joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409c20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x88
push ebx
push ebp
push esi
mov esi, dword [esp + 0x98]
test esi, esi
push edi
jl 0x409c4b
cmp esi, 0xa
jge 0x409c4b
lea eax, [esi + esi*4]
lea ecx, [esi + eax*2]
mov al, byte [ecx*4 + 0x6347d8]
test al, al
jne 0x409c58
push 0x493004
call fcn.00445450
add esp, 4
mov edi, dword [esp + 0xa0]
lea edx, [esi + esi*4]
push 0x4921c8
push edi
lea eax, [esi + edx*2]
lea esi, [eax*4 + 0x6347d8]
call dword [0x485200]
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x409c90
push edi
push 0x492ff0
call fcn.00445450
add esp, 8
mov ecx, dword [esi + 0x14]
mov ebp, dword [0x48520c]
push ecx
push 1
lea edx, [esp + 0x20]
push 0x80
push edx
call ebp
mov eax, dword [esp + 0x2c]
mov ebx, dword [0x4851f0]
and eax, 0xffff
add esp, 0x10
sub eax, 0xaf11
je 0x409cf3
dec eax
je 0x409cda
mov eax, dword [esi + 0x14]
push eax
call ebx
push edi
push 0x492fd8
call fcn.00445450
add esp, 0xc
jmp 0x409cfa
mov eax, dword [esp + 0x68]
mov ecx, dword [esi + 0x14]
push 0
push eax
push ecx
mov dword [esi + 0x10], eax
call dword [0x4851fc]
add esp, 0xc
jmp 0x409cfa
mov dword [esi + 0x10], 0x80
cmp word [esp + 0x1c], 0xaf11
jne 0x409d1c
mov eax, dword [esp + 0x28]
mov dx, word [esp + 0x1e]
cmp ax, 1
mov word [esi + 2], dx
mov word [esi + 4], ax
jae 0x409d54
jmp 0x409d4e
mov ecx, dword [esp + 0x28]
mov ax, word [esp + 0x1e]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
fild qword [esp + 0x10]
mov word [esi + 2], ax
fmul qword [0x485658]
call fcn.0047ddb0
cmp ax, 1
mov word [esi + 4], ax
jae 0x409d54
mov word [esi + 4], 1
xor edx, edx
mov dx, word [esi + 4]
mov dword [esp + 0x10], edx
fild dword [esp + 0x10]
fmul qword [0x485650]
fdivr qword [0x485648]
fdivr qword [0x485648]
call fcn.0047ddb0
mov word [esi + 4], ax
mov eax, dword [esp + 0xa4]
xor edi, edi
cmp eax, edi
jne 0x409db3
mov eax, dword [esp + 0x18]
push eax
call fcn.004225a0
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0x1c]
push ecx
push 1
push edx
push eax
mov dword [esi + 0x18], eax
call ebp
mov eax, dword [esi + 0x14]
push eax
call ebx
add esp, 0x18
mov dword [esi + 0x14], edi
jmp 0x409db6
mov dword [esi + 0x18], edi
push 0x200
call fcn.004225a0
push 0x10
mov dword [esi + 0x1c], eax
call fcn.004225a0
mov dword [esi + 0x20], eax
mov byte [eax], 0
mov ecx, dword [esi + 0x20]
mov dx, word [esp + 0x28]
mov word [ecx + 2], dx
mov eax, dword [esi + 0x20]
mov cx, word [esp + 0x2a]
mov word [eax + 4], cx
mov edx, dword [esp + 0x2a]
mov eax, dword [esp + 0x28]
and edx, 0xffff
and eax, 0xffff
imul edx, eax
push edx
call fcn.004225a0
mov ecx, dword [esi + 0x20]
add esp, 0xc
mov dword [ecx + 8], eax
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
pop edi
mov dword [edx + 0xc], eax
mov byte [esi], 4
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
Function at 0x40ac50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x224
push ebp
push esi
push edi
mov byte [esp + 0xc], 1
mov byte [esp + 0xd], 0
mov byte [esp + 0xe], 0
mov byte [esp + 0xf], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x14], 1
mov byte [esp + 0x15], 1
mov byte [esp + 0x16], 1
mov byte [esp + 0x17], 1
mov byte [esp + 0x18], 1
mov byte [esp + 0x19], 1
call fcn.0040aac0
push str.IGSMJ_P.SAV
push 0x66c0e4
lea eax, [esp + 0x134]
push str._s_s
push eax
call dword [0x48534c]
lea ecx, [esp + 0x13c]
push 0x4921c8
push ecx
call dword [0x485200]
mov ebp, eax
add esp, 0x18
test ebp, ebp
je 0x40ad80
push ebx
mov ebx, dword [0x48520c]
push ebp
push 1
lea edx, [esp + 0x28]
push 8
push edx
call ebx
add esp, 0x10
mov ecx, 2
mov edi, str.IGSMJP07
lea esi, [esp + 0x20]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x40ad75
push ebp
push 1
lea ecx, [esp + 0x28]
push 8
push ecx
call ebx
push ebp
push 1
lea edx, [esp + 0x40]
push 4
push edx
call ebx
add esp, 0x20
mov ecx, 2
mov edi, str.SETTING
lea esi, [esp + 0x20]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x40ad4e
push ebp
push 1
push 0x2868
push 0x634bc8
call ebx
add esp, 0x10
jmp 0x40ad0b
mov ecx, 2
mov edi, str.FILE_END
lea esi, [esp + 0x20]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40ad75
mov eax, dword [esp + 0x28]
push 1
push eax
push ebp
call dword [0x4851fc]
add esp, 0xc
jmp 0x40ad0b
push ebp
call dword [0x4851f0]
add esp, 4
pop ebx
mov edi, str.SoftwareIGSIGSMJ
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push 0x20019
push 0
push edx
push 0x80000001
call dword [0x485004]
test eax, eax
jne 0x40add2
mov byte [0x634bc8], 1
call fcn.0040aea0
mov al, byte [0x634bc8]
test al, al
je 0x40adf7
mov eax, 0x1010101
mov dword [0x634990], eax
mov dword [0x634994], eax
mov dword [0x634998], eax
mov word [0x63499c], ax
jmp 0x40ae55
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [0x634990], ecx
mov cx, word [esp + 0x18]
mov dword [0x634994], edx
mov word [0x63499c], cx
mov dword [0x634998], eax
xor ecx, ecx
xor edx, edx
mov dl, byte [ecx + 0x634bd8]
mov al, byte [edx + 0x634990]
test al, al
jne 0x40ae4f
lea eax, [edx + 1]
mov esi, 0xe
cdq
idiv esi
mov al, byte [edx + 0x634990]
test al, al
je 0x40ae34
mov byte [ecx + 0x634bd8], dl
inc ecx
cmp ecx, 4
jl 0x40ae22
call fcn.0040af70
call fcn.0040b070
pop edi
pop esi
test eax, eax
pop ebp
je 0x40ae80
push 0x634b70
call fcn.0041a1f0
add esp, 4
test eax, eax
jne 0x40ae8a
call fcn.0040b070
test eax, eax
jne 0x40ae66
mov dword [0x66c0e0], 1
add esp, 0x224
ret
Function at 0x40aea0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
push esi
call fcn.0040b420
push str.IGSMJ_P.SAV
push 0x66c0e4
lea eax, [esp + 0x10]
push str._s_s
push eax
call dword [0x48534c]
lea ecx, [esp + 0x18]
push 0x4933a8
push ecx
call dword [0x485200]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40af5c
push edi
mov edi, dword [0x485220]
push esi
push 1
push 8
push str.IGSMJP07
call edi
push esi
push 1
push 8
push str.SETTING
mov dword [esp + 0x28], 0x2868
call edi
push esi
push 1
lea edx, [esp + 0x30]
push 4
push edx
call edi
push esi
push 1
push 0x2868
push 0x634bc8
call edi
add esp, 0x40
mov dword [esp + 8], 0
push esi
push 1
push 8
push str.FILE_END
call edi
push esi
push 1
lea eax, [esp + 0x20]
push 4
push eax
call edi
push esi
call dword [0x4851f0]
add esp, 0x24
mov eax, 1
pop edi
pop esi
add esp, 0x108
ret
xor eax, eax
pop esi
add esp, 0x108
ret

Function at 0x40af70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
push edi
push 0x104
push eax
call dword [0x485060]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 7], 0x5c
je 0x40afb1
lea ecx, [esp + 8]
lea edx, [esp + 0x10c]
push ecx
push str._sigsmj2002.no
push edx
jmp 0x40afc3
lea eax, [esp + 8]
lea ecx, [esp + 0x10c]
push eax
push 0x4933ac
push ecx
call dword [0x48534c]
add esp, 0xc
lea edx, [esp + 0x10c]
push 0x4921c8
push edx
call dword [0x485200]
mov esi, eax
add esp, 8
test esi, esi
je 0x40b019
mov edi, dword [0x48520c]
push esi
push 1
push 0x51
push 0x634b70
call edi
push esi
push 1
push 0x51
push 0x634b1c
call edi
push esi
call dword [0x4851f0]
add esp, 0x24
pop edi
pop esi
add esp, 0x208
ret
mov edi, 0x637434
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x634b70
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.mj.chinesegamer.net
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x634b1c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x208
ret
Function at 0x40b070
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
push ebx
push ebp
push esi
push edi
call fcn.00401950
push 0
push 0x3ff00000
push 0
push 0
mov edi, eax
mov eax, dword [0x6349a8]
push 0x3e8
push 0
push 0x32
push eax
push 0x145
push 0xffffff47
push edi
mov dword [esp + 0x40], edi
call fcn.00401b10
add esp, 0x2c
mov esi, 0x14
push 0
call fcn.0040b920
push 0
push 0x1e
push edi
call fcn.004026c0
add esp, 0x10
call fcn.004454f0
dec esi
jne 0x40b0ba
xor ebx, ebx
mov esi, 0x15e
lea edi, [esp + 0x20]
call fcn.00401950
mov edx, dword [0x6349a8]
push 0
push 0x3ff00000
push 0
mov cl, bl
push 0
push 0x3e8
add cl, 0x30
push 0
push ecx
push edx
push 0x15e
push esi
push eax
mov dword [edi], eax
call fcn.00401b10
add esp, 0x2c
add esi, 0xaa
inc ebx
add edi, 4
cmp esi, 0x2b2
jl 0x40b0e1
mov eax, dword [0x66c0a8]
mov ecx, dword [0x66c0d0]
push 0
push 0x40b2f0
push eax
push 0x85
push ecx
call dword [0x48531c]
mov esi, eax
mov eax, dword [0x66c0a8]
lea edx, [esp + 0x38]
push edx
push eax
call dword [0x485314]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, dword [0x66c0a8]
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
push ecx
call dword [0x485324]
lea edx, [esp + 0x28]
push edx
push esi
call dword [0x485320]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov ebp, dword [esp + 0x28]
sub eax, edx
mov edx, dword [esp + 0x1c]
push 1
push eax
mov eax, dword [esp + 0x20]
sub ecx, ebp
add edx, 0xec
push ecx
add eax, 0x17c
push edx
push eax
push esi
call dword [0x485328]
push 0x3e8
push esi
call dword [0x485330]
push eax
call dword [0x485334]
push 5
push esi
call dword [0x485344]
mov ebp, dword [esp + 0x24]
push 0
call fcn.0040b920
call fcn.004454f0
push 1
call fcn.004234d0
add esp, 8
test eax, eax
je 0x40b226
call fcn.00423480
mov edi, eax
call fcn.00423490
mov ecx, dword [esp + 0x20]
mov ebx, eax
push ebx
push edi
push ecx
call fcn.00402b00
add esp, 0xc
test eax, eax
jne 0x40b243
push ebx
push edi
push ebp
call fcn.00402b00
add esp, 0xc
test eax, eax
jne 0x40b24f
cmp dword [0x66c0e0], 1
je 0x40b259
mov eax, dword [0x634bc4]
test eax, eax
jne 0x40b262
mov eax, dword [0x634b18]
test eax, eax
jne 0x40b275
jmp 0x40b1dc
mov dword [0x634bc4], 1
jmp 0x40b262
mov dword [0x634b18], 1
mov eax, dword [0x634bc4]
test eax, eax
je 0x40b275
push 0x51
push 0x634b70
push 0x3e8
push esi
call dword [0x485340]
push esi
call dword [0x485348]
lea esi, [esp + 0x20]
mov edi, 2
mov edx, dword [esi]
push edx
call fcn.00401a90
add esp, 4
add esi, 4
dec edi
jne 0x40b285
push 0
call fcn.0040b920
add esp, 4
mov esi, 0x14
push 0
call fcn.0040b920
mov eax, dword [esp + 0x18]
push 0
push 0x1e
push eax
call fcn.004026c0
add esp, 0x10
call fcn.004454f0
dec esi
jne 0x40b2a5
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00401a90
mov ecx, dword [0x634bc4]
add esp, 4
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b420
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
push edi
push 0x104
push eax
call dword [0x485060]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 7], 0x5c
je 0x40b461
lea ecx, [esp + 8]
lea edx, [esp + 0x10c]
push ecx
push str._sigsmj2002.no
push edx
jmp 0x40b473
lea eax, [esp + 8]
lea ecx, [esp + 0x10c]
push eax
push 0x4933ac
push ecx
call dword [0x48534c]
add esp, 0xc
lea edx, [esp + 0x10c]
push 0x4933a8
push edx
call dword [0x485200]
mov esi, eax
add esp, 8
test esi, esi
je 0x40b4c0
mov edi, dword [0x485220]
push esi
push 1
push 0x51
push 0x634b70
call edi
push esi
push 1
push 0x51
push 0x634b1c
call edi
push esi
call dword [0x4851f0]
add esp, 0x24
pop edi
pop esi
add esp, 0x208
ret
Function at 0x411ed0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x94
push ebx
push ebp
push esi
mov esi, dword [esp + 0xa4]
push 0x4921c8
push esi
call dword [0x485200]
mov ebx, eax
xor ebp, ebp
add esp, 8
cmp ebx, ebp
mov dword [esp + 0xc], ebx
jne 0x411f15
push esi
push 0x493658
call fcn.00445450
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
push ebx
push 0x80
lea eax, [esp + 0x28]
push 1
push eax
call dword [0x48520c]
add esp, 0x10
cmp eax, 0x80
jne 0x4120f7
cmp byte [esp + 0x20], 0xa
jne 0x4120f7
cmp byte [esp + 0x21], 5
jne 0x4120f7
push edi
push 0x10
call fcn.004225a0
mov esi, eax
mov dword [esp + 0x24], esi
mov byte [esi], 0
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x2c]
inc ecx
mov word [esi + 2], cx
mov edx, dword [esp + 0x32]
sub edx, dword [esp + 0x2e]
movsx ecx, cx
lea eax, [edx + 1]
movsx edx, ax
imul ecx, edx
push ecx
mov word [esi + 4], ax
call fcn.004225a0
add esp, 8
cmp word [esi + 4], bp
mov edi, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jle 0x412040
xor ebp, ebp
push ebx
call dword [0x485228]
mov cl, al
add esp, 4
and cl, 0xc0
cmp cl, 0xc0
jne 0x4120ee
mov edx, dword [esp + 0x10]
and al, 0x3f
push edx
mov bl, al
call dword [0x485228]
add esp, 4
mov cl, bl
dec bl
test cl, cl
mov byte [esp + 0x1c], bl
je 0x412010
mov esi, dword [esp + 0x1c]
mov bl, al
and esi, 0xff
add edi, ebp
inc esi
mov bh, bl
mov ecx, esi
mov eax, ebx
mov edx, ecx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
add ebp, esi
mov esi, dword [esp + 0x20]
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x66]
and eax, 0xffff
cmp ebp, eax
jl 0x411fa7
movsx ecx, word [esi + 2]
mov eax, dword [esp + 0x14]
add edi, ecx
movsx edx, word [esi + 4]
inc eax
mov dword [esp + 0x18], edi
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x411fa5
mov eax, dword [esp + 0xac]
test eax, eax
je 0x4120d1
push 0x200
call fcn.004225a0
push 0x300
mov dword [esi + 0xc], eax
call fcn.004225e0
push ebx
mov edi, eax
call dword [0x485228]
add esp, 0xc
cmp eax, 0xc
jne 0x4120d1
push ebx
push 0x300
push 1
push edi
call dword [0x48520c]
add esp, 0x10
cmp eax, 0x300
jne 0x4120d1
xor ecx, ecx
lea eax, [edi + 2]
mov dl, byte [eax - 2]
add ecx, 2
and dl, 0xf8
add eax, 3
movzx di, dl
mov dl, byte [eax - 4]
and dl, 0xf8
movzx dx, dl
shl edi, 5
add edi, edx
mov dl, byte [eax - 3]
shr dl, 3
movzx dx, dl
cmp ecx, 0x200
lea edx, [edx + edi*4]
mov edi, dword [esi + 0xc]
mov word [ecx + edi - 2], dx
jl 0x412095
push esi
call fcn.00411e50
push ebx
call dword [0x4851f0]
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
mov byte [edi + ebp], al
inc ebp
jmp 0x412014
push ebx
call dword [0x4851f0]
push esi
push 0x493640
call fcn.00445450
add esp, 0xc
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
Function at 0x412ae0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x94
push ebx
push ebp
mov ebp, dword [esp + 0xa0]
push esi
push edi
push ebp
push 0x80
lea eax, [esp + 0x2c]
push 1
push eax
call dword [0x48520c]
push 0x10
call fcn.004225a0
mov esi, eax
mov dword [esp + 0x30], esi
mov byte [esi], 0
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
inc ecx
mov word [esi + 2], cx
mov edx, dword [esp + 0x42]
mov ebx, dword [esp + 0x3e]
mov dword [esi + 0xc], 0
sub edx, ebx
inc edx
movsx eax, dx
movsx ecx, cx
imul eax, ecx
push eax
mov word [esi + 4], dx
call fcn.004225a0
mov edx, dword [esp + 0xc4]
mov dword [esi + 8], eax
lea edi, [edx - 0x80]
push edi
call fcn.004225e0
push ebp
mov ebx, eax
push 1
push edi
push ebx
call dword [0x48520c]
mov edi, dword [esi + 8]
add esp, 0x2c
cmp word [esi + 4], 0
mov ecx, ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 0
jle 0x412c14
xor ebp, ebp
mov al, byte [ecx]
inc ecx
mov dl, al
and dl, 0xc0
cmp dl, 0xc0
jne 0x412be4
mov dl, byte [ecx]
and al, 0x3f
inc ecx
mov bl, al
dec al
mov dword [esp + 0x20], ecx
test bl, bl
mov byte [esp + 0x18], al
je 0x412be8
mov esi, dword [esp + 0x18]
mov al, dl
and esi, 0xff
mov bl, al
add edi, ebp
inc esi
mov bh, bl
mov ecx, esi
mov eax, ebx
mov edx, ecx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
add ebp, esi
mov esi, dword [esp + 0x1c]
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
jmp 0x412be8
mov byte [edi + ebp], al
inc ebp
mov eax, dword [esp + 0x66]
and eax, 0xffff
cmp ebp, eax
jl 0x412b87
movsx edx, word [esi + 2]
mov eax, dword [esp + 0x14]
add edi, edx
movsx edx, word [esi + 4]
inc eax
mov dword [esp + 0x10], edi
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x412b85
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret

Function at 0x412c30
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [0x48520c]
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push edi
push 4
push 1
push eax
call ebx
push edi
push 4
lea ecx, [esp + 0x24]
push 1
push ecx
call ebx
push 0x10
call fcn.004225a0
mov esi, eax
mov byte [esi], 1
mov dx, word [esp + 0x38]
mov word [esi + 2], dx
mov ax, word [esp + 0x30]
movsx ecx, ax
movsx edx, dx
imul ecx, edx
shl ecx, 1
push ecx
mov word [esi + 4], ax
mov dword [esi + 0xc], 0
call fcn.004225a0
movsx ecx, word [esi + 4]
movsx edx, word [esi + 2]
imul ecx, edx
push edi
push 1
shl ecx, 1
push ecx
push eax
mov dword [esi + 8], eax
call ebx
add esp, 0x38
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x412cb0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [0x48520c]
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x14]
push edi
push 4
push 1
push eax
call ebx
push edi
push 4
lea ecx, [esp + 0x24]
push 1
push ecx
call ebx
push 0x10
call fcn.004225a0
mov esi, eax
mov byte [esi], 2
mov dx, word [esp + 0x38]
mov word [esi + 2], dx
mov ax, word [esp + 0x30]
movsx ecx, ax
movsx edx, dx
imul ecx, edx
shl ecx, 1
push ecx
mov word [esi + 4], ax
mov dword [esi + 0xc], 0
call fcn.004225a0
movsx ecx, word [esi + 4]
movsx edx, word [esi + 2]
imul ecx, edx
push edi
push 1
shl ecx, 1
push ecx
push eax
mov dword [esi + 8], eax
call ebx
add esp, 0x38
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x412e30
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x10
call fcn.004225a0
mov ebx, dword [esp + 0x18]
mov ebp, dword [0x48520c]
mov esi, eax
push ebx
push 1
push 2
lea edi, [esi + 2]
mov byte [esi], 0
push edi
call ebp
push ebx
lea eax, [esi + 4]
push 1
push 2
push eax
call ebp
movsx eax, word [esi + 4]
movsx ecx, word [edi]
imul eax, ecx
push eax
mov dword [esi + 0xc], 0
call fcn.004225a0
mov edx, dword [esp + 0x40]
mov dword [esi + 8], eax
lea edi, [edx - 4]
push edi
call fcn.004225e0
push ebx
push 1
push edi
push eax
mov dword [esp + 0x50], eax
call ebp
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x50]
push edi
push eax
push ecx
call fcn.00412d30
add esp, 0x48
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x412eb0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x10
call fcn.004225a0
mov edi, dword [esp + 0x1c]
mov ebx, dword [0x48520c]
mov esi, eax
push edi
push 1
push 2
lea eax, [esi + 2]
mov byte [esi], 3
push eax
call ebx
push edi
push 1
lea ecx, [esi + 4]
push 2
push ecx
call ebx
push edi
push 1
lea edx, [esp + 0x3c]
push 4
push edx
call ebx
mov dword [esi + 0xc], 0
mov eax, dword [esp + 0x44]
push eax
call fcn.004225a0
mov ecx, dword [esp + 0x54]
mov dword [esi + 8], eax
lea ebp, [ecx - 8]
push ebp
call fcn.004225e0
push edi
push 1
push ebp
push eax
mov dword [esp + 0x64], eax
call ebx
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x64]
add esp, 0x4c
push ebp
push edx
push eax
call fcn.00412d30
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x412f40
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x10
call fcn.004225a0
mov ebx, dword [esp + 0x18]
mov ebp, dword [0x48520c]
mov esi, eax
push ebx
push 1
push 2
lea edi, [esi + 2]
mov byte [esi], 1
push edi
call ebp
push ebx
lea eax, [esi + 4]
push 1
push 2
push eax
call ebp
movsx eax, word [esi + 4]
movsx ecx, word [edi]
imul eax, ecx
shl eax, 1
push eax
mov dword [esi + 0xc], 0
call fcn.004225a0
mov edx, dword [esp + 0x40]
mov dword [esi + 8], eax
lea edi, [edx - 4]
push edi
call fcn.004225e0
push ebx
push 1
push edi
push eax
mov dword [esp + 0x50], eax
call ebp
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x50]
push edi
push eax
push ecx
call fcn.00412d30
add esp, 0x48
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x412fc0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x10
call fcn.004225a0
mov ebx, dword [esp + 0x18]
mov ebp, dword [0x48520c]
mov esi, eax
push ebx
push 1
push 2
lea edi, [esi + 2]
mov byte [esi], 2
push edi
call ebp
push ebx
lea eax, [esi + 4]
push 1
push 2
push eax
call ebp
movsx eax, word [esi + 4]
movsx ecx, word [edi]
imul eax, ecx
shl eax, 1
push eax
mov dword [esi + 0xc], 0
call fcn.004225a0
mov edx, dword [esp + 0x40]
mov dword [esi + 8], eax
lea edi, [edx - 4]
push edi
call fcn.004225e0
push ebx
push 1
push edi
push eax
mov dword [esp + 0x50], eax
call ebp
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x50]
push edi
push eax
push ecx
call fcn.00412d30
add esp, 0x48
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x415970
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x66c0a8]
mov ecx, dword [0x66c0d0]
push esi
push edi
push 0
push 0x4159f0
push eax
push 0x6b
push ecx
mov byte [0x639d7c], 0
call dword [0x48531c]
mov esi, eax
push 5
push esi
call dword [0x485344]
call fcn.004454f0
mov eax, dword [0x66c0e0]
cmp eax, 1
je 0x4159be
mov cl, byte [0x639d7c]
test cl, cl
je 0x4159a0
cmp eax, 1
jne 0x4159c7
push 1
push esi
call dword [0x4852f8]
mov edi, 0x63ac84
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
mov eax, ecx
pop esi
neg eax
sbb eax, eax
neg eax
ret

Function at 0x415f90
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x190
xor eax, eax
push ebx
lea ebx, [ecx + 0xef4]
push edi
mov ecx, 0x40
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x101
call fcn.00445772
test eax, eax
je 0x415fc7
pop edi
xor eax, eax
pop ebx
add esp, 0x190
ret
push 0x634b1c
call fcn.0044576c
test eax, eax
jne 0x415fe5
call fcn.00445766
pop edi
xor eax, eax
pop ebx
add esp, 0x190
ret
mov ecx, dword [eax + 0xc]
push esi
mov eax, dword [ecx]
mov edx, dword [eax]
push edx
call fcn.00445760
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00445766
pop esi
pop edi
mov eax, 1
pop ebx
add esp, 0x190
ret