joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d950
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a4a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov edx, dword [esi]
push eax
mov ecx, esi
mov dword [esp + 0x2c], 0
call dword [edx + 4]
mov bx, word [esp + 0x12]
mov bp, word [esp + 0x10]
movsx eax, bx
mov dword [esp + 0x34], eax
mov edx, dword [esi]
fild dword [esp + 0x34]
push ecx
movsx ecx, bp
fstp dword [esp]
mov dword [esp + 0x38], ecx
push ecx
fild dword [esp + 0x3c]
mov ecx, esi
fstp dword [esp]
call dword [edx + 0x34]
mov edx, dword [edi + 0x10]
xor cx, cx
xor esi, esi
mov al, byte [edx]
and al, 3
mov cl, al
shl ecx, 5
movsx eax, cx
and eax, 0x8000007f
jns 0x42d9dc
dec eax
or eax, 0xffffff80
inc eax
test ax, ax
jge 0x42d9e6
add eax, 0x80
cmp word [edi + 0x14], 0
mov byte [esp + 0x34], al
jle 0x42daa5
lea edx, [esp + 0x1c]
push esi
push edx
mov ecx, edi
call fcn.00427a00
add bp, word [eax]
add bx, word [eax + 2]
mov al, byte [esp + 0x34]
inc esi
movsx ecx, si
mov byte [esp + 0x14], al
mov eax, ecx
cdq
and edx, 3
add eax, edx
mov edx, dword [edi + 0x10]
sar eax, 2
and ecx, 0x80000003
jns 0x42da30
dec ecx
or ecx, 0xfffffffc
inc ecx
mov al, byte [eax + edx]
shl cl, 1
shr al, cl
xor cx, cx
and al, 3
mov cl, al
shl ecx, 5
movsx eax, cx
and eax, 0x8000007f
jns 0x42da50
dec eax
or eax, 0xffffff80
inc eax
test ax, ax
jge 0x42da5a
add eax, 0x80
cmp si, word [edi + 0x14]
mov byte [esp + 0x34], al
jge 0x42da6a
cmp byte [esp + 0x14], al
je 0x42d9f5
mov ecx, dword [esp + 0x30]
mov word [esp + 0x12], bx
movsx eax, bx
mov dword [esp + 0x18], eax
mov edx, dword [ecx]
fild dword [esp + 0x18]
movsx eax, bp
push ecx
mov dword [esp + 0x1c], eax
mov word [esp + 0x14], bp
fstp dword [esp]
fild dword [esp + 0x1c]
push ecx
fstp dword [esp]
call dword [edx + 0x38]
cmp si, word [edi + 0x14]
jl 0x42d9f5
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x430830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a4c98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
lea edx, [esi + 0x20]
xor ebx, ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x30], ebx
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov eax, dword [edx]
cmp eax, ebx
je 0x43086a
mov eax, dword [eax]
jmp 0x43086c
xor eax, eax
mov ecx, eax
cmp ecx, ebx
mov dword [esp + 0x14], ecx
je 0x43087a
mov eax, dword [ecx]
jmp 0x43087c
xor eax, eax
cmp ecx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
je 0x430896
mov dword [esp + 0x20], ecx
jmp 0x43089b
mov byte [esp + 0x1d], 1
mov edi, dword [esp + 0x38]
mov byte [esp + 0x24], bl
cmp dword [edx], ebx
je 0x4308cc
cmp ecx, dword [esp + 0x20]
jne 0x4308b3
cmp byte [esp + 0x24], bl
jne 0x4308cc
push edi
call fcn.0043d3b0
lea ecx, [esp + 0xc]
call fcn.004403e0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
jmp 0x4308a3
mov eax, dword [esp + 0x3a]
add word [esi + 0xc], di
add word [esi + 0xe], ax
add word [esi + 0x10], di
add word [esi + 0x12], ax
push edi
lea ecx, [esi + 0x24]
call fcn.00437b70
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x430b80
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea eax, [esp + 0x18]
push 4
push eax
call edi
add esp, 0x10
cmp eax, 1
je 0x430bb7
push 0
push 2
push 0x4b9d44
push 0x4cb514
call fcn.00441210
add esp, 0x10
mov eax, dword [esp + 0x10]
cmp eax, 5
ja case.default.0x430bc4
jmp dword [eax*4 + 0x430d64]
push 0
push 0x24
call fcn.00442a90
push 0
push 0x24
call fcn.00442a90
push esi
mov ebx, eax
push 1
push 0x24
push ebx
call edi
add esp, 0x20
cmp eax, 1
je 0x430c05
push 0
push 2
push 0x4b9df0
push 0x4cb518
call fcn.00441210
add esp, 0x10
push 0x4333a0
push esi
lea ecx, [ebx + 4]
call fcn.00440340
push 0x430b70
push esi
lea ecx, [ebx + 0x18]
call fcn.00440340
push 0x43c020
push esi
lea ecx, [ebx + 0x20]
call fcn.00440340
pop edi
mov eax, ebx
pop esi
pop ebx
ret
push 0
push 0x20
call fcn.00442a90
push 0
push 0x20
call fcn.00442a90
push esi
mov ebx, eax
push 1
push 0x20
push ebx
call edi
add esp, 0x20
cmp eax, 1
je 0x430c6f
push 0
push 2
push 0x4b9dd0
push 0x4cb518
call fcn.00441210
add esp, 0x10
push 0x4333a0
push esi
lea ecx, [ebx + 4]
call fcn.00440340
push 0x430b70
push esi
lea ecx, [ebx + 0x18]
call fcn.00440340
pop edi
mov eax, ebx
pop esi
pop ebx
ret
push 0
push 0x20
call fcn.00442a90
push 0
push 0x20
call fcn.00442a90
push esi
mov ebx, eax
push 1
push 0x20
push ebx
call edi
add esp, 0x20
cmp eax, 1
je 0x430c6f
push 0
push 2
push 0x4b9db4
jmp 0x430c62
push 0
push 0x20
call fcn.00442a90
push 0
push 0x20
call fcn.00442a90
push esi
mov ebx, eax
push 1
push 0x20
push ebx
call edi
add esp, 0x20
cmp eax, 1
je 0x430c6f
push 0
push 2
push 0x4b9d98
jmp 0x430c62
push 0
push 0x20
call fcn.00442a90
push 0
push 0x20
call fcn.00442a90
push esi
mov ebx, eax
push 1
push 0x20
push ebx
call edi
add esp, 0x20
cmp eax, 1
je 0x430c6f
push 0
push 2
push 0x4b9d78
jmp 0x430c62
push 0
push 0x20
call fcn.00442a90
push 0
push 0x20
call fcn.00442a90
push esi
mov ebx, eax
push 1
push 0x20
push ebx
call edi
add esp, 0x20
cmp eax, 1
je 0x430c6f
push 0
push 2
push 0x4b9d5c
jmp 0x430c62
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x436c70
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x34]
lea eax, [esi + 0x14]
push eax
call fcn.0040f9a0
lea ecx, [esi + 0x10]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00426120
movsx edx, word [esi + 4]
mov dword [esp + 8], edx
sub esp, 8
fild dword [esp + 0x10]
fmul dword [ebp + 8]
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_floor]
call sub.MSVCRT.dll__ftol
fld dword [ebp + 0xc]
mov word [esi + 4], ax
mov ax, word [esi + 6]
movsx eax, ax
mov dword [esp + 0x10], eax
fimul dword [esp + 0x10]
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_floor]
call sub.MSVCRT.dll__ftol
movsx ecx, word [esi + 8]
mov dword [esp + 0x10], ecx
mov word [esi + 6], ax
fild dword [esp + 0x10]
fmul dword [ebp + 8]
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_ceil]
call sub.MSVCRT.dll__ftol
fld dword [ebp + 0xc]
mov word [esi + 8], ax
mov ax, word [esi + 0xa]
movsx edx, ax
mov dword [esp + 0x10], edx
fimul dword [esp + 0x10]
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_ceil]
call sub.MSVCRT.dll__ftol
mov word [esi + 0xa], ax
movsx eax, word [esi + 0xc]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul dword [ebp + 8]
fadd qword [0x4a8220]
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_floor]
call sub.MSVCRT.dll__ftol
fld dword [ebp + 0xc]
mov word [esi + 0xc], ax
mov ax, word [esi + 0xe]
movsx ecx, ax
mov dword [esp + 0x10], ecx
fimul dword [esp + 0x10]
fadd qword [0x4a8220]
fstp qword [esp]
call dword [sym.imp.MSVCRT.dll_floor]
add esp, 8
call sub.MSVCRT.dll__ftol
mov word [esi + 0xe], ax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x436d86
mov dword [esp + 0x2c], eax
jmp 0x436d8b
mov byte [esp + 0x29], 1
mov byte [esp + 0x30], 0
mov edx, dword [esp + 0x18]
cmp dword [edx], 0
je 0x436dfa
cmp eax, dword [esp + 0x2c]
jne 0x436da7
mov cl, byte [esp + 0x30]
test cl, cl
jne 0x436dfa
fld dword [eax + 8]
fmul dword [ebp + 8]
fstp dword [esp + 8]
fld dword [eax + 0xc]
fmul dword [ebp + 0xc]
mov ecx, dword [esp + 8]
mov dword [eax + 8], ecx
fstp dword [esp + 0xc]
fld dword [eax + 0x10]
mov edx, dword [esp + 0xc]
fmul dword [ebp + 8]
mov dword [eax + 0xc], edx
fstp dword [esp + 0x10]
fld dword [eax + 0x14]
mov ecx, dword [esp + 0x10]
fmul dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
lea ecx, [esp + 0x18]
fstp dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov dword [eax + 0x14], edx
call fcn.00440e40
mov eax, dword [esp + 0x20]
jmp 0x436d90
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x436e08
mov dword [esp + 0x48], ecx
jmp 0x436e0d
mov byte [esp + 0x45], 1
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov byte [esp + 0x4c], 0
mov eax, dword [esp + 0x34]
cmp dword [eax], 0
je 0x436e45
cmp ecx, dword [esp + 0x48]
jne 0x436e2f
mov al, byte [esp + 0x4c]
test al, al
jne 0x436e45
push esi
push edi
call fcn.00436c70
lea ecx, [esp + 0x34]
call fcn.004403e0
mov ecx, dword [esp + 0x3c]
jmp 0x436e18
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x439990
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
xor ebp, ebp
push 0x4b1c88
push edi
xor esi, esi
mov dword [esp + 0x18], ebp
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 8
cmp ebx, ebp
je 0x439b26
push ebx
call dword [sym.imp.MSVCRT.dll_fgetc]
add esp, 4
cmp eax, 0xffffffff
je 0x439b1a
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_ungetc]
add esp, 8
cmp eax, 0xffffffff
je 0x439b1a
mov al, byte [0x4cb8a8]
test al, al
je 0x439ad2
push 4
call sub.MFC42.DLL_operatornew
add esp, 4
cmp eax, ebp
je 0x439a04
mov dword [eax], ebp
mov esi, eax
jmp 0x439a06
xor esi, esi
push ebx
call fcn.00442df0
mov dword [esp + 0x14], esi
mov ecx, dword [esi]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi]
add esp, 4
cmp ecx, ebp
je 0x439a23
mov ecx, dword [ecx]
jmp 0x439a25
xor ecx, ecx
cmp ecx, ebp
mov dword [esp + 0x18], ecx
je 0x439a31
mov ecx, dword [ecx]
jmp 0x439a33
xor ecx, ecx
cmp eax, ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ebp
mov byte [esp + 0x28], 0
mov byte [esp + 0x20], 0
mov byte [esp + 0x21], 0
jle 0x439b12
mov dword [esp + 0x30], eax
push ebx
call fcn.00430e90
mov edx, dword [esp + 0x14]
mov edi, eax
add esp, 4
mov eax, dword [edx]
test eax, eax
je 0x439a87
mov ecx, dword [esp + 0x18]
cmp ecx, eax
je 0x439a87
mov ebp, dword [esp + 0x14]
test ecx, ecx
jne 0x439a93
cmp ebp, eax
jne 0x439a93
mov dl, byte [esp + 0x20]
test dl, dl
je 0x439a93
push edi
lea ecx, [esp + 0x14]
call fcn.00402a70
jmp 0x439ac5
mov edx, dword [eax]
cmp ecx, edx
je 0x439aa9
test ecx, ecx
jne 0x439ab5
cmp ebp, eax
jne 0x439ab5
mov al, byte [esp + 0x20]
test al, al
jne 0x439ab5
push edi
lea ecx, [esp + 0x14]
call fcn.00402af0
jmp 0x439abf
mov dword [edi], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [edx], edi
mov eax, dword [esp + 0x10]
mov dword [eax], edi
mov eax, dword [esp + 0x30]
dec eax
mov dword [esp + 0x30], eax
jne 0x439a56
jmp 0x439b12
push ebp
push 4
call fcn.00442a90
push ebx
mov esi, eax
push 1
push 4
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x18
cmp eax, 1
je 0x439b05
push ebp
push 2
push 0x4ba4cc
push 0x4cb8f0
call fcn.00441210
add esp, 0x10
push 0x430b70
push ebx
mov ecx, esi
call fcn.00440340
mov dword [0x4cb8d4], esi
xor ebp, ebp
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
jmp 0x439b52
push edi
push ebp
push 0x4ba4b8
push 0x4cb900
call fcn.00441210
push 4
call sub.MFC42.DLL_operatornew
add esp, 0x14
cmp eax, ebp
je 0x439b49
mov dword [eax], ebp
jmp 0x439b4b
xor eax, eax
mov esi, eax
mov dword [0x4cb8d4], eax
mov dword [0x4cb8b8], esi
mov ecx, dword [esi]
mov dword [0x4cb8bc], ecx
mov eax, dword [esi]
cmp eax, ebp
je 0x439b6a
mov eax, dword [eax]
jmp 0x439b6c
xor eax, eax
cmp eax, ebp
mov dword [0x4cb8c0], eax
je 0x439b79
mov eax, dword [eax]
jmp 0x439b7b
xor eax, eax
mov ecx, esi
mov dword [0x4cb8c4], eax
mov dword [0x4cb8cc], ebp
mov byte [0x4cb8d0], 0
mov byte [0x4cb8c8], 0
mov byte [0x4cb8c9], 0
call fcn.0043ff80
movsx edx, ax
push edx
push 0x4ba4a0
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x43fa10
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
sub esp, 0x460
push ebx
xor ebx, ebx
push esi
push ebx
push 0x1000
push ebx
lea eax, [esp + 0x14]
mov esi, ecx
push 4
push eax
push 0xffffffffffffffff
mov dword [esi], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [esi + 0xc], eax
je 0x43fb73
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x43fb73
mov edx, dword [esp + 0x480]
mov byte [eax + 5], bl
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x68]
push ecx
push edx
push 0x4ba9b4
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea edx, [esp + 0x14]
lea eax, [esp + 0x24]
push edx
push eax
push ebx
push ebx
push 0x800000c
push 1
push ebx
lea ecx, [esp + 0x84]
push ebx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x43fb73
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
jne 0x43fb73
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
mov eax, dword [esi + 4]
cmp byte [eax + 5], bl
je 0x43faf7
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 4]
mov dl, byte [eax + 3]
shl ecx, 8
add ecx, edx
xor edx, edx
mov dl, byte [eax + 2]
pop edi
shl ecx, 8
add ecx, edx
xor edx, edx
mov dl, byte [eax + 1]
shl ecx, 8
lea eax, [ecx + edx]
cmp eax, ebx
mov dword [esi], eax
je 0x43fb73
mov ecx, dword [esp + 0x46c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [esp + 0x47c]
mov eax, dword [esp + 0x478]
mov ecx, dword [esp + 0x474]
push 1
push edx
mov edx, dword [esp + 0x478]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esi]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop esi
pop ebx
add esp, 0x460
ret 0x18

Function at 0x441550
Capabilities:
Terminate process

Disassembly:
mov ax, word [0x4baaa0]
cmp ax, 8
je 0x441562
cmp ax, 0xe
jne 0x441579
mov cx, word [0x4cbb9a]
add cx, word [0x4cbb98]
add ax, cx
mov word [0x4baaa0], ax
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
movsx eax, ax
jge 0x44159d
movsx ecx, word [0x4cbb9c]
push ecx
push eax
lea edx, [ecx + eax*4]
lea esi, [edx + edx + 1]
push esi
push 0x4baae0
jmp 0x4415aa
lea esi, [ecx + eax*4]
push ecx
shl esi, 1
push eax
push esi
push 0x4baaa4
call fcn.00443600
add esp, 0x10
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
nop
nop
Function at 0x442d70
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call fcn.00442a90
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
push 1
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x14
cmp eax, 1
je 0x442dab
push 0
push 2
push 0x4bb1cc
push 0x4cd1d0
call fcn.00441210
add esp, 0x10
mov eax, esi
pop edi
pop esi
ret

Function at 0x442db0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push 1
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x442de5
push 0
push 2
push 0x4bb1e0
push 0x4cd1cc
call fcn.00441210
add esp, 0x10
ret
Function at 0x445be0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x90
call fcn.004555b0
mov ebx, dword [esp + 0x20]
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push ebx
mov esi, eax
push 1
push 0x90
push esi
call edi
push 0x100
call fcn.00454c70
push 0x20
mov dword [esi + 4], eax
call fcn.00454c70
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
push ebx
push 8
push 4
push eax
call edi
mov ecx, dword [esi + 8]
push ebx
push 1
push 4
push ecx
call edi
push ebx
push 1
lea edx, [esp + 0x54]
push 4
push edx
call edi
xor eax, eax
add esp, 0x4c
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x10]
cmp ecx, eax
mov dword [esp + 0x1c], eax
jle 0x445c8c
push 0x4bb418
push 0x20
call fcn.0042bad0
push ebx
mov ebp, eax
push 1
push 0x20
push ebp
call edi
mov eax, dword [esi + 0xc]
push ebp
push eax
call fcn.004560c0
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
add esp, 0x20
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x445c55
push ebx
push 1
lea ecx, [esp + 0x1c]
push 4
push ecx
call edi
mov eax, dword [esp + 0x24]
add esp, 0x10
xor edi, edi
test eax, eax
jle 0x445ce8
lea ebp, [esi + 0x10]
mov ecx, edi
mov edx, 1
and ecx, 0x1f
mov eax, edi
shl edx, cl
push ebx
mov ecx, edx
cdq
and edx, 0x1f
add eax, edx
mov edx, dword [esi + 8]
sar eax, 5
test dword [edx + eax*4], ecx
je 0x445cd1
call fcn.00445d60
jmp 0x445cd6
call fcn.00445dc0
add esp, 4
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
inc edi
add ebp, 4
cmp edi, eax
jl 0x445ca8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x445d00
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
push edi
push 0x198
call fcn.004555b0
mov ebp, dword [esp + 0x14]
mov esi, eax
push ebp
push 1
push 0x198
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push 0
push ebp
call fcn.0044fd10
mov dword [esi], eax
mov ecx, dword [eax]
add esp, 0x1c
xor edi, edi
test ecx, ecx
jle 0x445d59
push ebx
lea ebx, [esi + 8]
push ebp
call fcn.00445be0
mov dword [ebx], eax
mov eax, dword [esi]
add esp, 4
inc edi
mov ecx, dword [eax]
add ebx, 4
cmp edi, ecx
jl 0x445d3b
pop ebx
mov eax, esi
pop edi
pop esi
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x445d60
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push edi
push 1
push 1
push eax
call ebx
mov ecx, dword [esp + 0x20]
and ecx, 0xff
inc ecx
push ecx
call fcn.004555b0
mov edx, dword [esp + 0x24]
push edi
and edx, 0xff
mov esi, eax
push edx
push 1
push esi
call ebx
mov eax, dword [esp + 0x34]
add esp, 0x24
and eax, 0xff
pop edi
mov byte [eax + esi], 0
mov eax, esi
pop esi
pop ebx
ret
Function at 0x445dc0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push 0x4bb404
push 0xc
call fcn.0042bad0
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edi
mov esi, eax
push 1
push 0xc
push esi
call ebx
xor eax, eax
mov al, byte [esi + 1]
shl eax, 5
push eax
call fcn.00454c70
xor ecx, ecx
push edi
mov cl, byte [esi + 1]
mov dword [esi + 8], eax
push ecx
push 4
push eax
call ebx
add esp, 0x2c
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x445e10
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
push 1
push 0x90
push ebp
call edi
mov eax, dword [ebp + 4]
push ebx
push 8
push 4
push eax
call edi
mov ecx, dword [ebp + 8]
push ebx
push 1
push 4
push ecx
call edi
mov edx, dword [ebp + 0xc]
push edx
call fcn.00455e80
mov dword [esp + 0x48], eax
push ebx
push 1
lea eax, [esp + 0x50]
push 4
push eax
call edi
mov esi, dword [ebp + 0xc]
add esp, 0x44
test esi, esi
je 0x445e7a
mov eax, dword [esi]
push ebx
push 1
push 0x20
push eax
call edi
mov esi, dword [esi + 4]
add esp, 0x10
test esi, esi
jne 0x445e66
push ebx
push 1
lea ecx, [esp + 0x24]
push 4
push ecx
call edi
mov eax, dword [esp + 0x2c]
add esp, 0x10
xor esi, esi
test eax, eax
jle 0x445eda
lea edi, [ebp + 0x10]
mov ecx, esi
mov edx, 1
and ecx, 0x1f
mov eax, esi
shl edx, cl
mov ecx, edx
cdq
and edx, 0x1f
add eax, edx
mov edx, dword [ebp + 8]
sar eax, 5
test dword [edx + eax*4], ecx
je 0x445ec2
mov edx, dword [edi]
push edx
push ebx
call fcn.00445f40
jmp 0x445ecb
mov eax, dword [edi]
push eax
push ebx
call fcn.00445fa0
mov eax, dword [esp + 0x24]
add esp, 8
inc esi
add edi, 4
cmp esi, eax
jl 0x445e96
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x445ee0
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push ebp
push 1
push 0x198
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [esi]
push eax
push ebp
call fcn.00450430
mov eax, dword [esi]
add esp, 0x18
xor ebx, ebx
cmp dword [eax], 0
jle 0x445f3a
push edi
mov edi, 0x26c
mov ecx, dword [edi + eax]
mov eax, dword [esi + edi - 0x264]
xor edx, edx
mov dl, byte [ecx + 3]
push edx
push eax
push ebp
call fcn.00445e10
mov eax, dword [esi]
add esp, 0xc
inc ebx
add edi, 4
cmp ebx, dword [eax]
jl 0x445f15
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x445f40
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
setne al
push edi
push eax
call fcn.0042ba10
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x14]
not ecx
dec ecx
push edi
mov byte [esp + 0x1c], cl
push 1
lea ecx, [esp + 0x20]
push 1
push ecx
call ebx
mov edx, dword [esp + 0x28]
push edi
and edx, 0xff
push edx
push 1
push esi
call ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x445fa0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
setne al
push edi
push eax
call fcn.0042ba10
mov ebx, dword [esi + 4]
xor ecx, ecx
test ebx, ebx
sete cl
push ecx
call fcn.0042ba10
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
push edi
push 1
push 0xc
push esi
call ebx
mov eax, dword [esi + 8]
xor edx, edx
mov dl, byte [esi + 1]
push edi
push edx
push 4
push eax
call ebx
add esp, 0x28
pop edi
pop esi
pop ebx
ret