joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f1b0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52fa08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0041d850
lea edi, [esi + 0x1fc]
xor ebp, ebp
push 0x24
mov dword [esp + 0x20], ebp
mov dword [edi], ebp
mov dword [esi + 0x204], ebp
mov dword [esi + 0x208], ebp
mov dword [esi], 0x533084
call fcn.00470250
mov ebx, eax
add esp, 4
cmp ebx, ebp
mov ebp, dword [sym.imp.MSVCRT.dll_ftell]
je 0x41f228
mov ecx, dword [0x659a18]
push 1
push ecx
call ebp
add esp, 4
mov ecx, ebx
push eax
call fcn.00488fd0
jmp 0x41f22a
xor eax, eax
mov dword [esi + 0xcc], eax
mov edx, dword [0x659a18]
push edx
push 1
push 2
push edi
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [0x659a18]
push eax
call ebp
add esp, 0x14
mov ecx, esi
push eax
call fcn.0043aef0
mov ecx, dword [0x659a18]
push ecx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0043b340
mov edx, dword [esi + 8]
mov eax, dword [edi]
and dh, 0xfd
or dh, 1
cmp eax, 2
mov dword [esi + 8], edx
je 0x41f286
mov eax, dword [esi + 0xcc]
and dword [eax + 0x20], 0xfffffffe
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xe9
jl 0x41f2ac
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xea
jle 0x41f2e9
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x102
je 0x41f2e9
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x115
je 0x41f2e9
push 1
push 0x2392
call fcn.00487160
mov ecx, eax
call fcn.00483920
test eax, eax
je 0x41f2f2
mov eax, dword [esi + 8]
or ah, 8
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x41f870
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52fa28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0041d850
lea eax, [esi + 0x1fc]
xor ebx, ebx
lea ebp, [esi + 0x220]
mov dword [esi + 0x200], ebx
mov dword [eax], ebx
mov dword [esi + 0x214], ebx
mov dword [esi + 0x218], ebx
mov dword [esi + 0x21c], ebx
mov dword [ebp], ebx
mov dword [esi + 0x228], ebx
mov dword [esi + 0x22c], ebx
mov ecx, dword [esi + 0xc4]
mov dword [esi], 0x53316c
mov edi, dword [sym.imp.MSVCRT.dll_fread]
mov edx, dword [ecx + 0x20]
mov dword [esp + 0x1c], ebx
and edx, 0xfffffffe
mov dword [ecx + 0x20], edx
mov ecx, dword [0x659a18]
push ecx
push 1
push 2
push eax
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 0x200]
push edx
push 1
push 2
push eax
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 0x204]
push eax
push 4
push 4
push ecx
call edi
mov edx, dword [0x659a18]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x34
mov ecx, esi
push eax
call fcn.0043aef0
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, esi
push eax
call fcn.0043b340
cmp dword [0x659958], 0x1a
jl 0x41f9db
mov ecx, dword [0x659a18]
push ecx
push 1
push 4
push ebp
call edi
mov al, byte [ebp]
add esp, 0x10
test al, 1
je 0x41f9b1
push 0x24
call fcn.00470250
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x41f9a7
mov edx, dword [0x659a18]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, ebp
push eax
call fcn.00488fd0
mov dword [esi + 0x12c], eax
jmp 0x41f9c4
xor eax, eax
mov dword [esi + 0x12c], eax
jmp 0x41f9c4
mov eax, dword [0x659a18]
push 1
push 0x10
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov ecx, dword [0x659a18]
lea edx, [esi + 0x230]
push ecx
push 1
push 4
push edx
call edi
add esp, 0x10
mov eax, dword [esi + 0x200]
dec eax
cmp eax, 6
ja case.default.0x41f9e7
jmp dword [eax*4 + 0x41faec]
mov eax, 0x102
jmp 0x41fa1d
mov eax, 0x103
jmp 0x41fa1d
mov eax, 0x105
jmp 0x41fa1d
mov eax, 0x106
jmp 0x41fa1d
mov eax, 0xc9
jmp 0x41fa1d
mov eax, 0xca
jmp 0x41fa1d
mov eax, 0xcb
push eax
mov eax, dword [esi + 0x18]
push 2
push esi
push eax
call fcn.004757a0
add esp, 0x10
mov ecx, esi
call fcn.0043a330
mov ecx, eax
call fcn.004b53f0
push eax
mov ecx, esi
call fcn.0043a330
mov ecx, eax
call fcn.004b5570
mov eax, dword [esi + 8]
test ah, 3
jne 0x41fa58
or ah, 3
mov dword [esi + 8], eax
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xe9
jl 0x41fa7e
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xea
jle 0x41fabb
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x102
je 0x41fabb
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x115
je 0x41fabb
push 1
push 0x2392
call fcn.00487160
mov ecx, eax
call fcn.00483920
test eax, eax
je 0x41fad4
mov eax, dword [esi + 0x200]
cmp eax, 1
jl 0x41facb
cmp eax, 7
jle 0x41fad4
mov eax, dword [esi + 8]
or ah, 8
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x420070
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52fa48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0041d850
mov eax, dword [esi + 0xc4]
mov dword [esi], 0x533254
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov dword [esp + 0x1c], 0
mov edi, dword [eax + 0x20]
and edi, 0xfffffffe
mov dword [eax + 0x20], edi
mov ecx, dword [0x659a18]
push ecx
lea edi, [esi + 0x1fc]
push 1
push 4
push edi
call ebp
mov edx, dword [0x659a18]
lea ebx, [esi + 0x200]
push edx
push 1
push 4
push ebx
call ebp
mov eax, dword [0x659a18]
mov ebp, dword [sym.imp.MSVCRT.dll_ftell]
push eax
call ebp
add esp, 0x24
mov ecx, esi
push eax
call fcn.0043aef0
mov ecx, dword [0x659a18]
push ecx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0043b340
cmp dword [edi], 0x511
jne 0x420127
mov edx, dword [ebx]
mov ecx, dword [esi + 0x18]
push edx
call fcn.004cacf0
jmp 0x420193
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xe9
jl 0x42014d
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xea
jle 0x42018a
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x102
je 0x42018a
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x115
je 0x42018a
push 1
push 0x2392
call fcn.00487160
mov ecx, eax
call fcn.00483920
test eax, eax
je 0x420193
mov eax, dword [esi + 8]
or ah, 8
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test ah, 3
jne 0x4201a1
or ah, 3
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4212b0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52fa88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.0041d850
lea edi, [esi + 0x1fc]
lea ebx, [esi + 0x200]
mov ecx, esi
mov dword [esp + 0x18], 0
mov dword [edi], 0
mov dword [ebx], 0
mov dword [esi + 0x208], 0xffffffff
call fcn.0043a330
mov edx, dword [eax]
lea ecx, [esi + 0x20c]
mov dword [esi + 0x20c], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [esi], 0x53333c
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0xc4]
mov ecx, dword [eax + 0x20]
and ecx, 0xfffffffe
mov dword [eax + 0x20], ecx
mov ecx, esi
call fcn.0043a330
mov cl, byte [eax + 5]
cmp cl, 0xff
je 0x421358
cmp cl, 0xfd
je 0x421358
cmp cl, 0xfb
jne 0x42135c
mov byte [eax + 3], 2
mov ecx, dword [0x659a18]
push ecx
push 1
push 1
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
call edi
mov edx, dword [0x659a18]
push edx
push 1
push 1
push ebx
call edi
mov eax, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_ftell]
push eax
call edi
add esp, 0x24
mov ecx, esi
push eax
call fcn.0043aef0
mov ecx, dword [0x659a18]
push ecx
call edi
add esp, 4
mov ecx, esi
push eax
call fcn.0043b340
mov eax, dword [esi + 8]
test ah, 3
jne 0x4213b9
or ah, 3
mov dword [esi + 8], eax
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xe9
jl 0x4213df
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0xea
jle 0x42141c
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x102
je 0x42141c
call fcn.0047de30
mov ecx, eax
call fcn.0047e5d0
cmp eax, 0x115
je 0x42141c
push 1
push 0x2392
call fcn.00487160
mov ecx, eax
call fcn.00483920
test eax, eax
je 0x421425
mov eax, dword [esi + 8]
or ah, 8
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x421960
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52faa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0041d850
mov eax, dword [esi + 0xc4]
mov dword [esi], 0x533424
lea ebx, [esi + 0x1fc]
mov dword [esp + 0x1c], 0
mov edi, dword [eax + 0x20]
and edi, 0xfffffffe
mov dword [eax + 0x20], edi
mov ecx, dword [0x659a18]
push ecx
push 1
push 4
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
push 0x24
call fcn.00470250
mov ebp, dword [sym.imp.MSVCRT.dll_ftell]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4219ed
mov edx, dword [0x659a18]
push 0
push edx
call ebp
add esp, 4
mov ecx, edi
push eax
call fcn.00488fd0
jmp 0x4219ef
xor eax, eax
mov dword [esi + 0xcc], eax
mov al, byte [ebx]
test al, 0x70
je 0x421a32
push 0x24
call fcn.00470250
mov edi, eax
add esp, 4
test edi, edi
je 0x421a28
mov eax, dword [0x659a18]
push 1
push eax
call ebp
add esp, 4
mov ecx, edi
push eax
call fcn.00488fd0
mov dword [esi + 0x12c], eax
jmp 0x421a46
xor eax, eax
mov dword [esi + 0x12c], eax
jmp 0x421a46
mov ecx, dword [0x659a18]
push 1
push 0x10
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
test byte [ebx], 0xc
jne 0x421a61
mov edx, dword [0x659a18]
push 1
push 0x10
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
jmp 0x421a90
push 0x24
call fcn.00470250
mov edi, eax
add esp, 4
test edi, edi
je 0x421a88
mov eax, dword [0x659a18]
push 1
push eax
call ebp
add esp, 4
mov ecx, edi
push eax
call fcn.00488fd0
jmp 0x421a8a
xor eax, eax
mov dword [esi + 0x114], eax
mov ecx, dword [0x659a18]
push ecx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0043aef0
mov edx, dword [0x659a18]
push edx
call ebp
add esp, 4
mov ecx, esi
push eax
call fcn.0043b340
mov eax, dword [esi + 8]
test ah, 3
jne 0x421ac6
or ah, 3
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x421db0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x40
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push 1
push 4
push edi
call esi
mov eax, dword [0x659a18]
lea ecx, [esp + 0x28]
push eax
push 1
push 0x10
push ecx
call esi
mov edx, dword [0x659a18]
lea eax, [edi + 8]
push edx
push 1
push 4
push eax
call esi
mov ecx, dword [0x659a18]
lea edx, [edi + 0xc]
push ecx
push 1
push 4
push edx
call esi
mov eax, dword [0x659a18]
add esp, 0x4c
lea ecx, [edi + 0x10]
push eax
push 1
push 4
push ecx
call esi
mov edx, dword [0x659a18]
lea eax, [edi + 0x14]
push edx
push 1
push 4
push eax
call esi
mov ecx, dword [0x659a18]
lea edx, [edi + 0x18]
push ecx
push 1
push 4
push edx
call esi
mov eax, dword [0x659958]
add esp, 0x30
cmp eax, 0x1c
jl 0x421f18
mov eax, dword [0x659a18]
lea ebx, [edi + 0x1c]
push eax
push 1
push 4
push ebx
call esi
mov ecx, dword [0x659a18]
lea edx, [esp + 0x2c]
push ecx
push 1
push 0x30
push edx
call esi
mov eax, dword [0x659958]
add esp, 0x20
cmp eax, 0x1d
jl 0x421f18
mov eax, dword [0x659a54]
mov ecx, dword [ebx]
test eax, ecx
je 0x421eba
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x421eb5
lea ecx, [esp + 0x1c]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x421eb7
xor eax, eax
mov dword [edi + 0x20], eax
mov edx, dword [0x659a64]
mov eax, dword [ebx]
test edx, eax
je 0x421ee9
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x421ee4
lea ecx, [esp + 0x2c]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x421ee6
xor eax, eax
mov dword [edi + 0x24], eax
mov edx, dword [0x659a68]
mov eax, dword [ebx]
test edx, eax
je 0x421f18
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x421f13
lea ecx, [esp + 0x3c]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x421f15
xor eax, eax
mov dword [edi + 0x28], eax
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x421f40
lea edx, [esp + 0xc]
push 0
push edx
mov ecx, eax
call fcn.00489020
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
xor eax, eax
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
Function at 0x422350
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52facb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
mov eax, dword [esp + 0x418]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x18], esi
call fcn.0041d850
mov eax, dword [esi + 0xc4]
xor ebp, ebp
mov dword [esi + 0x204], ebp
mov dword [esi], 0x53350c
mov edi, dword [eax + 0x20]
mov ecx, 0xff
and edi, 0xfffffffe
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
mov dword [eax + 0x20], edi
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], ebp
rep stosd dword es:[edi], eax
mov ecx, dword [0x659a18]
lea edx, [esi + 0x1fc]
push ecx
push 1
push 4
push edx
mov dword [esp + 0x430], ebp
call ebx
mov eax, dword [0x659a18]
lea edi, [esi + 0x200]
push eax
push 1
push 4
push edi
call ebx
mov ecx, dword [0x659a18]
mov edx, dword [edi]
push ecx
push edx
lea eax, [esp + 0x40]
push 4
push eax
call ebx
mov ecx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_ftell]
push ecx
call ebx
add esp, 0x34
mov ecx, esi
push eax
call fcn.0043aef0
mov edx, dword [0x659a18]
push edx
call ebx
add esp, 4
mov ecx, esi
push eax
call fcn.0043b340
mov ebx, dword [edi]
lea eax, [ebx + ebx*4]
lea ecx, [ebx + eax*2]
lea edx, [ecx*4 + 4]
push edx
call fcn.00470280
add esp, 4
cmp eax, ebp
je 0x42245f
push 0x422300
push 0x41a940
lea ebp, [eax + 4]
push ebx
push 0x2c
push ebp
mov dword [eax], ebx
call fcn.0051c73f
mov eax, ebp
xor ebp, ebp
jmp 0x422461
xor eax, eax
mov dword [esi + 0x204], eax
mov eax, dword [edi]
xor ebx, ebx
cmp eax, ebp
jle 0x4224a1
mov dword [esp + 0x10], ebp
lea ebp, [esp + 0x18]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x204]
push eax
add ecx, edx
call fcn.00421db0
mov ecx, dword [esp + 0x10]
mov eax, dword [edi]
inc ebx
add ebp, 4
add ecx, 0x2c
cmp ebx, eax
mov dword [esp + 0x10], ecx
jl 0x422477
mov eax, dword [esi + 8]
test ah, 3
jne 0x4224af
or ah, 3
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x418]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x414
ret 4
Function at 0x422730
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52fb16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov esi, ecx
push ebp
mov dword [esp + 0x14], esi
call fcn.00439c20
xor edi, edi
push 0x5c4888
lea ecx, [esi + 0x1e0]
mov dword [esp + 0x20], edi
mov dword [esi + 0x1d4], edi
call fcn.004a5ac0
mov eax, dword [esi + 0xc4]
mov ebx, 1
push 0x24
push eax
mov byte [esp + 0x24], bl
mov dword [esi + 0x1f4], edi
mov dword [esi + 0x1f8], edi
mov dword [esi], 0x533654
call fcn.00470260
mov dword [esi + 0xc4], edi
mov ecx, dword [0x659a18]
add ebp, 8
push edi
push ebp
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push ebx
lea eax, [esi + 0x1d0]
push 4
push eax
call edi
add esp, 0x24
cmp word [esi + 0x1d2], bx
jae 0x4227e3
mov word [esi + 0x1d2], bx
cmp byte [esi + 0x1d1], bl
jae 0x4227f1
mov byte [esi + 0x1d1], bl
mov ecx, dword [0x659a18]
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, esi
push eax
call fcn.0043b300
cmp dword [0x659958], 0x19
jl 0x42283b
mov edx, dword [0x659a18]
lea eax, [esi + 0x1d8]
push edx
push ebx
push 4
push eax
call edi
mov ecx, dword [0x659a18]
lea edx, [esi + 0x1dc]
push ecx
push ebx
push 4
push edx
call edi
add esp, 0x20
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xb8], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x422db0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52fb68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.00439c20
lea ebp, [esi + 0x1e0]
xor ebx, ebx
lea edi, [esi + 0x1e4]
mov dword [esi + 0x1d4], ebx
mov word [ebp], bx
push 0x24
mov dword [edi], ebx
mov ecx, dword [esi + 0xc4]
push ecx
mov dword [esp + 0x24], ebx
mov dword [esi], 0x53373c
call fcn.00470260
mov dword [esi + 0xc4], ebx
mov edx, dword [0x659a18]
mov ebx, 1
push edx
push ebx
push 4
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 0x1d0]
push eax
push ebx
push 4
push ecx
call edi
add esp, 0x28
cmp word [esi + 0x1d2], bx
jae 0x422e4f
mov word [esi + 0x1d2], bx
cmp byte [esi + 0x1d1], bl
jae 0x422e5d
mov byte [esi + 0x1d1], bl
mov edx, dword [0x659a18]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, esi
push eax
call fcn.0043b300
cmp dword [0x659958], 0x19
jl 0x422eb3
mov eax, dword [0x659a18]
lea ecx, [esi + 0x1d8]
push eax
push ebx
push 4
push ecx
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 0x1dc]
push edx
push ebx
push 4
push eax
call edi
mov ecx, dword [0x659a18]
push ecx
push ebx
push 2
push ebp
call edi
add esp, 0x30
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xb8], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x423620
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x52fba8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.00439c20
xor eax, eax
mov ebx, 1
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1dc], eax
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1e4], ebx
mov dword [esi + 0x1e8], ebx
mov dword [esi + 0x1ec], ebx
mov dword [esi], 0x533824
mov ecx, dword [0x659a18]
push ebx
push 4
push ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push edx
push ebx
lea eax, [esi + 0x1d0]
push 2
push eax
call edi
mov ecx, dword [0x659a18]
lea edx, [esi + 0x1d2]
push ecx
push ebx
push 2
push edx
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 0x1d4]
push eax
push ebx
push 4
push ecx
call edi
mov edx, dword [0x659a18]
push edx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x40
mov ecx, esi
push eax
call fcn.0043b300
cmp dword [0x659958], 0x19
jl 0x423715
mov eax, dword [0x659a18]
lea ecx, [esi + 0x1f0]
push eax
push ebx
push 4
push ecx
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 0x1f4]
push edx
push ebx
push 4
push eax
call edi
add esp, 0x20
mov ecx, dword [esi + 8]
and ch, 0xfd
or ch, 1
mov dword [esi + 8], ecx
mov ecx, esi
call fcn.00423c90
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xb8], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x427fe0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x659a18]
xor ebx, ebx
push edi
push ebx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, 2
jne 0x428020
mov edx, dword [0x659a18]
push edx
push 1
push 0x54
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
jmp 0x4280a3
mov eax, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push eax
push 3
push 4
push esi
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [0x659a18]
lea edx, [esi + 0x14]
push ecx
push 1
push 8
push edx
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 0x1c]
push eax
push 1
push 4
push ecx
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 0x20]
push edx
push 1
push 0x10
push eax
call edi
mov ecx, dword [0x659a18]
add esp, 0x40
lea edx, [esi + 0x30]
push ecx
push 1
push 4
push edx
call edi
mov eax, dword [0x659a18]
lea ecx, [esi + 0x3c]
push eax
push 1
push 8
push ecx
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 0x44]
push edx
push 1
push 0x10
push eax
call edi
add esp, 0x30
mov cl, byte [esp + 0x14]
mov edx, dword [esp + 0x18]
mov byte [esi + 3], cl
mov eax, dword [0x659958]
cmp eax, 0x18
push ebp
jge 0x4280d2
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, byte [edx + 4]
movsx edi, al
cmp ecx, dword [edi*4 + 0x533638]
jbe 0x4280d2
add al, 2
mov byte [esi + 1], al
movsx edi, byte [esi + 1]
mov byte [esi + 2], bl
mov al, byte [edx + 4]
mov ebx, dword [edi*4 + 0x533638]
mov ecx, eax
and ecx, 0xff
cmp ecx, ebx
jbe 0x4280f6
mov cl, bl
sub al, cl
mov byte [esi + 2], al
mov eax, dword [esi + 0x1c]
mov ebx, dword [0x659a84]
mov ebp, eax
mov ecx, edi
and ebp, ebx
je 0x42810f
mov ecx, eax
shr ecx, 0x15
and ecx, 7
mov dl, byte [edx + 4]
mov ebx, edx
and ebx, 0xff
cmp ebx, dword [ecx*4 + 0x533638]
jbe 0x428143
test ebp, ebp
je 0x42812f
shr eax, 0x15
and eax, 7
mov edi, eax
mov bl, byte [edi*4 + 0x533638]
mov al, byte [esi + 2]
sub dl, bl
shl dl, 4
or al, dl
mov byte [esi + 2], al
mov eax, dword [0x659958]
pop ebp
cmp eax, 0x19
jge 0x428155
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x34], 0
test eax, 0x80000000
je 0x428203
mov edi, dword [esi + 0x14]
mov ebx, dword [esi + 0x18]
test edi, edi
jle 0x428200
cmp dword [0x659958], 0x1d
jl 0x4281d7
shr eax, 0x1c
and eax, 7
dec eax
je 0x4281d7
dec eax
je 0x4281b2
dec eax
jne 0x428200
push 0x1c
call fcn.00470250
add esp, 4
test eax, eax
je 0x4281fb
push edi
mov ecx, eax
call fcn.004ba9e0
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ebx
pop edi
pop esi
pop ebx
ret 0xc
push 0x298
call fcn.00470250
add esp, 4
test eax, eax
je 0x4281fb
push edi
mov ecx, eax
call fcn.004baf10
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ebx
pop edi
pop esi
pop ebx
ret 0xc
push 0x24
call fcn.00470250
add esp, 4
test eax, eax
je 0x4281fb
push 0
push edi
mov ecx, eax
call fcn.004bac90
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ebx
pop edi
pop esi
pop ebx
ret 0xc
xor eax, eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ebx
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x42a690
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x659958]
push esi
cmp eax, 0x1b
push edi
mov esi, ecx
jl 0x42a730
mov eax, dword [esp + 0xc]
mov ecx, dword [0x659a18]
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
push ecx
call edi
mov edx, dword [0x659a18]
lea eax, [esi + 0x214]
push edx
push 1
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
mov ecx, esi
call fcn.0042a610
test eax, eax
je 0x42a720
push 0x24
call fcn.00470250
mov edi, eax
add esp, 4
test edi, edi
je 0x42a713
mov ecx, dword [0x659a18]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov ecx, edi
push eax
call fcn.00488fd0
mov dword [esi + 0x12c], eax
pop edi
pop esi
ret 4
xor eax, eax
pop edi
mov dword [esi + 0x12c], eax
pop esi
ret 4
mov edx, dword [0x659a18]
push 1
push 0x10
push edx
call edi
add esp, 0xc
pop edi
pop esi
ret 4