joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410e40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x1c], 1
push edi
setne al
add eax, 3
mov dword [esp + 0xc], eax
lea eax, [ebx + 1]
shr eax, 1
and eax, 3
je 0x410e6c
mov edi, 4
sub edi, eax
mov dword [esp + 0x20], edi
jmp 0x410e78
mov dword [esp + 0x20], 0
mov edi, dword [esp + 0x20]
cmp dword [esp + 0x24], 0
mov dword [esp + 4], 0
jbe 0x410f6c
mov dword [esp + 8], 0
push ebp
xor ebp, ebp
test ebx, ebx
jbe 0x410f3b
mov edi, edi
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00428653
add esp, 4
cmp byte [esp + 0x2c], 0
mov edi, eax
je 0x410ec6
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 8]
dec ecx
imul ecx, ebx
add ecx, ebp
jmp 0x410ecd
mov edx, dword [esp + 0xc]
lea ecx, [edx + ebp]
mov eax, dword [esp + 0x20]
mov edx, edi
sar edx, 4
imul edx, dword [esp + 0x10]
add edx, eax
movzx eax, byte [edx]
add ecx, ecx
add ecx, ecx
mov byte [ecx + esi], al
movzx eax, byte [edx + 1]
mov byte [esi + ecx + 1], al
mov dl, byte [edx + 2]
lea eax, [ebp + 1]
mov byte [esi + ecx + 2], dl
mov byte [esi + ecx + 3], 0xff
cmp eax, ebx
jae 0x410f2c
mov edx, dword [esp + 0x20]
and edi, 0xf
imul edi, dword [esp + 0x10]
lea eax, [edi + edx]
movzx edx, byte [eax]
mov byte [ecx + esi + 4], dl
movzx edx, byte [eax + 1]
mov byte [ecx + esi + 5], dl
mov al, byte [eax + 2]
mov byte [ecx + esi + 6], al
mov byte [ecx + esi + 7], 0xff
add ebp, 2
cmp ebp, ebx
jb 0x410ea0
mov edi, dword [esp + 0x24]
test edi, edi
je 0x410f54
mov ecx, dword [esp + 0x1c]
push ecx
push 1
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.004294bd
add esp, 0x10
mov eax, dword [esp + 8]
add dword [esp + 0xc], ebx
inc eax
mov dword [esp + 8], eax
cmp eax, dword [esp + 0x28]
jb 0x410e94
pop ebp
pop edi
add esp, 0x10
ret

Function at 0x410f80
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [esp + 0x18], 1
push ebp
mov ebp, dword [esp + 0x20]
setne bl
mov eax, ebp
add ebx, 3
and eax, 3
je 0x410faa
mov ecx, 4
sub ecx, eax
mov dword [esp + 0x20], ecx
jmp 0x410fb6
mov dword [esp + 0x20], 0
mov ecx, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x24], eax
jbe 0x411063
mov dword [esp + 8], eax
push edi
jmp 0x410fd0
xor edi, edi
test ebp, ebp
jbe 0x41102e
mov eax, dword [esp + 0x18]
push eax
call fcn.00428653
add esp, 4
cmp byte [esp + 0x2c], 0
je 0x410ff8
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x20]
dec ecx
imul ecx, ebp
jmp 0x410ffc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
imul eax, ebx
add ecx, edi
add eax, edx
movzx edx, byte [eax]
add ecx, ecx
add ecx, ecx
mov byte [ecx + esi], dl
movzx edx, byte [eax + 1]
mov byte [esi + ecx + 1], dl
mov al, byte [eax + 2]
inc edi
mov byte [esi + ecx + 2], al
mov byte [esi + ecx + 3], 0xff
cmp edi, ebp
jb 0x410fd6
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x41104b
mov edx, dword [esp + 0x18]
push edx
push 1
push ecx
lea eax, [esp + 0x1c]
push eax
call fcn.004294bd
mov ecx, dword [esp + 0x34]
add esp, 0x10
mov eax, dword [esp + 0x20]
add dword [esp + 0xc], ebp
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x28]
jb 0x410fd0
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x411070
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x30]
neg eax
add eax, eax
and eax, 3
push ebp
mov dword [esp + 0x10], eax
push esi
xor esi, esi
mov eax, ebx
lea ecx, [esp + 0x18]
sub eax, ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], eax
jmp 0x4110b4
mov eax, dword [esp + 0x10]
lea ecx, [esp + esi + 0x18]
mov ebp, dword [eax + ecx]
mov eax, ebp
test al, 1
jne 0x4110cc
mov edx, dword [ecx]
shr eax, 1
inc edx
test al, 1
je 0x4110c3
mov dword [ecx], edx
mov ecx, dword [ecx]
shr ebp, cl
xor edx, edx
mov eax, 0xff
add esi, 4
div ebp
mov dword [esp + esi + 0x20], eax
cmp esi, 0xc
jb 0x4110b0
cmp dword [esp + 0x3c], 0
mov dword [esp + 8], 0
jbe 0x4111d0
mov dword [esp + 0xc], 0
xor ebp, ebp
cmp dword [esp + 0x38], ebp
jbe 0x411198
lea esp, [esp]
mov edx, dword [esp + 0x34]
push edx
push 1
lea eax, [esp + 0x18]
push 2
push eax
call fcn.004294bd
add esp, 0x10
cmp byte [esp + 0x40], 0
je 0x41113f
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 8]
dec eax
imul eax, dword [esp + 0x38]
add eax, ebp
jmp 0x411146
mov ecx, dword [esp + 0xc]
lea eax, [ecx + ebp]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov edx, esi
and edx, dword [ebx + 8]
add eax, eax
imul edx, dword [esp + 0x2c]
shr edx, cl
mov ecx, dword [esp + 0x1c]
add eax, eax
inc ebp
mov byte [eax + edi], dl
mov edx, esi
and edx, dword [ebx + 4]
imul edx, dword [esp + 0x28]
shr edx, cl
mov ecx, dword [esp + 0x18]
mov byte [edi + eax + 1], dl
mov edx, dword [ebx]
and edx, esi
imul edx, dword [esp + 0x24]
shr edx, cl
mov byte [edi + eax + 3], 0xff
mov byte [edi + eax + 2], dl
cmp ebp, dword [esp + 0x38]
jb 0x411110
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4111b5
mov ecx, dword [esp + 0x34]
push ecx
push 1
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.004294bd
add esp, 0x10
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x38]
add dword [esp + 0xc], ecx
inc eax
mov dword [esp + 8], eax
cmp eax, dword [esp + 0x3c]
jb 0x411100
pop esi
pop ebp
add esp, 0x28
ret
Function at 0x4111e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, ebp
and eax, 3
xor ebx, ebx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x1c], ebx
jbe 0x411298
mov dword [esp + 0x18], ebx
push esi
xor esi, esi
test ebp, ebp
jbe 0x41126b
lea esp, [esp]
mov eax, dword [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x14]
push 3
push ecx
call fcn.004294bd
add esp, 0x10
cmp byte [esp + 0x24], 0
je 0x41123b
mov eax, dword [esp + 0x20]
sub eax, ebx
dec eax
imul eax, ebp
add eax, esi
jmp 0x411242
mov edx, dword [esp + 0x1c]
lea eax, [edx + esi]
mov ecx, dword [esp + 0xc]
add eax, eax
add eax, eax
mov edx, ecx
mov byte [eax + edi], cl
shr edx, 8
shr ecx, 0x10
inc esi
mov byte [edi + eax + 1], dl
mov byte [edi + eax + 2], cl
mov byte [edi + eax + 3], 0xff
cmp esi, ebp
jb 0x411210
mov eax, dword [esp + 0x10]
test eax, eax
je 0x411288
mov ecx, dword [esp + 0x18]
push ecx
push 1
push eax
lea edx, [esp + 0x18]
push edx
call fcn.004294bd
mov eax, dword [esp + 0x20]
add esp, 0x10
add dword [esp + 0x1c], ebp
inc ebx
cmp ebx, dword [esp + 0x20]
jb 0x411203
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4112a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x20]
push edi
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
xor ecx, ecx
lea esp, [esp]
mov eax, dword [ecx + ebx]
cmp eax, edi
je 0x4112d5
test al, 1
jne 0x4112d5
inc dword [esp + ecx + 0x10]
shr eax, 1
cmp eax, edi
jne 0x4112c7
add ecx, 4
cmp ecx, 0xc
jb 0x4112c0
mov dword [esp + 0x24], edi
cmp dword [esp + 0x2c], edi
jbe 0x411389
mov dword [esp + 8], edi
push esi
cmp dword [esp + 0x2c], edi
jbe 0x41136d
mov eax, dword [esp + 0x24]
push eax
push 1
lea ecx, [esp + 0x18]
push 4
push ecx
call fcn.004294bd
add esp, 0x10
cmp byte [esp + 0x34], 0
je 0x411325
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
dec eax
imul eax, dword [esp + 0x2c]
add eax, edi
jmp 0x41132c
mov edx, dword [esp + 0xc]
lea eax, [edx + edi]
mov edx, dword [ebx + 8]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
and edx, esi
shr edx, cl
mov ecx, dword [esp + 0x18]
add eax, eax
add eax, eax
mov byte [eax + ebp], dl
mov edx, dword [ebx + 4]
and edx, esi
shr edx, cl
mov ecx, dword [esp + 0x14]
inc edi
mov byte [eax + ebp + 1], dl
mov edx, dword [ebx]
and edx, esi
shr edx, cl
mov byte [eax + ebp + 3], 0xff
mov byte [eax + ebp + 2], dl
cmp edi, dword [esp + 0x2c]
jb 0x4112f6
xor edi, edi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
add dword [esp + 0xc], ecx
inc eax
mov dword [esp + 0x28], eax
cmp eax, dword [esp + 0x30]
jb 0x4112f0
pop esi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x411a50
Capabilities:
Read file on windows

Disassembly:
cmp dword [edi + 0x2c], 1
push ebx
push ebp
mov ebp, dword [esp + 0xc]
lea ebx, [edi + 0x38]
jne 0x411a64
pop ebp
xor al, al
pop ebx
ret
mov ecx, dword [edi + 0x30]
push esi
cmp ecx, dword [edi + 0x34]
jne 0x411ac3
push ebp
call fcn.00428653
add esp, 4
cmp eax, 0xffffffff
jne 0x411a7d
xor eax, eax
movzx esi, al
mov dword [edi + 0x34], esi
test esi, esi
jne 0x411a94
pop esi
pop ebp
mov dword [edi + 0x2c], 1
xor al, al
pop ebx
ret
push ebp
push esi
push 1
push ebx
call fcn.004294bd
add esp, 0x10
cmp eax, esi
jge 0x411ab6
sub esi, eax
push esi
lea ecx, [eax + ebx]
push 0
push ecx
call fcn.004300c0
add esp, 0xc
mov al, byte [ebx]
pop esi
pop ebp
mov dword [edi + 0x30], 1
pop ebx
ret
mov al, byte [ecx + ebx]
pop esi
inc ecx
pop ebp
mov dword [edi + 0x30], ecx
pop ebx
ret

Function at 0x411ad0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
push ebp
xor edi, edi
call fcn.00428653
add esp, 4
cmp eax, 0xffffffff
jne 0x411ae9
xor eax, eax
movzx esi, al
test esi, esi
jle 0x411b44
push 8
call fcn.00427ed0
mov edi, eax
add esp, 4
test edi, edi
je 0x411b17
push esi
mov dword [edi], esi
call fcn.00426b12
push esi
push 0
push eax
mov dword [edi + 4], eax
call fcn.004300c0
add esp, 0x10
push ebx
mov ebx, dword [edi + 4]
push ebp
push esi
push 1
push ebx
call fcn.004294bd
add esp, 0x10
cmp eax, esi
jge 0x411b3d
sub esi, eax
push esi
lea ecx, [eax + ebx]
push 0
push ecx
call fcn.004300c0
add esp, 0xc
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x411ea0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, eax
push edi
push 2
lea eax, [esp + 0xc]
push 1
push eax
call fcn.004294bd
add esp, 0x10
cmp eax, 2
je 0x411ebf
xor eax, eax
jmp 0x411ecf
mov cx, word [esp + 4]
movzx eax, ch
movzx ecx, cl
shl eax, 8
or eax, ecx
push edi
push 2
lea edx, [esp + 0xc]
push 1
push edx
mov dword [esi], eax
call fcn.004294bd
add esp, 0x10
cmp eax, 2
je 0x411eec
xor eax, eax
jmp 0x411efc
mov cx, word [esp + 4]
movzx eax, ch
movzx ecx, cl
shl eax, 8
or eax, ecx
push edi
mov dword [esi + 4], eax
call fcn.00428653
add esp, 4
cmp eax, 0xffffffff
jne 0x411f0f
xor eax, eax
movzx eax, al
mov edx, eax
shr edx, 7
mov ecx, eax
mov dword [esi + 8], edx
mov edx, eax
shr ecx, 4
and ecx, 7
shr edx, 3
and eax, 7
inc ecx
and edx, 1
inc eax
push edi
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
call fcn.00428653
add esp, 4
cmp eax, 0xffffffff
jne 0x411f48
xor eax, eax
movzx eax, al
push edi
mov dword [esi + 0x18], eax
call fcn.00428653
add esp, 4
cmp eax, 0xffffffff
jne 0x411f5e
xor eax, eax
cmp dword [esi + 8], 0
movzx ecx, al
mov dword [esi + 0x1c], ecx
je 0x411f85
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x20]
mov edx, 1
shl edx, cl
push edi
mov dword [eax], edx
mov edi, dword [esi + 0x20]
call fcn.00411dd0
add esp, 4
pop edi
pop ecx
ret
Function at 0x411f90
Capabilities:
Read file on windows

Disassembly:
cmp dword [ebx + 0x34], 0
push ebp
mov ebp, dword [esp + 8]
push edi
lea edi, [ebx + 0x38]
je 0x411fee
push esi
push ebp
call fcn.00428653
add esp, 4
cmp eax, 0xffffffff
jne 0x411fb0
xor eax, eax
movzx esi, al
mov dword [ebx + 0x34], esi
test esi, esi
je 0x411fe6
push ebp
push esi
push 1
push edi
call fcn.004294bd
add esp, 0x10
cmp eax, esi
jge 0x411fdc
sub esi, eax
push esi
lea ecx, [eax + edi]
push 0
push ecx
call fcn.004300c0
add esp, 0xc
cmp dword [ebx + 0x34], 0
jne 0x411fa0
pop esi
pop edi
pop ebp
ret
mov dword [ebx + 0x2c], 1
pop esi
pop edi
pop ebp
ret

Function at 0x412520
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push 2
lea eax, [esp + 8]
push 1
push eax
call fcn.004294bd
add esp, 0x10
cmp eax, 2
je 0x41253c
xor eax, eax
jmp 0x41254b
mov cx, word [esp]
movzx eax, ch
movzx ecx, cl
shl eax, 8
or eax, ecx
push ebx
push 2
lea edx, [esp + 8]
push 1
push edx
mov dword [esi], eax
call fcn.004294bd
add esp, 0x10
cmp eax, 2
je 0x412568
xor eax, eax
jmp 0x412577
mov cx, word [esp]
movzx eax, ch
movzx ecx, cl
shl eax, 8
or eax, ecx
push ebx
push 2
lea edx, [esp + 8]
push 1
push edx
mov dword [esi + 4], eax
call fcn.004294bd
add esp, 0x10
cmp eax, 2
je 0x412595
xor eax, eax
jmp 0x4125a4
mov cx, word [esp]
movzx eax, ch
movzx ecx, cl
shl eax, 8
or eax, ecx
push ebx
push 2
lea edx, [esp + 8]
push 1
push edx
mov dword [esi + 8], eax
call fcn.004294bd
add esp, 0x10
cmp eax, 2
je 0x4125c2
xor eax, eax
jmp 0x4125d1
mov cx, word [esp]
movzx eax, ch
movzx ecx, cl
shl eax, 8
or eax, ecx
push ebx
mov dword [esi + 0xc], eax
call fcn.00428653
add esp, 4
cmp eax, 0xffffffff
jne 0x4125e4
xor eax, eax
movzx eax, al
mov edx, eax
shr edx, 6
and edx, 1
mov dword [esi + 0x14], edx
mov edx, eax
shr edx, 5
and edx, 1
mov dword [esi + 0x18], edx
mov edx, eax
mov ecx, eax
shr edx, 3
shr ecx, 7
and edx, 3
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], edx
test ecx, ecx
je 0x412637
and eax, 7
inc eax
mov ecx, eax
mov edx, 1
shl edx, cl
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
push edi
mov dword [eax], edx
mov edi, dword [esi + 0x24]
push ebx
call fcn.00411dd0
add esp, 4
pop edi
mov eax, 0x1000
cmp dword [esi + 8], eax
jg 0x412654
cmp dword [esi + 0xc], eax
jg 0x412654
push esi
push ebx
call fcn.00412360
add esp, 8
mov al, 1
pop ecx
ret
xor al, al
pop ecx
ret
Function at 0x412c20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov ebx, eax
push edi
xor edi, edi
xor ecx, ecx
xor esi, esi
xor edx, edx
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
test ebx, ebx
jle 0x412ccf
mov esi, 0x100
push ebp
push 1
lea eax, [esp + 0x30]
push 0x10
push eax
call fcn.004294bd
mov ax, word [esp + 0x3e]
add esp, 0x10
cmp ax, 0x20
je 0x412c89
cmp ax, 0x18
je 0x412c89
xor ecx, ecx
cmp ax, 8
setne cl
inc ecx
mov eax, ecx
jmp 0x412c8b
xor eax, eax
mov cl, byte [esp + 0x28]
test cl, cl
jne 0x412ca1
mov edx, dword [esp + 0x34]
mov dword [esp + eax*4 + 0x10], esi
mov dword [esp + eax*4 + 0x1c], edx
jmp 0x412cb6
movzx ecx, cl
cmp ecx, dword [esp + eax*4 + 0x10]
jle 0x412cb6
mov dword [esp + eax*4 + 0x10], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + eax*4 + 0x1c], ecx
sub ebx, 1
jne 0x412c58
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
cmp dword [esp + 0x44], 0
jne 0x412cee
cmp ecx, esi
jge 0x412cde
mov ecx, esi
mov edx, edi
cmp ecx, dword [esp + 0x18]
jl 0x412ce6
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
test edx, edx
jne 0x412ce4
test edi, edi
je 0x412ce6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x412d00
Capabilities:
Read file on windows

Disassembly:
push ecx
imul eax, eax
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
test eax, eax
jle 0x412d46
push edi
mov edi, eax
push ebp
push 3
lea eax, [esp + 0x14]
push 1
push eax
call fcn.004294bd
mov cl, byte [esp + 0x1c]
mov dl, byte [esp + 0x1d]
mov al, byte [esp + 0x1e]
mov byte [esi], cl
mov byte [esi + 1], dl
mov byte [esi + 2], al
mov byte [esi + 3], 0
add esp, 0x10
add esi, 4
sub edi, 1
jne 0x412d13
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x412d50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x404
push ebx
push esi
push edi
push 0x100
mov ebx, eax
lea eax, [esp + 0x14]
push 4
push eax
mov esi, ecx
call fcn.004294bd
mov eax, ebx
imul eax, ebx
xor ebx, ebx
add esp, 0x10
cmp eax, ebx
jle 0x412dbd
push ebp
mov ebp, eax
nop
push edi
push 1
lea ecx, [esp + 0x17]
push 1
push ecx
call fcn.004294bd
movzx eax, byte [esp + 0x1f]
add eax, eax
add eax, eax
movzx edx, byte [esp + eax + 0x20]
mov cl, byte [esp + eax + 0x21]
mov byte [esi], dl
movzx edx, byte [esp + eax + 0x22]
mov byte [esi + 1], cl
mov byte [esi + 2], dl
mov byte [esi + 3], bl
add esp, 0x10
add esi, 4
sub ebp, 1
jne 0x412d80
pop ebp
pop esi
pop ebx
add esp, 0x404
ret
Function at 0x412dd0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
push ebx
push esi
push edi
push 0x10
mov ebx, eax
lea eax, [esp + 0x14]
push 4
push eax
mov esi, ecx
call fcn.004294bd
mov eax, ebx
imul eax, ebx
cdq
sub eax, edx
sar eax, 1
xor ebx, ebx
add esp, 0x10
cmp eax, ebx
jle 0x412e78
push ebp
mov ebp, eax
mov edi, edi
push edi
push 1
lea ecx, [esp + 0x17]
push 1
push ecx
call fcn.004294bd
mov cl, byte [esp + 0x1f]
mov al, cl
shr al, 4
movzx eax, al
add eax, eax
add eax, eax
movzx edx, byte [esp + eax + 0x20]
mov byte [esi], dl
movzx edx, byte [esp + eax + 0x21]
movzx eax, byte [esp + eax + 0x22]
mov byte [esi + 2], al
movzx eax, cl
mov byte [esi + 1], dl
mov byte [esi + 3], bl
add esp, 0x10
add esi, 4
and eax, 0x8000000f
jns 0x412e4e
dec eax
or eax, 0xfffffff0
inc eax
movzx eax, al
add eax, eax
add eax, eax
movzx ecx, byte [esp + eax + 0x10]
movzx edx, byte [esp + eax + 0x11]
movzx eax, byte [esp + eax + 0x12]
mov byte [esi], cl
mov byte [esi + 1], dl
mov byte [esi + 2], al
mov byte [esi + 3], bl
add esi, 4
sub ebp, 1
jne 0x412e00
pop ebp
pop esi
pop ebx
add esp, 0x44
ret

Function at 0x412e80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
push 2
mov esi, ecx
lea ecx, [esp + 0x1c]
push 4
push ecx
call fcn.004294bd
mov eax, edi
imul eax, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
xor ebx, ebx
add esp, 0x10
cmp eax, ebx
jle 0x412f18
mov dword [esp + 0x10], eax
push ebp
lea esp, [esp]
mov edx, dword [esp + 0x24]
push edx
push 1
lea eax, [esp + 0x1b]
push 1
push eax
call fcn.004294bd
movzx ebp, byte [esp + 0x23]
mov ecx, 0x80
add esp, 0x10
lea edi, [ecx - 0x78]
mov eax, ebp
and eax, ecx
neg eax
sbb eax, eax
neg eax
movzx edx, byte [esp + eax*4 + 0x18]
mov byte [esi], dl
movzx edx, byte [esp + eax*4 + 0x19]
mov al, byte [esp + eax*4 + 0x1a]
mov byte [esi + 1], dl
mov byte [esi + 2], al
mov byte [esi + 3], bl
shr ecx, 1
add esi, 4
sub edi, 1
jne 0x412ee3
sub dword [esp + 0x14], 1
jne 0x412ec0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x412f20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x4c]
push edi
push 1
mov esi, eax
lea eax, [esp + 0x28]
push 0x28
push eax
call fcn.004294bd
mov eax, dword [esp + 0x34]
add esp, 0x10
test eax, eax
je 0x4130db
cmp dword [esp + 0x28], 0
je 0x4130db
mov dword [esi + 4], eax
mov dword [esi], eax
imul eax, eax
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00426b12
mov cx, word [esp + 0x32]
add esp, 4
mov dword [esi + 8], eax
cmp cx, 0x20
jne 0x412fa2
mov ecx, dword [esi + 4]
imul ecx, dword [esi]
push edi
push ecx
push 4
push eax
call fcn.004294bd
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
mov ebp, eax
cmp cx, 0x18
jne 0x412fb7
mov eax, dword [esi + 4]
push edi
mov ecx, ebp
call fcn.00412d00
jmp 0x412feb
cmp cx, 8
jne 0x412fc9
mov eax, dword [esi + 4]
mov ecx, ebp
call fcn.00412d50
jmp 0x412fee
cmp cx, 4
jne 0x412fdb
mov eax, dword [esi + 4]
mov ecx, ebp
call fcn.00412dd0
jmp 0x412fee
test cx, cx
je 0x412fee
mov eax, dword [esi + 4]
push edi
mov ecx, ebp
call fcn.00412e80
add esp, 4
mov ecx, dword [esi + 4]
mov eax, dword [esi]
imul eax, ecx
shr eax, 3
call fcn.00417640
cmp ecx, 0x10
jne 0x41300e
mov ecx, 2
mov dword [esp + 0x1c], ecx
jmp 0x413057
cmp ecx, 0x18
jne 0x413022
mov ecx, 3
mov dword [esp + 0x1c], 1
jmp 0x413057
cmp ecx, 0x30
jne 0x413036
mov ecx, 6
mov dword [esp + 0x1c], 2
jmp 0x413057
cmp ecx, 0x48
jne 0x41304a
mov ecx, 9
mov dword [esp + 0x1c], 3
jmp 0x413057
mov ecx, 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], ecx
mov edi, 1
mov ebx, ecx
test eax, eax
jle 0x4130d1
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x4c]
push edx
push 1
lea eax, [esp + 0x1b]
push 1
push eax
call fcn.004294bd
add esp, 0x10
test edi, edi
je 0x4130b1
movzx esi, byte [esp + 0x13]
mov eax, 0x80
lea ecx, [eax - 0x78]
mov edx, esi
and edx, eax
neg edx
sbb dl, dl
and dl, 1
dec dl
mov byte [ebp + 3], dl
shr eax, 1
add ebp, 4
sub ecx, 1
jne 0x413097
cmp dword [esp + 0x1c], 0
je 0x4130ca
sub ebx, 1
jne 0x4130ca
mov ebx, dword [esp + edi*4 + 0x18]
xor eax, eax
test edi, edi
sete al
mov edi, eax
sub dword [esp + 0x14], 1
jne 0x413070
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x38
ret
Function at 0x4132f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [eax + 0x18], 0x10
push ebx
push esi
push edi
jb 0x413307
mov eax, dword [eax + 4]
jmp 0x41330a
add eax, 4
push 0x4611e8
push eax
call fcn.00427d18
mov esi, eax
add esp, 8
test esi, esi
je 0x41335e
push esi
push 1
lea eax, [esp + 0x1c]
push 4
push eax
call fcn.004294bd
add esp, 0x10
cmp dword [esp + 0x14], 0x10000
jne 0x413355
push esi
push 1
lea ecx, [esp + 0x18]
push 2
push ecx
call fcn.004294bd
movsx eax, word [esp + 0x20]
add esp, 0x10
test eax, eax
jg 0x413367
push esi
call fcn.00427e39
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.00412c20
mov edi, eax
add esp, 8
test edi, edi
je 0x413355
push 0
push edi
push esi
call fcn.00428cf0
add esp, 0xc
push esi
push 8
lea eax, [esp + 0x20]
push 1
push eax
call fcn.004294bd
lea ecx, [esp + 0x28]
push ecx
mov eax, 8
xor edx, edx
mov bl, 1
call fcn.0041a170
add esp, 0x14
test eax, eax
je 0x4133c8
push 0
push edi
push esi
call fcn.00428cf0
mov eax, dword [ebp + 8]
add esp, 0xc
push esi
call fcn.00412f20
mov bl, al
jmp 0x4133d1
mov eax, dword [ebp + 8]
push esi
call fcn.004130f0
add esp, 4
push esi
call fcn.00427e39
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret