esp + 0x10], ebx
je 0x45bef9
push 0x10c
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov byte [esp + 0x24], 2
je 0x45bef1
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, eax
call fcn.0045b7e0
jmp 0x45bef3
xor eax, eax
mov dword [esi + 0x1e8], eax
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0xb8], 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x45d2c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
mov dword [esi], 0x537a30
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call edi
mov edx, dword [0x659a18]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 0x10
push esi
call ebp
mov eax, dword [esi + 8]
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call edi
push 0x1e4
call fcn.00470250
mov ebx, eax
add esp, 0x2c
test ebx, ebx
je 0x45d336
push 0x64
push 0x64
push 0
push 0
lea ecx, [esp + 0x20]
call fcn.004b4a60
push eax
mov ecx, ebx
call fcn.0043d120
jmp 0x45d338
xor eax, eax
mov edx, dword [esi + 0xc]
xor ebx, ebx
mov dword [esi + 8], eax
mov bx, word [eax + 0x1d0]
mov eax, dword [0x659a18]
push 0
push edx
push eax
call edi
lea ecx, [ebx*4]
push ecx
call fcn.00470b90
mov dword [esi + 0xc], eax
mov edx, dword [0x659a18]
push edx
push ebx
push 4
push eax
call ebp
add esp, 0x20
xor edi, edi
test ebx, ebx
jle 0x45d3ae
mov eax, dword [esi + 0xc]
push 0xc
mov ebp, dword [eax + edi*4]
call fcn.00470250
add esp, 4
test eax, eax
je 0x45d395
mov ecx, eax
call fcn.00479c30
jmp 0x45d397
xor eax, eax
mov ecx, dword [esi + 0xc]
push ebp
mov dword [ecx + edi*4], eax
mov edx, dword [esi + 0xc]
mov ecx, dword [edx + edi*4]
call fcn.00479c90
inc edi
cmp edi, ebx
jl 0x45d378
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x45da60
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x530deb
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push esi
mov esi, ecx
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
push edx
push 1
push 0x10
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 8]
add esp, 0x1c
test eax, eax
je 0x45db11
mov eax, dword [esi]
and eax, 0xf
dec eax
je 0x45daef
dec eax
je 0x45dad1
dec eax
jne 0x45db11
push 0x1c
call fcn.00470250
add esp, 4
test eax, eax
je 0x45db0c
mov ecx, dword [esi + 8]
push ecx
mov ecx, eax
call fcn.004ba9e0
jmp 0x45db0e
push 0x298
call fcn.00470250
add esp, 4
test eax, eax
je 0x45db0c
mov edx, dword [esi + 8]
mov ecx, eax
push edx
call fcn.004baf10
jmp 0x45db0e
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x45db0c
mov ecx, dword [esi + 8]
push 0
push ecx
mov ecx, eax
call fcn.004bac90
jmp 0x45db0e
xor eax, eax
mov dword [esi + 8], eax
test byte [esi], 0x40
je 0x45db6e
mov eax, dword [esi + 0xc]
test eax, eax
je 0x45db6e
push 0x10
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x45db57
mov edx, dword [esi + 0xc]
mov ecx, eax
push edx
call fcn.0045d2c0
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
xor eax, eax
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esp + 4]
mov dword [esi + 0xc], 0
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x45dc30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x80
mov eax, dword [esp + 0x84]
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push ebx
call ebp
mov eax, dword [0x659a18]
lea ecx, [ebx + 4]
push eax
push 1
push 2
push ecx
call ebp
mov edx, dword [0x659a18]
lea eax, [ebx + 6]
push edx
push 1
push 1
push eax
call ebp
mov ecx, dword [0x659a18]
lea edx, [ebx + 7]
push ecx
push 1
push 1
push edx
call ebp
mov ecx, dword [0x659a18]
add esp, 0x4c
lea eax, [ebx + 8]
push ecx
push 1
push 8
push eax
call ebp
mov edx, dword [0x659a18]
lea eax, [esp + 0x40]
push edx
push 1
push 0x60
push eax
call ebp
mov eax, dword [ebx]
mov edx, dword [0x659a38]
mov ecx, eax
mov edi, dword [0x659a34]
and ecx, edx
mov esi, dword [0x659a40]
mov dword [esp + 0x3c], ecx
mov ecx, dword [0x659a3c]
mov edx, eax
add esp, 0x20
and edx, ecx
mov ecx, eax
and ecx, edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov ecx, dword [0x659a48]
mov edx, eax
mov dword [esp + 0x18], 1
and edx, esi
and eax, ecx
mov dword [esp + 0x2c], eax
lea eax, [ebx + 0x110]
mov dword [esp + 0x28], edx
lea esi, [esp + 0x30]
lea edi, [esp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 6
cmp dword [edi], 0
je 0x45dd51
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x45dd49
push 1
push esi
mov ecx, eax
call fcn.00489020
jmp 0x45dd4b
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add edi, 4
add edx, 4
add esi, 0x10
dec eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
jne 0x45dd2a
mov eax, dword [ebx + 8]
test eax, eax
je 0x45dda7
mov edx, dword [0x659a18]
push 0
push eax
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [0x659a18]
lea esi, [ebx + 0x10]
push eax
push 1
push 0x80
push esi
call ebp
lea edi, [ebx + 0x90]
mov ecx, 0x20
add esp, 0x1c
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x45ddd8
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
add ebx, 0x90
push edx
push 1
push 0x80
push ebx
call ebp
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret 4
Function at 0x4602d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x530ec8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push ebp
push esi
mov esi, dword [esp + 0x64]
push edi
mov dword [esp + 0x18], ecx
movsx edi, word [esi + 6]
movsx ebp, word [esi + 2]
movsx ebx, word [esi + 4]
lea eax, [edi + ebp]
sub edi, ebp
cdq
sub eax, edx
mov ecx, eax
movsx eax, word [esi]
mov dword [esp + 0x10], eax
add eax, ebx
cdq
sub eax, edx
mov ebp, dword [esp + 0x10]
mov esi, eax
sub ebx, ebp
sar ecx, 1
sar esi, 1
inc edi
mov eax, edi
mov dword [esp + 0x14], edi
cdq
sub eax, edx
sar eax, 1
mov edi, eax
neg edi
movsx eax, di
movsx edx, cx
add eax, edx
inc ebx
movsx edx, si
mov word [esp + 0x68], dx
mov word [esp + 0x6a], ax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], eax
mov eax, ebx
cdq
sub eax, edx
mov ebp, eax
mov eax, dword [esp + 0x14]
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
movsx eax, bx
movsx edx, cx
add eax, edx
sar ebp, 1
mov dword [esp + 0x14], eax
movsx eax, bp
movsx edx, si
add eax, edx
mov word [esp + 0x68], ax
mov ax, word [esp + 0x14]
mov word [esp + 0x6a], ax
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], edx
cdq
sub eax, edx
sar eax, 1
neg eax
mov dword [esp + 0x10], eax
movsx eax, bx
movsx edx, cx
add eax, edx
mov dword [esp + 0x14], eax
movsx eax, word [esp + 0x10]
movsx edx, si
add eax, edx
mov word [esp + 0x68], ax
mov ax, word [esp + 0x14]
mov word [esp + 0x6a], ax
mov edx, dword [esp + 0x68]
mov dword [esp + 0x30], edx
movsx eax, di
movsx edx, cx
add eax, edx
mov dword [esp + 0x14], eax
movsx eax, word [esp + 0x10]
movsx edx, si
add eax, edx
mov word [esp + 0x68], ax
mov ax, word [esp + 0x14]
mov word [esp + 0x6a], ax
mov edx, dword [esp + 0x68]
mov dword [esp + 0x34], edx
movsx eax, di
movsx edx, cx
add eax, edx
movsx edx, bp
movsx edi, si
add edx, edi
mov word [esp + 0x6a], ax
mov word [esp + 0x68], dx
mov eax, dword [esp + 0x68]
mov dword [esp + 0x38], eax
movsx eax, bx
movsx ecx, cx
add eax, ecx
movsx ecx, si
mov word [esp + 0x68], cx
mov word [esp + 0x6a], ax
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0x40]
mov dword [esp + 0x3c], edx
call fcn.004b1f80
mov eax, dword [esp + 0x18]
mov edi, dword [0x659a34]
push 3
mov dword [esp + 0x64], 0
mov eax, dword [eax + 0x2f0]
and eax, edi
lea ecx, [eax + eax*2]
lea edx, [esp + ecx*4 + 0x2c]
lea ecx, [esp + 0x44]
push edx
call fcn.004b2040
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 0x1c]
push eax
push eax
push 1
call fcn.0041b380
mov ecx, dword [eax]
push 1
mov dword [0x67349c], ecx
mov edx, dword [eax + 4]
push 1
mov dword [0x6734a0], edx
mov eax, dword [eax + 8]
push 1
push 0
push 0
lea ecx, [esp + 0x30]
mov dword [0x6734a4], eax
call fcn.004b4a60
lea ecx, [esp + 0x44]
push eax
push ecx
mov ecx, 0x673490
call fcn.00496230
lea ecx, [esp + 0x40]
mov dword [esp + 0x60], 0xffffffff
call fcn.004b2330
mov ecx, dword [esp + 0x58]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 8
Function at 0x461c70
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 0
mov ecx, dword [0x659a18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
push edx
push 1
push 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esi + 8]
add esp, 0x1c
test eax, eax
je 0x461d1b
mov eax, dword [esi]
and eax, 0xf
dec eax
je 0x461cf4
dec eax
je 0x461cd1
dec eax
jne 0x461d1b
push 0x1c
call fcn.00470250
add esp, 4
test eax, eax
je 0x461d16
mov ecx, dword [esi + 8]
push ecx
mov ecx, eax
call fcn.004ba9e0
mov dword [esi + 8], eax
pop esi
ret 4
push 0x298
call fcn.00470250
add esp, 4
test eax, eax
je 0x461d16
mov edx, dword [esi + 8]
mov ecx, eax
push edx
call fcn.004baf10
mov dword [esi + 8], eax
pop esi
ret 4
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x461d16
mov ecx, dword [esi + 8]
push 0
push ecx
mov ecx, eax
call fcn.004bac90
mov dword [esi + 8], eax
pop esi
ret 4
xor eax, eax
mov dword [esi + 8], eax
pop esi
ret 4
Function at 0x463780
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x659a18]
push edi
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push esi
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 4]
push eax
push 1
push 4
push ecx
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 8]
push edx
push 1
push 0x10
push eax
call edi
mov ecx, dword [0x659a18]
lea ebx, [esi + 0x18]
push ecx
push 1
push 0x10
push ebx
call edi
add esp, 0x4c
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x463803
push 1
push ebx
mov ecx, eax
call fcn.00489020
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
pop edi
mov dword [esi + 0x28], eax
pop esi
pop ebx
ret 4
Function at 0x463a50
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x530fa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x3c]
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [0x659a18]
push ebx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push edi
call esi
mov eax, dword [0x659a18]
lea ecx, [edi + 4]
push eax
push 1
push 4
push ecx
call esi
mov edx, dword [0x659a18]
lea eax, [edi + 8]
push edx
push 1
push 4
push eax
call esi
mov ecx, dword [0x659a18]
lea edx, [esp + 0x54]
push ecx
push 1
push 0x10
push edx
call esi
mov eax, dword [0x659a18]
add esp, 0x4c
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], ebx
push eax
push 1
push 4
push ecx
call esi
mov edx, dword [0x659a18]
lea eax, [edi + 0x14]
push edx
push 1
push 0x10
push eax
call esi
mov ecx, dword [0x659a18]
lea edx, [esp + 0x2c]
push ecx
push 1
push 4
push edx
mov dword [esp + 0x3c], ebx
call esi
mov eax, dword [0x659a18]
lea ecx, [esp + 0x40]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x50], ebx
call esi
mov edx, dword [0x659a18]
add esp, 0x40
lea eax, [esp + 0x28]
push edx
push 1
push 0x10
push eax
call esi
mov ecx, dword [0x659a98]
add esp, 0x10
test dword [edi], ecx
je 0x463b6c
push 0x38
call sub.MFC42u.DLL_operatornew
add esp, 4
cmp eax, ebx
je 0x463b5b
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ebx
mov dword [eax + 0x34], ebx
jmp 0x463b5d
xor eax, eax
mov edx, dword [esp + 0xc]
mov ecx, eax
push edx
mov dword [edi + 0x24], eax
call fcn.00463780
mov eax, dword [0x659a9c]
mov ecx, dword [edi]
or esi, 0xffffffff
test eax, ecx
je 0x463bb0
push 0x150
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov dword [esp + 0x40], ebx
je 0x463ba7
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x10]
push ecx
push ebx
push edx
mov ecx, eax
call fcn.00415430
jmp 0x463ba9
xor eax, eax
mov dword [esp + 0x40], esi
mov dword [edi + 0x28], eax
cmp dword [esp + 0x48], ebx
je 0x463bee
push 0x1c
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x4c], eax
cmp eax, ebx
mov dword [esp + 0x40], 1
je 0x463bd9
mov ecx, eax
call fcn.004399d0
jmp 0x463bdb
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x40], esi
push ecx
mov ecx, eax
mov dword [edi + 0xc], eax
call fcn.00439a00
mov edx, dword [0x659a40]
mov eax, dword [edi]
test edx, eax
je 0x463c1d
push 0x24
call fcn.00470250
add esp, 4
cmp eax, ebx
je 0x463c18
lea ecx, [esp + 0x18]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x463c1a
xor eax, eax
mov dword [edi + 0x10], eax
mov edx, dword [0x659aa0]
mov eax, dword [edi]
test edx, eax
je 0x463c4c
push 0x24
call fcn.00470250
add esp, 4
cmp eax, ebx
je 0x463c47
lea ecx, [esp + 0x28]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x463c49
xor eax, eax
mov dword [edi + 0x2c], eax
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x4642e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x659a18]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
push ecx
call edi
mov edx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 0x1c
push esi
call ebx
mov eax, dword [esi + 0xc]
add esp, 0x1c
test eax, eax
je 0x4643af
cmp dword [0x659958], 0x1d
jl 0x46438d
mov eax, dword [esi]
shr eax, 8
and eax, 0xf
dec eax
je 0x464370
dec eax
je 0x464352
dec eax
jne 0x4643af
push 0x1c
call fcn.00470250
add esp, 4
test eax, eax
je 0x4643aa
mov ecx, dword [esi + 0xc]
push ecx
mov ecx, eax
call fcn.004ba9e0
jmp 0x4643ac
push 0x298
call fcn.00470250
add esp, 4
test eax, eax
je 0x4643aa
mov edx, dword [esi + 0xc]
mov ecx, eax
push edx
call fcn.004baf10
jmp 0x4643ac
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x4643aa
mov ecx, dword [esi + 0xc]
push 0
push ecx
mov ecx, eax
call fcn.004bac90
jmp 0x4643ac
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x4643aa
mov edx, dword [esi + 0xc]
push 0
push edx
mov ecx, eax
call fcn.004bac90
jmp 0x4643ac
xor eax, eax
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4643d6
push 0x58
call fcn.00470250
add esp, 4
test eax, eax
je 0x4643d1
mov ecx, dword [esi + 0x10]
push ecx
mov ecx, eax
call fcn.0043cbc0
jmp 0x4643d3
xor eax, eax
mov dword [esi + 0x10], eax
mov edx, dword [0x659a38]
mov eax, dword [esi]
test edx, eax
je 0x46442f
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46442f
push 0
push eax
mov eax, dword [0x659a18]
push eax
call edi
push 0x24
call sub.MFC42u.DLL_operatornew
mov edx, eax
add esp, 0x10
test edx, edx
je 0x464413
mov ecx, 9
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
jmp 0x464415
xor eax, eax
mov dword [esi + 0x14], eax
mov ecx, dword [0x659a18]
push ecx
push 1
push 0x24
push eax
call ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret 4
mov dword [esi + 0x14], 0
pop edi
pop esi
pop ebx
ret 4
Function at 0x4683f0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5310b9
push eax
mov eax, 0x100c
mov dword fs:[0], esp
call fcn.0051c710
mov eax, dword [esp + 0x101c]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x1c], esi
call fcn.00439c20
lea ebp, [esi + 0x1e0]
xor edi, edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi + 0x1e4], edi
mov dword [ebp], edi
mov dword [esi + 0x1e8], edi
mov dword [esi + 0x1ec], edi
mov dword [esi], 0x537cf0
mov ecx, dword [0x659a18]
lea eax, [esi + 0x1d0]
push ecx
push 1
push 4
push eax
mov dword [esp + 0x1034], edi
call ebx
mov edx, dword [0x659a18]
lea eax, [esi + 0x1d4]
push edx
push 1
push 0xc
push eax
call ebx
mov ecx, dword [0x659a18]
push ecx
push 1
push 4
push ebp
call ebx
mov edx, dword [0x659a18]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
mov edx, dword [ebp]
add esp, 0x34
cmp edx, edi
jle 0x4685be
mov dword [esp + 0x1c], edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [0x659a18]
lea ecx, [esp + 0x1c]
push eax
push edx
push 4
push ecx
call ebx
mov edx, dword [0x659a18]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
mov ecx, dword [esi + 0x1d0]
mov dword [esp + 0x28], eax
mov eax, dword [0x659a3c]
add esp, 0x14
test eax, ecx
jne 0x4684f5
cmp dword [ebp], 0
jle 0x4685ba
mov edi, dword [ebp]
lea ecx, [edi*8]
sub ecx, edi
shl ecx, 3
push ecx
call sub.MFC42u.DLL_operatornew
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov byte [esp + 0x1024], 1
je 0x468551
lea ebx, [edi - 1]
test ebx, ebx
jl 0x468553
lea edi, [eax + 0xa]
inc ebx
xor eax, eax
lea ecx, [edi + 0x22]
mov word [edi - 4], ax
mov word [edi - 6], ax
mov word [edi], 0xffff
mov word [edi - 2], 0xffff
call fcn.0041b350
add edi, 0x38
dec ebx
jne 0x468528
mov eax, dword [esp + 0x10]
jmp 0x468553
xor eax, eax
mov dword [esi + 0x1e4], eax
mov eax, dword [ebp]
xor edi, edi
mov byte [esp + 0x1024], 0
cmp eax, edi
jle 0x4685ba
mov dword [esp + 0x10], edi
lea ebx, [esp + 0x1c]
mov edx, dword [ebx]
mov eax, dword [0x659a18]
push 0
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
mov edx, dword [esi + 0x1e4]
push ecx
mov ecx, dword [esp + 0x20]
push 1
add edx, ecx
push 0x38
push edx
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esp + 0x2c]
mov eax, dword [ebp]
add esp, 0x1c
inc edi
add ebx, 4
add ecx, 0x38
cmp edi, eax
mov dword [esp + 0x10], ecx
jl 0x468572
mov eax, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.0043b300
test byte [esi + 0x1d0], 0xf
je 0x4685dd
mov eax, dword [esi + 8]
and ah, 0xfd
or ah, 1
mov dword [esi + 8], eax
jmp 0x4685e9
mov ecx, dword [esi + 8]
and ch, 0xfe
or ch, 2
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x101c]
mov dword [esi + 0xb8], 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1018
ret 4
Function at 0x468970
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
mov esi, ecx
push eax
call fcn.00439d00
lea eax, [esi + 0x1d0]
mov edx, 1
or ecx, 0xffffffff
mov word [eax], dx
mov word [eax + 2], dx
mov dword [eax + 4], edx
mov word [esi + 0x1da], 0
mov word [esi + 0x1d8], 0
mov word [esi + 0x1de], cx
mov word [esi + 0x1dc], cx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x1d8], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi], 0x537ddc
mov dword [esi + 0x1dc], ecx
mov ecx, dword [0x659a18]
push ecx
push edx
push 8
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov eax, esi
pop esi
ret 4

Function at 0x468fb0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5310f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.00468970
lea eax, [esi + 0x1e0]
lea edi, [esi + 0x1e4]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi], 0x537ed0
mov dword [eax], 0
mov dword [edi], 0
mov ecx, dword [0x659a18]
mov dword [esp + 0x1c], 0
push ecx
push 1
push 2
push eax
call ebp
mov edx, dword [0x659a18]
push edx
push 1
push 2
push edi
call ebp
mov ebx, dword [edi]
lea eax, [ebx*4]
push eax
call fcn.00470280
xor edx, edx
add esp, 0x24
cmp eax, edx
je 0x469051
dec ebx
mov ecx, eax
cmp ebx, edx
jl 0x469053
inc ebx
mov word [ecx], dx
mov word [ecx + 2], dx
add ecx, 4
dec ebx
jne 0x469042
jmp 0x469053
xor eax, eax
mov edx, dword [edi]
mov dword [esi + 0x1e8], eax
mov ecx, dword [0x659a18]
push ecx
push edx
push 4
push eax
call ebp
add esp, 0x10
mov ecx, esi
call fcn.0043a1b0
mov eax, dword [edi]
mov ecx, dword [esi + 0x1e8]
push eax
push ecx
mov ecx, esi
call fcn.00468cd0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4695d0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x531138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.00468970
lea edi, [esi + 0x1e0]
mov dword [esp + 0x18], 0
mov ecx, edi
call fcn.0041b350
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esi], 0x537fc0
mov ecx, dword [0x659a18]
push ecx
push 1
push 0xc
push edi
call ebx
mov edx, dword [0x659a18]
lea edi, [esi + 0x1ec]
push edx
push 1
push 4
push edi
call ebx
add esp, 0x20
mov ecx, esi
call fcn.0043a1b0
movsx eax, word [esi + 0x16]
movsx ecx, word [esi + 0x12]
movsx edx, word [esi + 0x10]
sub eax, ecx
movsx ecx, word [esi + 0x14]
sub ecx, edx
inc eax
inc ecx
cmp ecx, eax
jl 0x469662
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [edi]
cmp eax, edx
jle 0x469678
mov dword [edi], edx
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4