joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042d0
Capabilities:
Read file on windows

Disassembly:
test eax, eax
je 0x4042ea
push ecx
push 1
push eax
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x4042ea
xor eax, eax
ret
mov eax, 1
ret

Function at 0x4042f0
Capabilities:
Terminate process
Write file on windows

Disassembly:
test eax, eax
je 0x40432f
push ecx
push 1
push eax
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x40432f
push str._Unable_to_write._Full_disk__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00404c60
inc dword [0x437d8c]
je 0x404327
call fcn.004048c0
push 5
call dword [sym.imp.MSVCR100.dll_exit]
ret

Function at 0x404330
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
mov ecx, dword [0x43811c]
test edx, edx
je 0x404418
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
test edx, edx
jle 0x4043ca
mov edx, dword [ebp + 0x10]
add edx, edx
add edx, edx
push ebx
add edx, edx
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
nop
xor edi, edi
mov ecx, ebx
test esi, esi
js 0x4043bc
lea edx, [esi + 1]
cmp edx, 4
jl 0x4043a0
shr edx, 2
lea edi, [edx*4]
lea ebx, [ebx]
fld qword [ecx]
add eax, 0x20
fstp qword [eax - 0x20]
add ecx, 0x20
dec edx
fld qword [ecx - 0x18]
fstp qword [eax - 0x18]
fld qword [ecx - 0x10]
fstp qword [eax - 0x10]
fld qword [ecx - 8]
fstp qword [eax - 8]
jne 0x404380
cmp edi, esi
jg 0x4043bc
mov edx, esi
sub edx, edi
sub ecx, eax
inc edx
jmp 0x4043b0
fld qword [ecx + eax]
add eax, 8
dec edx
fstp qword [eax - 8]
jne 0x4043b0
add ebx, dword [ebp - 4]
inc esi
cmp esi, dword [ebp + 8]
jl 0x404360
mov edx, dword [ebp + 8]
pop edi
pop ebx
mov eax, dword [0x438058]
mov ecx, dword [ebp + 0xc]
push eax
lea eax, [edx + 1]
imul eax, edx
add eax, eax
push 1
add eax, eax
push eax
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
pop esi
cmp eax, 1
je 0x404418
push str._Unable_to_write._Full_disk__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00404c60
inc dword [0x437d8c]
je 0x404410
call fcn.004048c0
push 5
call dword [sym.imp.MSVCR100.dll_exit]
mov esp, ebp
pop ebp
ret
Function at 0x404420
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x438058]
push ebx
mov ebx, dword [0x43811c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x40444a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
push eax
lea eax, [esi + 1]
imul eax, esi
add eax, eax
push 1
add eax, eax
push eax
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x404477
push str.bad_dreadmat
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp esi, eax
jle 0x4045a9
lea edx, [ebx + edi*8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], ebx
xor edx, edx
mov dword [ebp - 0x10], edx
test eax, eax
js 0x404587
lea esi, [eax + 1]
mov dword [ebp - 0x28], esi
cmp esi, 4
jl 0x404541
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], ebx
lea ebx, [eax + edi*2]
add ebx, edi
mov edx, edi
mov edi, dword [ebp - 0x14]
lea ebx, [edi + ebx*8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0x10]
lea ebx, [eax + ebx*2]
lea edi, [edi + ebx*8]
mov ebx, dword [ebp - 0x28]
shr ebx, 2
mov dword [ebp - 0x28], ebx
add ebx, ebx
shl edx, 5
add ebx, ebx
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
lea ebx, [ebx]
fld qword [ecx]
mov ebx, dword [ebp - 4]
fstp qword [esi]
add dword [ebp - 4], edx
fld qword [ecx]
add ecx, 0x20
fstp qword [ebx]
mov ebx, dword [ebp - 8]
fld qword [ecx - 0x18]
add dword [ebp - 8], edx
fstp qword [esi + 8]
add esi, 0x20
fld qword [ecx - 0x18]
fstp qword [edi]
add edi, edx
fld qword [ecx - 0x10]
fstp qword [esi - 0x10]
fld qword [ecx - 0x10]
fstp qword [ebx]
mov ebx, dword [ebp - 0xc]
fld qword [ecx - 8]
add dword [ebp - 0xc], edx
dec dword [ebp - 0x28]
fstp qword [esi - 8]
fld qword [ecx - 8]
fstp qword [ebx]
jne 0x4044f0
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp edx, eax
jg 0x404587
mov esi, dword [ebp - 0x20]
add esi, edx
imul edx, edi
add edx, eax
lea edx, [ebx + edx*8]
mov dword [ebp - 0x28], edx
mov edx, eax
sub edx, dword [ebp - 0x10]
lea esi, [ebx + esi*8]
mov ebx, dword [ebp - 0x28]
inc edx
jmp 0x404566
mov esi, dword [ebp - 0x28]
fld qword [ecx]
add esi, 8
fstp qword [esi - 8]
mov dword [ebp - 0x28], esi
fld qword [ecx]
lea esi, [edi*8]
fstp qword [ebx]
add ecx, 8
add ebx, esi
dec edx
jne 0x404563
mov ebx, dword [ebp - 0x14]
add dword [ebp - 0x20], edi
mov edx, 8
add dword [ebp - 0x18], edx
add dword [ebp - 0x1c], edx
lea edx, [edi*8]
add dword [ebp - 0x24], edx
inc eax
cmp eax, dword [ebp + 8]
jl 0x404493
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_printf]
push esi
mov esi, dword [sym.imp.MSVCR100.dll_tolower]
push edi
xor edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x14], edi
mov ecx, dword [ebp - 0x18]
push ecx
push 0x42f9f8
call ebx
call dword [sym.imp.MSVCR100.dll___iob_func]
push eax
lea edx, [ebp - 0xc]
push 5
push edx
call dword [sym.imp.MSVCR100.dll_fgets]
movsx eax, byte [ebp - 0xc]
push eax
call esi
add esp, 0x18
cmp eax, 0x6e
jne 0x404976
mov dword [ebp - 0x10], 0
inc edi
movsx ecx, byte [ebp - 0xc]
push ecx
call esi
add esp, 4
cmp eax, 0x79
jne 0x40498d
mov dword [ebp - 0x10], 1
inc edi
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 9
jg 0x4049b1
test edi, edi
je 0x404941
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e325
mov esp, ebp
pop ebp
ret
push str.Unable_to_get_a_proper_response__n
push 0x43225c
call ebx
add esp, 8
call fcn.00404c60
inc dword [0x437d8c]
je 0x4049d2
call fcn.004048c0
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x4049e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_fgets]
xor eax, eax
push esi
mov esi, dword [sym.imp.MSVCR100.dll_printf]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
push edi
push 0x42f9f8
call esi
call dword [sym.imp.MSVCR100.dll___iob_func]
push eax
lea eax, [ebp - 0xc]
push 5
push eax
call ebx
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCR100.dll_atol]
add esp, 0x18
cmp eax, dword [ebp + 8]
jl 0x404a37
cmp eax, dword [ebp + 0xc]
jg 0x404a37
inc dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 9
jg 0x404a59
cmp dword [ebp - 0x10], 0
je 0x404a06
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e325
mov esp, ebp
pop ebp
ret
push str.Unable_to_get_a_proper_response__n
push 0x43225c
call esi
add esp, 8
call fcn.00404c60
inc dword [0x437d8c]
je 0x404a7a
call fcn.004048c0
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x404a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll___iob_func]
push esi
mov esi, dword [sym.imp.MSVCR100.dll_printf]
xor eax, eax
push edi
mov edi, dword [sym.imp.MSVCR100.dll_fgets]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
jmp 0x404ac2
fstp st(0)
push 0x42fa20
push 0x42f9f8
call esi
call ebx
push eax
lea eax, [ebp - 0x20]
push 0x19
push eax
call edi
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.MSVCR100.dll_atof]
fld qword [0x436270]
fcomp st(1)
add esp, 0x18
fnstsw ax
test ah, 0x41
jp 0x404b07
fld qword [0x436268]
fcomp st(1)
fnstsw ax
test ah, 1
jne 0x404b07
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 9
jg 0x404b2a
cmp dword [ebp - 0x24], 0
je 0x404ac0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e325
mov esp, ebp
pop ebp
ret
push str.Unable_to_get_a_proper_response__n
fstp st(0)
push 0x43225c
call esi
add esp, 8
call fcn.00404c60
inc dword [0x437d8c]
je 0x404b4d
call fcn.004048c0
push 0x64
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x404b60
Capabilities:
Terminate process

Disassembly:
push esi
test edi, edi
jne 0x404b69
xor eax, eax
pop esi
ret
push edi
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x404ba1
push str._Out_of_memory._Please_run_a_smaller_problem_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00404c60
inc dword [0x437d8c]
je 0x404b99
call fcn.004048c0
push 3
call dword [sym.imp.MSVCR100.dll_exit]
push edi
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x404bc0
Capabilities:
Terminate process

Disassembly:
push str._Out_of_memory._Please_run_a_smaller_problem_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00404c60
inc dword [0x437d8c]
je 0x404be0
call fcn.004048c0
push 3
call dword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x404c60
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_fclose]
push esi
push edi
mov esi, 0x439784
xor edi, edi
cmp dword [esi + 4], edi
je 0x404cb7
mov eax, dword [esi - 4]
push eax
call ebx
mov eax, dword [esi]
add esp, 4
mov dword [esi + 4], edi
mov dword [esi - 4], edi
cmp eax, edi
je 0x404cb7
push edi
push eax
call dword [sym.imp.MSVCR100.dll__access]
add esp, 8
test eax, eax
jne 0x404cb7
mov ecx, dword [esi]
push ecx
call dword [sym.imp.MSVCR100.dll_remove]
mov eax, dword [esi]
add esp, 4
cmp eax, edi
je 0x404cb5
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov dword [esi], edi
add esi, 0xc
cmp esi, 0x4399dc
jl 0x404c70
pop edi
pop esi
pop ebx
ret
Function at 0x405100
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x48
lea eax, [ebp - 0x58]
push 0x24
push eax
mov esi, ecx
call sub.MSVCR100.dll_memset
mov ecx, dword [0x437c5c]
lea ebx, [esi*8]
sub ebx, esi
add ebx, ebx
push 0
add ebx, ebx
push 0
add ebx, ebx
mov esi, dword [ebx + ecx]
push 0
push esi
mov byte [ebp - 0x10], 0
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x64], 0
call dword [sym.imp.MSVCR100.dll__fseeki64]
mov edi, dword [sym.imp.MSVCR100.dll_fread]
push esi
push 1
lea edx, [ebp - 0x59]
push 1
push edx
call edi
push esi
push 1
lea eax, [ebp - 0x59]
push 1
push eax
call edi
push esi
push 1
lea ecx, [ebp - 0x64]
push 2
push ecx
call edi
add esp, 0x4c
push esi
push 1
lea edx, [ebp - 0x68]
push 2
push edx
call edi
push esi
push 1
lea eax, [ebp - 0x60]
push 2
push eax
call edi
push esi
push 1
lea ecx, [ebp - 0x59]
push 1
push ecx
call edi
add esp, 0x30
cmp word [ebp - 0x60], 0
jg 0x40520d
push 0x48
lea edx, [ebp - 0x58]
push edx
push 0x4385a1
mov byte [0x4385a1], 0
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x4051f4
lea ecx, [ecx]
push esi
push 1
push 0x4a
push 0x4385a0
call edi
push 0x48
lea eax, [ebp - 0x58]
push eax
push 0x4385a1
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0x1c
test eax, eax
jne 0x4051d0
push esi
push 1
lea ecx, [ebp - 0x59]
push 1
push ecx
call edi
push esi
push 1
lea edx, [ebp - 0x64]
push 2
push edx
call edi
add esp, 0x20
mov ecx, dword [ebp - 0x64]
test cx, cx
je 0x405219
xor eax, eax
jmp 0x40521c
mov eax, dword [ebp - 0x6c]
mov edx, dword [0x437c5c]
movsx ecx, cx
mov dword [ebx + edx + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e325
mov esp, ebp
pop ebp
ret
Function at 0x405bb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x104], esi
cmp dword [ebp + 8], ebx
jle 0x405cd8
lea edi, [eax + 0x14]
mov eax, dword [0x4399dc]
test eax, eax
je 0x405c0d
push esi
push 1
push eax
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x405d3d
movzx ecx, word [ebp - 0xf0]
mov esi, dword [sym.imp.MSVCR100.dll__swab]
push 2
lea edx, [ebp - 0xfc]
push edx
lea eax, [ebp - 0xf8]
push eax
mov dword [ebp - 0xf8], ecx
call esi
mov cx, word [ebp - 0xfc]
movzx edx, word [ebp - 0xec]
push 2
lea eax, [ebp - 0x100]
mov word [edi - 0x14], cx
push eax
lea ecx, [ebp - 0xf8]
push ecx
mov dword [ebp - 0xf8], edx
call esi
mov al, byte [ebp - 0x99]
mov cl, byte [ebp - 0x9a]
mov dx, word [ebp - 0x100]
mov byte [ebp - 0xf4], al
mov eax, dword [ebp - 0x9c]
mov byte [ebp - 0xf3], cl
push 8
lea ecx, [ebp - 0xe8]
mov byte [ebp - 0xf2], ah
mov byte [ebp - 0xf1], al
mov word [edi - 0x12], dx
mov edx, dword [ebp - 0xf4]
push ecx
xor eax, eax
lea esi, [edi - 0xe]
push esi
mov dword [edi], edx
mov word [edi - 0x10], ax
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0x24
mov eax, 8
call fcn.004045b0
mov esi, dword [ebp - 0x104]
inc ebx
add edi, 0x1c
cmp ebx, dword [ebp + 8]
jl 0x405be7
mov edi, dword [ebp - 0x108]
mov eax, dword [0x4399dc]
imul eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0x50
div ecx
test edx, edx
je 0x405cf4
mov eax, ecx
sub eax, edx
jmp 0x405cf6
xor eax, eax
cdq
push 1
push edx
push eax
push esi
call dword [sym.imp.MSVCR100.dll__fseeki64]
push esi
push 1
lea edx, [ebp - 0x60]
push 0x50
push edx
call dword [sym.imp.MSVCR100.dll_fread]
push 0x17
lea eax, [ebp - 0x60]
push str.HEADER_RECORDOBS
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0x2c
test eax, eax
je 0x405d50
push str.SAS_transport
push edi
push str.The_level__d_file_does_not_seem_to_be_a__s_file__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e325
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.MSVCR100.dll__ftelli64]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [edi*8 + 0x437c40], eax
mov dword [edi*8 + 0x437c44], edx
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0042e325
mov esp, ebp
pop ebp
ret
Function at 0x405f50
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea edx, [ebp - 0x108]
mov eax, edi
sub edx, edi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405f70
push ebx
lea eax, [ebp - 0x108]
push str..ssp
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x405fa5
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e325
mov esp, ebp
pop ebp
ret
mov ecx, dword [str..ssd]
push esi
mov dword [ebx], ecx
mov dl, byte [0x42fbc0]
lea eax, [ebp - 0x108]
push 0
push eax
mov byte [ebx + 4], dl
call dword [sym.imp.MSVCR100.dll__access]
add esp, 8
test eax, eax
jne 0x406098
mov esi, dword [sym.imp.MSVCR100.dll_printf]
lea ecx, [ebp - 0x108]
push ecx
push edi
push str.I_dont_see__s__but_I_do_see__s._n
call esi
push str.Would_you_like_me_to_convert_it_to_a_transport_file_
call fcn.00404910
add esp, 0x10
test eax, eax
je 0x406098
push str.Give_me_a_moment_to_run_the_SAS_job..._n
call esi
push 0x42fc48
push str.xyzzy.sas
call dword [sym.imp.MSVCR100.dll_fopen]
push edi
mov esi, eax
push str.libname_tranfile_sasv5xpt_.__s__nlibname_fileout__.___n
push esi
call dword [sym.imp.MSVCR100.dll_fprintf]
lea edx, [ebp - 0x108]
push edx
push str.proc_copy_infileout_outtranfile__nselect__s__nrun__n
push esi
mov byte [ebx], 0
call dword [sym.imp.MSVCR100.dll_fprintf]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
push str.sas_xyzzy.sas
call dword [sym.imp.MSVCR100.dll_system]
mov esi, dword [sym.imp.MSVCR100.dll_remove]
push str.xyzzy.sas
call esi
add esp, 0x30
test edi, edi
je 0x406098
push 0
push edi
call dword [sym.imp.MSVCR100.dll__access]
add esp, 8
test eax, eax
jne 0x406098
push edi
push str.Please_keep__s_around_if_you_want_to_do_a_non_linear_run._n
call dword [sym.imp.MSVCR100.dll_printf]
push str.xyzzy.log
call esi
add esp, 0xc
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042e325
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042e325
mov esp, ebp
pop ebp
ret
Function at 0x4060b0
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov ecx, dword [0x437c5c]
push esi
lea eax, [ebx*8]
sub eax, ebx
add eax, eax
push edi
add eax, eax
add eax, eax
mov edi, dword [eax + ecx]
push edi
lea esi, [ebx + ebx*4]
add esi, esi
push 1
add esi, esi
lea edx, [ebp - 0x44]
push 4
add esi, esi
push edx
mov dword [ebp - 0x4c], eax
mov dword [esi + 0x437db0], 8
call dword [sym.imp.MSVCR100.dll_fread]
push 4
lea eax, [ebp - 0x44]
push str._FL2
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0x1c
test eax, eax
je 0x40615c
mov esi, dword [sym.imp.MSVCR100.dll_printf]
push str.SPSS
lea ecx, [ebx + 1]
push ecx
push str.The_level__d_file_does_not_seem_to_be_a__s_file__n
call esi
mov ebx, dword [ebx*4 + 0x438510]
push ebx
push str.__s_is_an_empty_file_n
call esi
add esp, 0x14
call fcn.00404c60
inc dword [0x437d8c]
je 0x406154
call fcn.004048c0
push 1
call dword [sym.imp.MSVCR100.dll_exit]
push 1
push 0
push 0x3c
push edi
call dword [sym.imp.MSVCR100.dll__fseeki64]
push edi
push 1
lea edx, [ebp - 0x48]
push 4
push edx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x20
cmp dword [ebp - 0x48], 3
ja 0x406228
mov ebx, dword [sym.imp.MSVCR100.dll_fread]
push edi
push 1
lea eax, [ebp - 0x48]
push 4
push eax
call ebx
mov ecx, dword [ebp - 0x48]
push edi
push 1
lea edx, [ebp - 0x48]
push 4
push edx
mov dword [esi + 0x437da0], ecx
call ebx
mov eax, dword [ebp - 0x48]
push edi
push 1
lea ecx, [ebp - 0x48]
push 4
push ecx
mov dword [esi + 0x437da4], eax
call ebx
mov edx, dword [ebp - 0x48]
push edi
push 1
lea eax, [ebp - 0x48]
push 4
push eax
mov dword [esi + 0x437da8], edx
call ebx
mov ecx, dword [ebp - 0x48]
add esp, 0x40
push edi
push 1
lea edx, [ebp - 0x58]
push 8
push edx
mov dword [esi + 0x437dac], ecx
call ebx
fld qword [ebp - 0x58]
push 1
fstp qword [esi + 0x437db8]
push 0
push 0x54
push edi
call dword [sym.imp.MSVCR100.dll__fseeki64]
mov eax, dword [esi + 0x437da0]
mov ecx, dword [0x437c5c]
mov edx, dword [ebp - 0x4c]
add esp, 0x20
mov dword [edx + ecx + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0042e325
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll_printf]
push str.SPSS
lea eax, [ebx + 1]
push eax
push str.The_level__d_file_does_not_seem_to_be_a__s_file__n
call esi
mov ebx, dword [ebx*4 + 0x438510]
push ebx
push str.__s_is_an_empty_file_n
call esi
add esp, 0x14
call fcn.00404c60
inc dword [0x437d8c]
je 0x406262
call fcn.004048c0
push 1
call dword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x407d90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x43925c]
inc esi
imul esi, esi, 0xd
push edi
test esi, esi
jne 0x407dac
xor ebx, ebx
mov dword [ebp - 4], ebx
jmp 0x407df5
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x407de4
push str._Out_of_memory._Please_run_a_smaller_problem_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00404c60
inc dword [0x437d8c]
je 0x407ddc
call fcn.004048c0
push 3
call dword [sym.imp.MSVCR100.dll_exit]
push esi
push 0
push edi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 4], edi
mov ebx, edi
mov esi, dword [0x438ed4]
inc esi
imul esi, esi, 0xd
mov dword [0x43924c], ebx
test esi, esi
jne 0x407e0d
xor edi, edi
jmp 0x407e51
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x407e45
push str._Out_of_memory._Please_run_a_smaller_problem_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00404c60
inc dword [0x437d8c]
je 0x407e3d
call fcn.004048c0
push 3
call dword [sym.imp.MSVCR100.dll_exit]
push esi
push 0
push edi
call sub.MSVCR100.dll_memset
add esp, 0xc
mov esi, dword [0x4390b0]
inc esi
imul esi, esi, 0xd
mov dword [0x4390c0], edi
test esi, esi
jne 0x407e69
xor eax, eax
jmp 0x407eb2
push esi
call dword [sym.imp.MSVCR100.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x407ea1
push str._Out_of_memory._Please_run_a_smaller_problem_n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
call fcn.00404c60
inc dword [0x437d8c]
je 0x407e99
call fcn.004048c0
push 3
call dword [sym.imp.MSVCR100.dll_exit]
push esi
push 0
push ebx
call sub.MSVCR100.dll_memset
mov eax, ebx
mov ebx, dword [ebp - 4]
add esp, 0xc
mov ecx, dword [0x4304b8]
mov dword [ebx], ecx
mov edx, dword [0x4304bc]
mov dword [ebx + 4], edx
mov ecx, dword [0x4304c0]
mov dword [ebx + 8], ecx
movzx edx, byte [0x4304c4]
mov byte [ebx + 0xc], dl
mov ecx, dword [0x4304c8]
mov dword [edi], ecx
mov edx, dword [0x4304cc]
mov dword [edi + 4], edx
mov ecx, dword [0x4304d0]
mov dword [edi + 8], ecx
movzx edx, byte [0x4304d4]
mov byte [edi + 0xc], dl
mov ecx, dword [str.INTRCPT3]
mov dword [eax], ecx
mov edx, dword [0x4304dc]
mov dword [eax + 4], edx
mov ecx, dword [0x4304e0]
mov dword [eax + 8], ecx
movzx edx, byte [0x4304e4]
pop edi
pop esi
mov dword [0x438524], eax
mov byte [eax + 0xc], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e430
Capabilities:
Terminate process

Disassembly:
push edi
push 1
push 0
mov edi, str.Enter_0_to_stop_iterating__1_to_exit_now
call fcn.004049e0
add esp, 8
sub eax, 0
pop edi
je 0x40e465
dec eax
jne 0x40e471
call fcn.00404c60
inc dword [0x437d8c]
je 0x40e45d
call fcn.004048c0
push 0
call dword [sym.imp.MSVCR100.dll_exit]
inc dword [0x438044]
inc dword [0x438048]
push 0x40e410
push 2
mov dword [0x438034], 0
call dword [sym.imp.MSVCR100.dll_signal]
add esp, 8
ret