joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x406243
pop dword [ebp - 0x3c]
mov eax, 0x814cacc1
sub eax, 0x810c4a7e
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x23097e3f
add dword [ebp - 0x4c], 0x2b48c70c
mov dword [ebp - 0x48], 0x2084c8c4
add dword [ebp - 0x48], 0x11ae8381
mov dword [ebp - 0x44], 0xd6d86e3e
add dword [ebp - 0x44], 0x7573d5f0
mov dword [ebp - 0x40], 0x133e95ad
add dword [ebp - 0x40], 0xecc16a53
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x4b2b6be2
add dword [ebp - 0x4c], 0x2946fd74
mov dword [ebp - 0x48], 0xc9205f11
sub dword [ebp - 0x48], 0x87b3fd9c
mov dword [ebp - 0x44], 0xeabe6e3
sub dword [ebp - 0x44], 0xab3c7a77
mov dword [ebp - 0x40], 0x7a1b54
add dword [ebp - 0x40], 0xff85e4ac
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xe5102d7d
sub eax, 0xe4cfac7d
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x358cb
push 0
call eax
mov ecx, 0xc26c4665
add ecx, 0x3d93fbb6
mov ebx, eax
mov edi, 0x2267ac76
sub edi, 0x2220c876
add edi, dword [ebp - 0x3c]
mov edx, 0xda74c544
add edx, 0x7bf0f228
mov dword [ebp - 0x28], 0xd6dd2789
mov esi, dword [edi]
sub dword [ebp - 0x34], 0xe6a797b7
sub esi, edx
add dword [ebp - 0x18], esi
mov dword [ebx], esi
xor dword [ebp - 0x34], 0x9678090f
add ebx, 0xbd40a765
sub ebx, 0xbd40a761
add edi, 0x1e0a552
sub edi, 0x1e0a54e
loop 0x406360
add eax, 0x64616ec
sub eax, 0x6451bad
xor ebx, ebx
add ebx, eax
add eax, 0x355126a7
add eax, 0xcaaed95e
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
jne 0x40101d
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x401061
mov ecx, dword [ebp - 4]
push edi
push esi
push ecx
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x401057
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0x43a234
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
jne 0x401069
push edi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x40107d
mov eax, dword [ebp + 8]
test eax, eax
je 0x40107d
movzx ecx, word [ecx + 0xa]
mov dword [eax], ecx
push edi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4010a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x11c]
push ecx
push ebx
mov dword [ebp - 0x110], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
jne 0x4010e0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004391bc
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x40112f
mov edx, dword [ebp - 0x11c]
push edi
push esi
push edx
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x401125
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueA]
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x118]
push ecx
push str.VarFileInfoTranslation
push edi
call esi
test eax, eax
jne 0x401141
push edi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004391bc
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x118]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push 0x43a930
push edx
push eax
lea ecx, [ebp - 0x108]
push str.StringFileInfo_04X_04X_s
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x108]
push ecx
push edi
call esi
cmp dword [ebp - 0x114], 0x50
ja 0x4011a4
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x110]
push 0x50
push edx
push eax
call dword [sym.imp.MSVCR100.dll__mbsnbcpy]
add esp, 0xc
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004391bc
mov esp, ebp
pop ebp
ret
Function at 0x4015d0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
mov edi, eax
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
sub eax, dword [esi]
sbb edx, dword [esi + 4]
xor ecx, ecx
cmp edx, ecx
jg 0x4015f8
jl 0x4015f3
cmp eax, dword [ebp + 8]
jae 0x4015f8
xor eax, eax
pop edi
pop ebp
ret
movsx edx, word [esi + 0xc]
mov dword [ebp + 8], ecx
mov ecx, dword [esi + 0x22]
lea eax, [ebp + 8]
push eax
movzx eax, word [esi + 0x14]
push ecx
mov ecx, dword [esi + 8]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
je 0x4016a9
mov eax, dword [esi + 0x22]
movsx ecx, word [esi + 0xc]
lea edx, [ebp + 8]
push edx
mov edx, dword [esi + 8]
push eax
push ecx
push 0x20
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
je 0x4016a9
mov eax, dword [esi + 0x22]
mov ecx, dword [esi + 8]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ebx, dword [sym.imp.MSVCR100.dll_printf]
test edi, edi
je 0x401660
push edi
push 0x43a93c
call ebx
add esp, 8
cmp dword [ebp + 0xc], 0
jle 0x401698
xor edi, edi
cmp dword [esi + 0x28], 0xffffffff
jne 0x401671
mov dword [esi + 0x28], edi
cmp dword [esi + 0x28], edi
jle 0x401686
push 0x43a940
call ebx
inc edi
add esp, 4
cmp edi, dword [esi + 0x28]
jl 0x401676
mov edx, dword [ebp + 0xc]
inc dword [esi + 0x28]
cmp dword [esi + 0x28], edx
jle 0x401698
mov dword [esi + 0x28], 0
push 0
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], edx
pop ebx
mov eax, 1
pop edi
pop ebp
ret
Function at 0x401e00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x44872c]
push esi
mov esi, dword [sym.imp.MSVCR100.dll_fread]
push eax
push 1
push 4
push edi
call esi
add esp, 0x10
cmp eax, 1
je 0x401e24
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [0x44872c]
mov edx, dword [ebp + 0x14]
push ecx
push 1
push 4
push edx
call esi
mov eax, dword [0x44872c]
mov ecx, dword [ebp + 0x18]
push eax
push 1
push 4
push ecx
call esi
add esp, 0x20
test ebx, ebx
je 0x401e6c
mov eax, dword [0x453180]
add eax, eax
add eax, eax
add eax, eax
je 0x401e6c
mov edx, dword [0x44872c]
push edx
push 1
push eax
mov eax, dword [ebp + 8]
push eax
call esi
add esp, 0x10
mov eax, dword [edi]
imul eax, dword [0x453180]
add eax, eax
add eax, eax
add eax, eax
je 0x401e90
mov ecx, dword [0x44872c]
mov edx, dword [ebp + 0xc]
push ecx
push 1
push eax
push edx
call esi
add esp, 0x10
test ebx, ebx
je 0x401ec1
cmp dword [0x448520], 0
je 0x401ead
mov eax, dword [0x44872c]
mov ecx, dword [ebp + 0x1c]
push eax
push 1
push 8
push ecx
jmp 0x401ebc
mov edx, dword [0x44872c]
mov eax, dword [ebp + 0x1c]
push edx
push 1
push 0xd
push eax
call esi
add esp, 0x10
mov eax, dword [0x448664]
add eax, eax
add eax, eax
add eax, eax
je 0x401ee1
mov ecx, dword [0x44872c]
mov edx, dword [ebp + 0x10]
push ecx
push 1
push eax
push edx
call esi
add esp, 0x10
mov eax, 1
pop esi
pop ebp
ret
Function at 0x4064d0
Capabilities:
Delete file
Terminate process

Disassembly:
push esi
xor esi, esi
mov eax, 0x46e1d4
push edi
lea esp, [esp]
cmp dword [eax - 0xc], 0
mov edi, 1
je 0x406522
cmp dword [eax], 0
je 0x406511
cmp dword [eax + 0xc], 0
je 0x406515
cmp dword [eax + 0x18], 0
je 0x40651a
cmp dword [eax + 0x24], 0
je 0x40651f
add eax, 0x3c
add esi, 5
cmp eax, 0x46e42c
jl 0x4064e0
jmp 0x406527
add esi, edi
jmp 0x406522
add esi, 2
jmp 0x406522
add esi, 3
jmp 0x406522
add esi, 4
cmp esi, 0x32
jl 0x4065a4
push str.Cannot_open_any_more_scratch_files__n
call dword [sym.imp.MSVCR100.dll_printf]
call fcn.00406fe0
mov eax, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push eax
mov dword [0x443e58], edi
call esi
mov ecx, dword [0x448bc8]
push ecx
call esi
add esp, 0xc
cmp dword [0x443e58], 0
je 0x40659c
mov edi, dword [sym.imp.MSVCR100.dll_clock]
call edi
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
jmp 0x406580
call edi
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
cmp eax, 3
jbe 0x406580
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
push 0
push 0
call dword [sym.imp.MSVCR100.dll__tempnam]
lea esi, [esi + esi*2]
add esi, esi
add esi, esi
add esp, 8
mov dword [esi + 0x46e1c4], eax
test eax, eax
jne 0x406614
push str.tmpfile
call dword [sym.imp.MSVCR100.dll_perror]
push str._Unable_to_open_temp_file_n
call dword [sym.imp.MSVCR100.dll_printf]
call fcn.00406fe0
mov ecx, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push ecx
mov dword [0x443e58], edi
call esi
mov edx, dword [0x448bc8]
push edx
call esi
add esp, 0x10
cmp dword [0x443e58], 0
je 0x40660c
call fcn.00406b90
push 6
call dword [sym.imp.MSVCR100.dll_exit]
push 0x43b518
push eax
mov dword [esi + 0x46e1c8], edi
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
test eax, eax
jne 0x40667e
push str.tmpfile
call dword [sym.imp.MSVCR100.dll_perror]
push str._Unable_to_open_temp_file_n
call dword [sym.imp.MSVCR100.dll_printf]
call fcn.00406fe0
mov eax, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push eax
mov dword [0x443e58], edi
call esi
mov ecx, dword [0x448bc8]
push ecx
call esi
add esp, 0x10
cmp dword [0x443e58], 0
je 0x406676
call fcn.00406b90
push 6
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
mov dword [esi + 0x46e1c0], eax
pop esi
ret

Function at 0x406690
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
call dword [sym.imp.MSVCR100.dll_fclose]
mov edi, dword [sym.imp.MSVCR100.dll_remove]
add esp, 4
mov esi, 0x46e1c4
xor ebx, ebx
mov ecx, dword [ebp + 8]
cmp dword [esi - 4], ecx
jne 0x4066d8
mov edx, dword [esi]
push edx
mov dword [esi - 4], ebx
call edi
mov eax, dword [esi]
add esp, 4
cmp eax, ebx
je 0x4066d3
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi], ebx
add esi, 0xc
cmp esi, 0x46e41c
jl 0x4066b0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4066f0
Capabilities:
Delete file
Terminate process

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
push esi
push edi
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 8
test eax, eax
jne 0x40677f
push 0x43b50d
call dword [sym.imp.MSVCR100.dll_perror]
push edi
mov edi, dword [sym.imp.MSVCR100.dll_printf]
push str.Unable_to_open__s_for
call edi
mov al, byte [esi]
add esp, 0xc
cmp al, 0x72
jne 0x40672e
push str.reading_n
jmp 0x40673b
cmp al, 0x77
je 0x406736
cmp al, 0x61
jne 0x406740
push str.writing_n
call edi
add esp, 4
call fcn.00406fe0
mov eax, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push eax
mov dword [0x443e58], 1
call esi
mov ecx, dword [0x448bc8]
push ecx
call esi
add esp, 8
cmp dword [0x443e58], 0
je 0x406777
call fcn.00406b90
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
pop edi
pop esi
ret

Function at 0x406790
Capabilities:
Read file on windows

Disassembly:
test eax, eax
je 0x4067aa
push ecx
push 1
push eax
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x4067aa
xor eax, eax
ret
mov eax, 1
ret

Function at 0x4067b0
Capabilities:
Delete file
Terminate process
Write file on windows

Disassembly:
test eax, eax
je 0x406811
push ecx
push 1
push eax
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x406811
push str._Unable_to_write._Full_disk__n
call dword [sym.imp.MSVCR100.dll_printf]
call fcn.00406fe0
mov eax, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push eax
mov dword [0x443e58], 1
call esi
mov ecx, dword [0x448bc8]
push ecx
call esi
add esp, 0xc
cmp dword [0x443e58], 0
je 0x406809
call fcn.00406b90
push 5
call dword [sym.imp.MSVCR100.dll_exit]
ret

Function at 0x406bd0
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_printf]
push esi
mov esi, dword [sym.imp.MSVCR100.dll_tolower]
push edi
xor edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp - 0x18]
push ecx
push 0x43b59c
call ebx
call dword [sym.imp.MSVCR100.dll___iob_func]
push eax
lea edx, [ebp - 0xc]
push 5
push edx
call dword [sym.imp.MSVCR100.dll_fgets]
movsx eax, byte [ebp - 0xc]
push eax
call esi
add esp, 0x18
cmp eax, 0x6e
jne 0x406c36
mov dword [ebp - 0x10], 0
inc edi
movsx ecx, byte [ebp - 0xc]
push ecx
call esi
add esp, 4
cmp eax, 0x79
jne 0x406c4d
mov dword [ebp - 0x10], 1
inc edi
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 9
jg 0x406c71
test edi, edi
je 0x406c01
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004391bc
mov esp, ebp
pop ebp
ret
push str.Unable_to_get_a_proper_response__n
push 0x43a944
call ebx
call fcn.00406fe0
mov edx, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push edx
mov dword [0x443e58], 1
call esi
mov eax, dword [0x448bc8]
push eax
call esi
add esp, 0x10
cmp dword [0x443e58], 0
je 0x406cb4
call fcn.00406b90
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x406cc0
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_fgets]
xor eax, eax
push esi
mov esi, dword [sym.imp.MSVCR100.dll_printf]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
push edi
push 0x43b59c
call esi
call dword [sym.imp.MSVCR100.dll___iob_func]
push eax
lea eax, [ebp - 0xc]
push 5
push eax
call ebx
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 0x18
cmp eax, dword [ebp + 8]
jl 0x406d17
cmp eax, dword [ebp + 0xc]
jg 0x406d17
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 9
jg 0x406d39
cmp dword [ebp - 0x10], 0
je 0x406ce6
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004391bc
mov esp, ebp
pop ebp
ret
push str.Unable_to_get_a_proper_response__n
push 0x43a944
call esi
call fcn.00406fe0
mov edx, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push edx
mov dword [0x443e58], 1
call esi
mov eax, dword [0x448bc8]
push eax
call esi
add esp, 0x10
cmp dword [0x443e58], 0
je 0x406d7c
call fcn.00406b90
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x406d90
Capabilities:
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
fild dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_fgets]
xor eax, eax
push esi
fstp qword [ebp - 0x30]
mov esi, dword [sym.imp.MSVCR100.dll_printf]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
jmp 0x406dc2
fstp st(0)
push edi
push 0x43b59c
call esi
call dword [sym.imp.MSVCR100.dll___iob_func]
push eax
lea eax, [ebp - 0x20]
push 0x19
push eax
call ebx
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.MSVCR100.dll_atof]
fld qword [ebp - 0x30]
fcomp st(1)
add esp, 0x18
fnstsw ax
test ah, 0x41
jp 0x406e01
fild dword [ebp + 0xc]
fcomp st(1)
fnstsw ax
test ah, 1
jne 0x406e01
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 9
jg 0x406e23
cmp dword [ebp - 0x24], 0
je 0x406dc0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004391bc
mov esp, ebp
pop ebp
ret
push str.Unable_to_get_a_proper_response__n
fstp st(0)
push 0x43a944
call esi
call fcn.00406fe0
mov edx, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push edx
mov dword [0x443e58], 1
call esi
mov eax, dword [0x448bc8]
push eax
call esi
add esp, 0x10
cmp dword [0x443e58], 0
je 0x406e68
call fcn.00406b90
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x406e80
Capabilities:
Delete file
Terminate process

Disassembly:
push esi
test edi, edi
jne 0x406e89
xor eax, eax
pop esi
ret
push edi
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x406ee3
push str._Out_of_memory._Please_run_a_smaller_problem_n
call dword [sym.imp.MSVCR100.dll_printf]
call fcn.00406fe0
mov eax, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push eax
mov dword [0x443e58], 1
call esi
mov ecx, dword [0x448bc8]
push ecx
call esi
add esp, 0xc
cmp dword [0x443e58], 0
je 0x406edb
call fcn.00406b90
push 3
call dword [sym.imp.MSVCR100.dll_exit]
push edi
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x406f00
Capabilities:
Delete file
Terminate process

Disassembly:
push esi
push str._Out_of_memory._Please_run_a_smaller_problem_n
call dword [sym.imp.MSVCR100.dll_printf]
call fcn.00406fe0
mov eax, dword [0x4596c4]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push eax
mov dword [0x443e58], 1
call esi
mov ecx, dword [0x448bc8]
push ecx
call esi
add esp, 0xc
cmp dword [0x443e58], 0
je 0x406f43
call fcn.00406b90
push 3
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x406fe0
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_fclose]
push esi
push edi
mov esi, 0x46e1c4
xor edi, edi
cmp dword [esi + 4], edi
je 0x407037
mov eax, dword [esi - 4]
push eax
call ebx
mov eax, dword [esi]
add esp, 4
mov dword [esi + 4], edi
mov dword [esi - 4], edi
cmp eax, edi
je 0x407037
push edi
push eax
call dword [sym.imp.MSVCR100.dll__access]
add esp, 8
test eax, eax
jne 0x407037
mov ecx, dword [esi]
push ecx
call dword [sym.imp.MSVCR100.dll_remove]
mov eax, dword [esi]
add esp, 4
cmp eax, edi
je 0x407035
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov dword [esi], edi
add esi, 0xc
cmp esi, 0x46e41c
jl 0x406ff0
pop edi
pop esi
pop ebx
ret
Function at 0x407520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x48
lea eax, [ebp - 0x58]
push 0x24
push eax
mov esi, ecx
call sub.MSVCR100.dll_memset
mov ecx, dword [0x448c78]
lea ebx, [esi*8]
sub ebx, esi
add ebx, ebx
push 0
add ebx, ebx
push 0
add ebx, ebx
mov esi, dword [ebx + ecx]
push 0
push esi
mov byte [ebp - 0x10], 0
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x64], 0
call dword [sym.imp.MSVCR100.dll__fseeki64]
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
lea edx, [ebp - 0x59]
push 1
push edx
call edi
push esi
push 1
lea eax, [ebp - 0x59]
push 1
push eax
call edi
push esi
push 1
lea ecx, [ebp - 0x64]
push 2
push ecx
call edi
add esp, 0x4c
push esi
push 1
lea edx, [ebp - 0x68]
push 2
push edx
call edi
push esi
push 1
lea eax, [ebp - 0x60]
push 2
push eax
call edi
push esi
push 1
lea ecx, [ebp - 0x59]
push 1
push ecx
call edi
add esp, 0x30
cmp word [ebp - 0x60], 0
jg 0x40762d
push 0x48
lea edx, [ebp - 0x58]
push edx
push 0x444521
mov byte [0x444521], 0
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x407614
lea ecx, [ecx]
push esi
push 1
push 0x4a
push 0x444520
call edi
push 0x48
lea eax, [ebp - 0x58]
push eax
push 0x444521
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0x1c
test eax, eax
jne 0x4075f0
push esi
push 1
lea ecx, [ebp - 0x59]
push 1
push ecx
call edi
push esi
push 1
lea edx, [ebp - 0x64]
push 2
push edx
call edi
add esp, 0x20
mov ecx, dword [ebp - 0x64]
test cx, cx
je 0x407639
xor eax, eax
jmp 0x40763c
mov eax, dword [ebp - 0x6c]
mov edx, dword [0x448c78]
movsx ecx, cx
mov dword [ebx + edx + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004391bc
mov esp, ebp
pop ebp
ret
Function at 0x407ff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x104], esi
cmp dword [ebp + 8], ebx
jle 0x408118
lea edi, [eax + 0x14]
mov eax, dword [0x46e41c]
test eax, eax
je 0x40804d
push esi
push 1
push eax
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x40817d
movzx ecx, word [ebp - 0xf0]
mov esi, dword [sym.imp.MSVCR100.dll__swab]
push 2
lea edx, [ebp - 0xfc]
push edx
lea eax, [ebp - 0xf8]
push eax
mov dword [ebp - 0xf8], ecx
call esi
mov cx, word [ebp - 0xfc]
movzx edx, word [ebp - 0xec]
push 2
lea eax, [ebp - 0x100]
mov word [edi - 0x14], cx
push eax
lea ecx, [ebp - 0xf8]
push ecx
mov dword [ebp - 0xf8], edx
call esi
mov al, byte [ebp - 0x99]
mov cl, byte [ebp - 0x9a]
mov dx, word [ebp - 0x100]
mov byte [ebp - 0xf4], al
mov eax, dword [ebp - 0x9c]
mov byte [ebp - 0xf3], cl
push 8
lea ecx, [ebp - 0xe8]
mov byte [ebp - 0xf2], ah
mov byte [ebp - 0xf1], al
mov word [edi - 0x12], dx
mov edx, dword [ebp - 0xf4]
push ecx
xor eax, eax
lea esi, [edi - 0xe]
push esi
mov dword [edi], edx
mov word [edi - 0x10], ax
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0x24
mov eax, 8
call fcn.00406820
mov esi, dword [ebp - 0x104]
inc ebx
add edi, 0x1c
cmp ebx, dword [ebp + 8]
jl 0x408027
mov edi, dword [ebp - 0x108]
mov eax, dword [0x46e41c]
imul eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0x50
div ecx
test edx, edx
je 0x408134
mov eax, ecx
sub eax, edx
jmp 0x408136
xor eax, eax
cdq
push 1
push edx
push eax
push esi
call dword [sym.imp.MSVCR100.dll__fseeki64]
push esi
push 1
lea edx, [ebp - 0x60]
push 0x50
push edx
call dword [sym.imp.MSVCR100.dll_fread]
push 0x17
lea eax, [ebp - 0x60]
push str.HEADER_RECORDOBS
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0x2c
test eax, eax
je 0x408190
push str.SAS_transport
push edi
push str.The_level__d_file_does_not_seem_to_be_a__s_file__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004391bc
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.MSVCR100.dll__ftelli64]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [edi*8 + 0x448be0], eax
mov dword [edi*8 + 0x448be4], edx
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004391bc
mov esp, ebp
pop ebp
ret