joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
mov ebx, eax
sub esp, 0x5c
test eax, eax
mov dword [esp + 0x40], edx
mov esi, dword [esp + 0x74]
je 0x40178d
mov edi, dword [eax + 0x184]
lea eax, [esi + 8]
add ecx, 0x24
xor ebp, ebp
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ecx
lea esi, [esi]
mov eax, dword [0xbd7160]
test eax, eax
jne 0x401918
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4017fe
fnstcw word [esp + 0x4e]
fld qword [0xbd7088]
mov dword [esp + 8], esi
mov dword [esp], ebx
movzx eax, word [esp + 0x4e]
mov ah, 0xc
mov word [esp + 0x4c], ax
mov eax, dword [esp + 0x48]
fldcw word [esp + 0x4c]
fistp dword [esp + 0xc]
fldcw word [esp + 0x4e]
mov dword [esp + 4], eax
call fcn.004f5c30
test eax, eax
mov dword [esi + 4], eax
js 0x401944
fld dword [ebx + 0x38]
fadd dword [esi + 8]
fstp dword [ebx + 0x38]
fld dword [0xbd7114]
fadd qword [ebx + 0x20]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
mov dword [esi + 0xc], 0
fsub dword [esi + 8]
fstp dword [esp]
call fcn.00401580
test ebp, ebp
fstp dword [esp + 0x3c]
je 0x401841
mov edx, dword [esp + 0x78]
test edx, edx
je 0x401930
mov eax, dword [ebx]
test byte [eax + 0x34], 1
jne 0x401930
fld dword [esp + 0x70]
fcomp qword [ebx + 0x20]
fnstsw ax
sahf
ja 0x401852
mov ebp, 1
test edi, edi
je 0x4018c2
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], edi
call dword [edi + 8]
mov dword [esp + 0x18], 0
cmp eax, 1
fld dword [0x941138]
setne al
movzx eax, al
fst qword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
fstp dword [esp + 0x30]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0044f120
test eax, eax
fld dword [esp + 0x30]
je 0x4018c0
fstp qword [esp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0044f3e0
jmp 0x4018c2
fstp st(0)
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x4017a0
fld dword [esp + 0x3c]
fstp qword [esp + 0x24]
mov eax, dword [0xbd714c]
fld qword [ebx + 0x20]
fstp qword [esp + 0x1c]
fld dword [eax + 4]
fstp qword [esp + 0x14]
fld dword [eax]
fstp qword [esp + 0xc]
mov dword [esp + 8], str.EDL_SKIP:_Start:__.2f__End:__.2f___Current:_V:__.2f__A:__.2f______r
mov dword [esp + 4], 5
mov dword [esp], 0x16
call fcn.0042b9b0
mov eax, dword [0xbd7160]
test eax, eax
je 0x4017ad
mov eax, dword [0xbd7160]
cmp eax, 1
sbb eax, eax
add esp, 0x5c
add eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esi + 0xc], 1
mov eax, 1
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x5c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4091e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
sub esp, 0x48
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0xc]
mov dword [eax + 0x44], 0x409150
mov dword [eax + 0x48], 0x409010
mov edx, ecx
imul edx, ebx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x4c], 0x409000
mov dword [eax + 0x50], 0x409060
shl edx, 4
mov dword [eax + 0x14], edx
sar edx, 3
mov dword [eax + 0x38], edx
mov dword [eax + 0x58], 0x409020
mov eax, dword [0xbd7168]
test eax, eax
je 0x4092cf
mov word [esp + 0x2a], bx
add ebx, ebx
mov word [esp + 0x34], bx
movzx ebx, bx
imul ebx, ecx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x46464952
mov dword [esp + 0x1c], 0x45564157
mov dword [esp + 0x20], 0x20746d66
mov dword [esp + 0x24], 0x10
mov word [esp + 0x28], 1
mov dword [esp + 0x2c], ecx
mov word [esp + 0x36], 0x10
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], 0x61746164
mov dword [esp + 0x3c], 0x7ffff000
mov dword [esp + 0x18], 0x7ffff024
mov dword [esp + 8], 0x2c
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll__write
mov eax, dword [0xbd7168]
mov dword [esp + 8], str.Audio_data_will_be_piped_out_through_fd__d_n
mov dword [esp + 4], 4
mov dword [esp], 0x16
mov dword [esp + 0xc], eax
call fcn.0042b9b0
mov eax, 1
add esp, 0x48
pop ebx
ret
Function at 0x42ca00
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov dword [esp], str.MPLAYER_VERBOSE
call sub.msvcrt.dll_getenv
test eax, eax
je 0x42b470
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [0xbd7e20], eax
xor eax, eax
mov dword [eax*4 + 0xbd7e40], 0xfffffffe
add eax, 1
cmp eax, 0x40
jne 0x42b472
mov dword [0xbd7ee4], 0xffffffff
mov dword [esp], str.MPLAYER_CHARSET
call sub.msvcrt.dll_getenv
test eax, eax
mov dword [0xbd7e2c], eax
je 0x42b4a8
add esp, 0x1c
ret
call fcn.004f8200
mov dword [0xbd7e2c], eax
add esp, 0x1c
ret
sub esp, 0x1c
call fcn.004f8340
call fcn.004f82b0
mov dword [esp], eax
call sub.msvcrt.dll_srand
add esp, 0x1c
jmp 0x42b450

Function at 0x42d6f0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov edi, dword [esp + 0x150]
mov dword [esp], str.MPLAYER_HOME
call sub.msvcrt.dll_getenv
test eax, eax
mov ebx, eax
je 0x42d7c9
mov dword [str._mplayer], 0x9cd9d8
xor esi, esi
mov ebp, 0x9cd9d8
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
test edi, edi
lea esi, [eax + esi]
lea eax, [esi + 1]
je 0x42d7a1
mov dword [esp], edi
call sub.msvcrt.dll_strlen
lea eax, [esi + eax + 2]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x42d794
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._s_s__s
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.get_path__s______s_n
mov dword [esp + 4], 6
mov dword [esp], 0
call fcn.0042b9b0
add esp, 0x13c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x42d794
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x9cd9e6
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
jmp 0x42d770
lea ebx, [esp + 0x2c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
mov edx, ebx
sub esp, 0xc
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x42d7ea
test eax, 0x8080
jne 0x42d80d
shr eax, 0x10
add edx, 2
add al, al
sbb edx, 3
xor ecx, ecx
sub edx, ebx
xor eax, eax
jmp 0x42d823
add eax, 1
cmp eax, edx
jae 0x42d863
cmp byte [ebx + eax], 0x5c
jne 0x42d820
mov byte [ebx + eax], 0x2f
mov edx, ebx
mov esi, dword [edx]
add edx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x42d833
test ecx, 0x8080
jne 0x42d858
shr ecx, 0x10
add edx, 2
add cl, cl
mov ecx, eax
sbb edx, 3
sub edx, ebx
jmp 0x42d820
mov ebp, dword [str._mplayer]
mov byte [esp + ecx + 0x2c], 0
mov dword [esp], ebp
call sub.msvcrt.dll_strlen
mov esi, eax
jmp 0x42d728
Function at 0x42d880
Capabilities:
Set environment variable

Disassembly:
push ebx
sub esp, 0x128
lea ebx, [esp + 0x1c]
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call sub.msvcrt.dll_strrchr
lea edx, [eax + 1]
mov dword [eax + 1], 0x65646f63
mov word [edx + 4], 0x7363
mov byte [edx + 6], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.Setting_PATH_to__s_n
mov dword [esp + 4], 6
mov dword [esp], 0xf
call fcn.0042b9b0
mov dword [esp + 4], ebx
mov dword [esp], str.PATH
call sub.KERNEL32.dll_SetEnvironmentVariableA
sub esp, 8
test eax, eax
jne 0x42d91d
mov dword [esp + 8], str.Cannot_set_PATH_
mov dword [esp + 4], 2
mov dword [esp], 0xf
call fcn.0042b9b0
add esp, 0x128
pop ebx
ret

Function at 0x433150
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], str.unrar.dll
call fcn.0042d6f0
mov dword [esp], eax
call sub.KERNEL32.dll_LoadLibraryA
xor edx, edx
sub esp, 4
test eax, eax
mov dword [0xbd8c4c], eax
je 0x433283
mov dword [esp + 4], str.RAROpenArchiveEx
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xbd8c50], eax
mov eax, dword [0xbd8c4c]
sub esp, 8
mov dword [esp + 4], str.RARCloseArchive
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xbd8c54], eax
mov eax, dword [0xbd8c4c]
sub esp, 8
mov dword [esp + 4], str.RARReadHeaderEx
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xbd8c58], eax
mov eax, dword [0xbd8c4c]
sub esp, 8
mov dword [esp + 4], str.RARProcessFile
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xbd8c5c], eax
mov eax, dword [0xbd8c4c]
sub esp, 8
mov dword [esp + 4], str.RARSetCallback
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
mov dword [0xbd8c60], eax
mov eax, dword [0xbd8c4c]
sub esp, 8
mov dword [esp + 4], str.RARSetPassword
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp], 0x200
mov dword [0xbd8c64], eax
call sub.msvcrt.dll_malloc
mov dword [esp], 0x200
mov ebx, eax
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea eax, [ebx + eax]
mov dword [eax], 0x76706d5c
mov dword [eax + 4], 0x7573626f
mov dword [eax + 8], 0x6d742e62
mov word [eax + 0xc], 0x70
mov dword [esp], ebx
call sub.msvcrt.dll__strdup
mov dword [esp], ebx
mov dword [0xbd8c48], eax
call fcn.008f2ba8
mov edx, 1
mov eax, edx
add esp, 0x18
pop ebx
ret
Function at 0x4f20e0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
test byte [edx + 6], 0x20
je 0x4f2185
movzx ebx, byte [edx]
movzx ecx, byte [edx + 2]
shl ebx, 0x10
or ecx, ebx
movzx ebx, byte [edx + 1]
shl ebx, 8
or ecx, ebx
mov ebx, ecx
and ecx, 0xfff
sar ebx, 0xc
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
movzx ecx, byte [edx + 3]
shr cl, 4
movzx ecx, cl
mov dword [eax + 0xc], ecx
movzx ecx, byte [edx + 3]
and ecx, 0xf
mov dword [eax + 0x10], ecx
mov ecx, dword [ecx*4 + 0x9e9ce0]
mov dword [eax + 0x14], ecx
movzx ecx, byte [edx + 5]
movzx ebx, byte [edx + 4]
movzx edx, byte [edx + 6]
mov dword [eax], 1
shl ecx, 2
shl ebx, 0xa
shr dl, 6
or ecx, ebx
movzx edx, dl
or ecx, edx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], 3
mov dword [eax + 0x38], 0x64
mov dword [eax + 0x18], 1
mov dword [eax + 0x1c], 1
xor eax, eax
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], str.missing_marker_bit__n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, 1
add esp, 0x18
pop ebx
ret
Function at 0x4f9090
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x2064]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp + 4], eax
lea eax, [ebx + 0x64]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
test eax, eax
jne 0x4f9107
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], str.Error_writing_capture_file:__s_n
mov dword [esp + 4], 1
mov dword [esp], 0
mov dword [esp + 0xc], eax
call fcn.0042b9b0
mov eax, dword [ebx + 0x2064]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx + 0x2064], 0
add esp, 0x18
pop ebx
ret

Function at 0x4f94a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, edx
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x1c
jmp 0x4f9577
cmp eax, 8
je 0x4f95e0
mov eax, dword [ebx]
test eax, eax
je 0x4f94d8
mov dword [esp + 8], 0x800
mov dword [esp + 4], ebp
mov dword [esp], ebx
call eax
test eax, eax
jg 0x4f95c6
mov ecx, dword [ebx + 0x48]
mov esi, dword [ebx + 0x30]
mov edi, dword [ebx + 0x34]
test ecx, ecx
jne 0x4f9626
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x40]
mov ecx, edx
or ecx, eax
je 0x4f9501
xor edx, edi
xor eax, esi
or edx, eax
je 0x4f9626
cmp dword [ebx + 0x18], 9
je 0x4f9626
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x2c], 0
test eax, eax
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x48], 0
je 0x4f954a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call eax
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.004f9190
test eax, eax
jns 0x4f9626
xor edi, dword [ebx + 0x34]
xor esi, dword [ebx + 0x30]
or edi, esi
jne 0x4f9626
mov dword [ebx + 0x48], 1
mov eax, dword [ebx + 0x18]
cmp eax, 2
jne 0x4f94b0
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x4f9600
mov edx, dword [eax + 0x20]
test edx, edx
je 0x4f9600
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 8], 0x800
mov dword [esp + 4], ebp
mov dword [esp], eax
call edx
mov edx, dword [ebx + 0x60]
mov esi, dword [edx + 4]
test esi, esi
jne 0x4f94d0
test eax, eax
mov dword [ebx + 0x48], 1
jle 0x4f94d8
mov ecx, eax
sar ecx, 0x1f
add dword [ebx + 0x30], eax
adc dword [ebx + 0x34], ecx
mov dword [ebx + 0x48], 0
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x58]
mov dword [esp + 8], 0x800
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.004954d0
jmp 0x4f94d0
mov eax, dword [ebx]
test eax, eax
jne 0x4f94bf
mov eax, dword [ebx + 0x14]
mov dword [esp + 8], 0x800
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll__read
jmp 0x4f94d0
mov dword [ebx + 0x48], 1
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x509620
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
mov edx, eax
mov dword [esp + 0x20], ebx
mov ebx, dword [0xbe24e4]
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], esi
mov esi, dword [ebx]
test esi, esi
lea edi, [esi - 1]
jne 0x509657
mov dword [ebx], 1
xor edi, edi
mov esi, 1
mov dword [0xbe24ec], 0
mov eax, dword [ebx + edi*4 + 0xc]
test eax, eax
je 0x509742
mov ecx, dword [0xbe24ec]
cmp dl, 0xa
je 0x5096a1
cmp ecx, 0x3f
je 0x509774
mov byte [eax + ecx], dl
add ecx, 1
mov dword [0xbe24ec], ecx
mov eax, dword [0x9137a0]
cmp eax, 2
je 0x509720
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
test ecx, ecx
je 0x509683
cmp esi, 0xb
jg 0x509683
cmp dword [0x9137a0], 2
lea edi, [esi + 1]
mov dword [ebx], edi
mov dword [0xbe24ec], 0
jne 0x509691
mov dword [esp + 4], 0x40
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov dword [ebx + esi*4 + 0xc], eax
mov esi, dword [0x9137a4]
cmp edi, esi
jle 0x509720
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call fcn.008f2ba8
mov ecx, dword [ebx]
sub ecx, 1
test ecx, ecx
jle 0x50970f
xor eax, eax
lea esi, [esi]
add eax, 1
mov edx, dword [ebx + eax*4 + 0xc]
cmp ecx, eax
mov dword [ebx + eax*4 + 8], edx
jg 0x509700
cmp ecx, esi
mov dword [ebx + ecx*4 + 0xc], 0
mov dword [ebx], ecx
jg 0x5096e4
lea esi, [esi]
mov dword [0xbe23f0], ebx
mov dword [esp], 2
call fcn.00509580
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov byte [esp + 0x1c], dl
mov dword [esp + 4], 0x40
mov dword [esp], 1
call sub.msvcrt.dll_calloc
xor ecx, ecx
movzx edx, byte [esp + 0x1c]
mov dword [ebx + edi*4 + 0xc], eax
mov dword [0xbe24ec], 0
jmp 0x509669
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2e
mov dword [esp + 4], 1
mov dword [esp], 0x9ec4e8
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x509691
Function at 0x51a5b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [esp], 0x30
call sub.msvcrt.dll_malloc
mov dword [esp + 4], 0x9edb78
mov dword [esp + 0x2c], eax
mov ebx, eax
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
mov ebp, eax
je 0x51a72d
lea esi, [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x20
mov dword [esp], esi
call sub.msvcrt.dll_fread
test eax, eax
je 0x51a725
mov edi, str.mhwanh
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
jne 0x51a725
movzx eax, byte [esp + 0x38]
movzx edx, byte [esp + 0x39]
movzx ecx, byte [esp + 0x3b]
movzx esi, byte [esp + 0x3d]
shl eax, 8
add eax, edx
movzx edx, byte [esp + 0x3a]
mov dword [ebx + 8], eax
shl edx, 8
lea ecx, [edx + ecx]
movzx edx, byte [esp + 0x3c]
mov dword [ebx + 0xc], ecx
shl edx, 8
add edx, esi
test eax, eax
mov dword [ebx + 0x10], edx
je 0x51a6f3
cmp edx, 0x100
jg 0x51a725
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 8], str.RAW:__s___d_x__d___d_colors_n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 7
mov dword [esp], 0x1e
call fcn.0042b9b0
mov esi, dword [ebx + 0x10]
test esi, esi
jne 0x51a750
mov dword [ebx + 4], 0
mov eax, 3
mov esi, dword [ebx + 8]
imul esi, dword [ebx + 0xc]
imul esi, eax
mov dword [esp], esi
call sub.msvcrt.dll_malloc
mov dword [esp + 0xc], ebp
mov dword [esp + 4], esi
mov dword [esp + 8], 1
mov dword [ebx], eax
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x2c]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [esp + 0x4c]
movzx esi, byte [esp + 0x4d]
shl eax, 8
add eax, esi
movzx esi, byte [esp + 0x4e]
shl eax, 8
add eax, esi
movzx esi, byte [esp + 0x4f]
shl eax, 8
add eax, esi
cmp edx, 0x100
mov dword [ebx + 8], eax
jle 0x51a66c
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov dword [esp], ebx
call fcn.008f2ba8
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x2c]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + esi*2]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], 3
mov dword [ebx + 4], eax
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov eax, 1
jmp 0x51a6b3
Function at 0x52e530
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
sub esp, 8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov edx, dword [ecx + 0xec]
cmp edx, 2
je 0x52e581
jbe 0x52e577
cmp edx, 4
je 0x52e5a6
cmp edx, 8
jne 0x52e57c
mov edx, dword [ecx + 8]
mov edx, dword [edx + 0x28]
mov ecx, dword [edx + 0x156]
mov dword [eax], ecx
movzx edx, word [edx + 0x15a]
mov word [eax + 4], dx
add esp, 8
pop ebx
ret 4
cmp edx, 1
je 0x52e5a6
call sub.msvcrt.dll_abort
mov ecx, dword [ecx + 8]
lea edx, [ebx + ebx*2]
add edx, edx
add edx, dword [ecx + 0x28]
add edx, 0x250
mov ecx, dword [edx + 6]
mov dword [eax], ecx
movzx edx, word [edx + 0xa]
mov word [eax + 4], dx
add esp, 8
pop ebx
ret 4
mov edx, dword [ecx + 4]
mov edx, dword [edx + 4]
mov ecx, dword [edx + 0x156]
mov dword [eax], ecx
movzx edx, word [edx + 0x15a]
mov word [eax + 4], dx
add esp, 8
pop ebx
ret 4
Function at 0x55f8c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0x3c
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 4], 0x9fb7a0
mov dword [esp], edx
call sub.msvcrt.dll_fopen
test eax, eax
mov edi, eax
je 0x55fa4a
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
cmp eax, 0xffffffff
je 0x55fa15
mov dword [esp], edi
call sub.msvcrt.dll_ftell
mov dword [esp], edi
mov esi, eax
call sub.msvcrt.dll_rewind
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.File_size:__ld
mov dword [esp + 4], 6
mov dword [esp], eax
call fcn.00573d10
lea eax, [esi + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebp, eax
mov dword [esp + 0x28], eax
je 0x55fa77
xor ebx, ebx
lea esi, [esi]
mov eax, esi
sub eax, ebx
mov dword [esp + 8], eax
lea eax, [ebp + ebx]
mov dword [esp + 0xc], edi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
test eax, eax
jle 0x55f9b5
add ebx, eax
mov eax, esi
sub eax, ebx
test eax, eax
jg 0x55f960
mov byte [ebp + esi], 0
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, dword [esp + 0x24]
test eax, eax
je 0x55f9a9
mov eax, dword [esp + 0x24]
mov dword [eax], esi
mov eax, dword [esp + 0x28]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov ebx, eax
call sub.msvcrt.dll__errno
mov dword [esp + 0x10], ebx
mov eax, dword [eax]
mov dword [esp + 8], str.Read_failed___d:__s
mov dword [esp + 4], 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00573d10
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp], ebp
call fcn.008f2ba8
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x28]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.ass_read_file__s_:_fseek_failed
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.00573d10
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp + 0x28], 0
jmp 0x55f9a9
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.ass_read_file__s_:_fopen_failed
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.00573d10
mov dword [esp + 0x28], 0
jmp 0x55f9a9
mov dword [esp + 8], 0x403
mov dword [esp + 4], str.libass_ass.c
mov dword [esp], 0x9fb800
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x562480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
lea eax, [ebx + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 8], ebx
mov dword [esp + 4], ebp
mov edi, eax
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov byte [edi + ebx], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.Event:__s
mov dword [esp + 4], 6
mov eax, dword [esi + 0x4c]
mov dword [esp], eax
call fcn.00573d10
movzx eax, byte [edi]
mov edx, edi
cmp al, 0xa
je 0x5624e0
cmp al, 0xd
jne 0x5624ee
add edx, 1
movzx eax, byte [edx]
cmp al, 0xa
je 0x5624e0
cmp al, 0xd
je 0x5624e0
cmp al, 0xef
je 0x562551
test al, al
je 0x562532
mov ebx, edx
jmp 0x562508
test al, al
je 0x562512
cmp al, 0xa
je 0x562512
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0xd
jne 0x562500
cmp edx, ebx
je 0x562532
test al, al
je 0x562520
mov byte [ebx], 0
add ebx, 1
mov eax, esi
call fcn.005607c0
movzx eax, byte [ebx]
test al, al
je 0x562532
mov edx, ebx
jmp 0x5624d8
mov dword [esp], edi
call fcn.008f2ba8
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x56256a
mov dword [esp + 0x30], esi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00561af0
cmp byte [edx + 1], 0xbb
jne 0x5624f6
cmp byte [edx + 2], 0xbf
mov ebx, edx
jne 0x562508
add edx, 3
movzx eax, byte [edx]
jmp 0x5624d8
mov eax, dword [esi + 0x50]
cmp dword [esi + 0x20], 2
mov dword [eax], 3
je 0x5625a5
mov dword [esp], str.Format:_Layer__Start__End__Style__Actor__MarginL__MarginR__MarginV__Effect__Text
call sub.msvcrt.dll__strdup
mov dword [esi + 0x1c], eax
mov dword [esp + 8], str.No_event_format_found__using_fallback
mov dword [esp + 4], 6
mov eax, dword [esi + 0x4c]
mov dword [esp], eax
call fcn.00573d10
jmp 0x562541
mov dword [esp], str.Format:_Marked__Start__End__Style__Name__MarginL__MarginR__MarginV__Effect__Text
call sub.msvcrt.dll__strdup
mov dword [esi + 0x1c], eax
jmp 0x562588