joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4769e0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x348
lea eax, [esp]
push ebx
push esi
push edi
push eax
call fcn.00476c70
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.X.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x214]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x476a9e
mov edi, dword [esp + 0x358]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x240]
push edi
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00476ab0
add esp, 0xc
lea ecx, [esp + 0x214]
push ecx
push esi
call ebx
test eax, eax
jne 0x476a79
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
add esp, 0x348
ret

Function at 0x479c30
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x479c63
push esi
call fcn.0048a760
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x479c5c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x479ce9
mov eax, dword [esi + 0x1b4]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x479cd2
mov eax, dword [esi + 8]
test eax, eax
je 0x479c87
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b4]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x479cce
cmp eax, 2
je 0x479cd2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x479c7a
cmp eax, 3
je 0x479cad
cmp eax, 1
jne 0x479c7a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x479c7a
mov edx, dword [esi + 0x140]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x479c7a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00479d20
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x479d09
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00479d20
add esp, 4
pop esi
ret
Function at 0x479d20
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xcc
je 0x479d4b
mov eax, dword [esi + 0x1a4]
push esi
call dword [eax]
add esp, 4
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a4]
mov eax, dword [ecx + 8]
test eax, eax
je 0x479d76
mov edx, dword [esi]
push esi
mov dword [edx + 0x14], 0x30
mov eax, dword [esi]
call dword [eax]
mov ecx, dword [esi + 0x1a4]
add esp, 4
mov eax, dword [ecx + 8]
test eax, eax
jne 0x479d58
mov ecx, dword [esi + 0x44]
xor edx, edx
test ecx, ecx
setne dl
add edx, 0xcd
mov eax, 1
mov dword [esi + 0x14], edx
pop esi
ret

Function at 0x47a480
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 0xc]
cmp ecx, 0xc
jb 0x47a53d
mov eax, dword [esp + 8]
cmp byte [eax], 0x41
jne 0x47a53d
cmp byte [eax + 1], 0x64
jne 0x47a53d
cmp byte [eax + 2], 0x6f
jne 0x47a53d
cmp byte [eax + 3], 0x62
jne 0x47a53d
cmp byte [eax + 4], 0x65
jne 0x47a53d
push ebx
xor ecx, ecx
mov cl, byte [eax + 7]
push ebp
push esi
push edi
mov edi, ecx
xor edx, edx
mov dl, byte [eax + 8]
xor ecx, ecx
mov cl, byte [eax + 9]
mov esi, dword [esp + 0x14]
shl edi, 8
add edi, edx
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + 0xa]
mov cl, byte [eax + 0xb]
shl ebp, 8
add ebp, edx
xor edx, edx
mov dl, byte [eax + 5]
xor ebx, ebx
mov bl, byte [eax + 6]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi]
mov dword [ecx + 0x1c], edi
shl edx, 8
add ecx, 0x18
add edx, ebx
mov ebx, dword [esp + 0x1c]
push 1
mov dword [ecx], edx
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], ebx
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x4c
mov ecx, dword [esi]
call dword [ecx + 4]
add esp, 8
mov dword [esi + 0x124], 1
mov byte [esi + 0x128], bl
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 4]
push 1
push eax
mov edx, dword [eax]
mov dword [edx + 0x14], 0x4e
mov edx, dword [esp + 0x18]
add ecx, edx
mov edx, dword [eax]
mov dword [edx + 0x18], ecx
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
ret
Function at 0x48bc30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x48bc3b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x48bd3e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x4ee794]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4ee794]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4ee794]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4ee794]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4ee794]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x4ee794]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x4ee794]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4ee794]
xor eax, edx
inc ecx
dec edi
jne 0x48bc56
pop edi
test esi, esi
je 0x48bd60
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4ee794]
xor eax, edx
inc ecx
dec esi
jne 0x48bd42
pop esi
pop ebx
not eax
ret
Function at 0x4918d0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
cmp eax, 3
push esi
jne 0x491926
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor dx, dx
mov al, byte [eax]
mov dl, al
cmp dx, word [ecx + 0x118]
jbe 0x491908
push str.Invalid_background_palette_index
push ecx
call fcn.00484aa0
add esp, 8
pop esi
add esp, 8
ret
mov byte [esp + 4], al
lea eax, [esp + 4]
push 1
push eax
push str.bKGD
push ecx
call fcn.00490750
add esp, 0x10
pop esi
add esp, 8
ret
test al, 2
je 0x4919b4
mov esi, dword [esp + 0x14]
xor ecx, ecx
lea edx, [esp + 4]
mov cx, word [esi + 2]
push ecx
push edx
call fcn.00490730
xor eax, eax
lea ecx, [esp + 0xe]
mov ax, word [esi + 4]
push eax
push ecx
call fcn.00490730
xor edx, edx
lea eax, [esp + 0x18]
mov dx, word [esi + 6]
push edx
push eax
call fcn.00490730
mov eax, dword [esp + 0x28]
add esp, 0x18
cmp byte [eax + 0x127], 8
jne 0x49199a
mov cl, byte [esp + 8]
mov dl, byte [esp + 6]
or cl, dl
mov dl, byte [esp + 4]
or cl, dl
je 0x49199a
push str.Ignoring_attempt_to_write_16_bit_bKGD_chunk_when_bit_depth_is_8
push eax
call fcn.00484aa0
add esp, 8
pop esi
add esp, 8
ret
lea edx, [esp + 4]
push 6
push edx
push str.bKGD
push eax
call fcn.00490750
add esp, 0x10
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor eax, eax
mov edx, 1
mov ax, word [ecx + 8]
mov cl, byte [esi + 0x127]
shl edx, cl
cmp eax, edx
jl 0x4919e6
push str.Ignoring_attempt_to_write_bKGD_chunk_out_of_range_for_bit_depth
push esi
call fcn.00484aa0
add esp, 8
pop esi
add esp, 8
ret
push eax
lea eax, [esp + 8]
push eax
call fcn.00490730
lea ecx, [esp + 0xc]
push 2
push ecx
push str.bKGD
push esi
call fcn.00490750
add esp, 0x18
pop esi
add esp, 8
ret
Function at 0x4b8b99
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x5073e0
cmp edx, dword [eax]
je 0x4b8bbb
add eax, 8
inc ecx
cmp eax, 0x507470
jl 0x4b8bac
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x5073e0]
jne 0x4b8ce9
mov eax, dword [0x509794]
cmp eax, 1
je 0x4b8cc3
test eax, eax
jne 0x4b8bec
cmp dword [0x504bc8], 1
je 0x4b8cc3
cmp edx, 0xfc
je 0x4b8ce9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b8c23
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baad0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b7090
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b8c66
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b7090
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4f007c
push edi
call fcn.004b2b30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baad0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baae0
lea eax, [ebp - 0xa0]
push 0x4f005c
push eax
call fcn.004baae0
push dword [esi + 0x5073e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baae0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be6c3
add esp, 0x2c
pop edi
jmp 0x4b8ce9
lea eax, [ebp + 8]
lea esi, [esi + 0x5073e4]
push 0
push eax
push dword [esi]
call fcn.004b7090
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x246f74be
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6c5b2cb1
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x427432
Capabilities:
Encode data using xor

Disassembly:
pop ebp
clc
pushal
lea edi, [ebp + 0x42]
mov si, 0x256
cld
mov cl, byte [edi]
xor cl, 0x59
rol cl, 0xc4
xor cl, 0x18
mov byte [edi], cl
inc edi
dec si
jne 0x42743d
jmp 0x427495
fmul st(0)
fdivr dword [esi + 0x7d0c6bc0]
invalid
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x4ec060], 1
mov dword [0x4ec05c], 1
mov dword [0x4ec058], 1
mov dword [0x4ec050], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x4ec014], eax
mov eax, dword [0x4ec06c]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x4ec080]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x4ec068]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4dd108], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060
Function at 0x402c78
Capabilities:
Execute command
Get common file path

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x140
call dbg.__main
mov dword [esp], str.Please_Input_Song_MD5
call sym._puts
lea eax, [ebp - 0x131]
mov dword [esp], eax
call sym._gets
mov dword [esp], str.___get_rank_xml..
call sym._puts
mov dword [esp + 4], 0x4df358
mov dword [esp], str.rank.xml
call sym._fopen
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x131]
mov dword [esp], eax
call dbg.GetRanks(char const*, _iobuf*)
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str.__get_rank_xml_success
call sym._puts
mov dword [esp], str.___parse_rank_xml..
call sym._puts
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0x104
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
mov edx, eax
lea eax, [ebp - 0x110]
add eax, edx
mov dword [eax], 0x6e61725c
mov dword [eax + 4], 0x6d782e6b
mov word [eax + 8], 0x6c
lea eax, [ebp - 0x110]
mov dword [esp], eax
call dbg.parseXml(char const*)
mov dword [esp], str.__parse_rank_xml_success
call sym._puts
mov dword [esp], str.___rank_sort..
call sym._puts
mov ecx, 0x4ec028
call dbg.std::vector<Player, std::allocator<Player> >::end()
mov ebx, eax
mov ecx, 0x4ec028
call dbg.std::vector<Player, std::allocator<Player> >::begin()
mov dword [esp + 8], dbg.ranksort(Player const&, Player const&)
mov dword [esp + 4], ebx
mov dword [esp], eax
call method.void_std::sort___gnu_cxx::__normal_iterator_Player__std::vector_Player__std.allocator_Player_______bool____Player_const__Player_const_____gnu_cxx::__normal_iterator_Player__std::vector_Player__std::allocator_Player_________gnu_cxx::__normal_it
mov dword [esp], str.__rank_sort_success
call sym._puts
mov dword [esp], str.___get_ghosts..
call sym._puts
mov dword [esp + 4], 0x4df358
mov dword [esp], str.ghost.csv
call sym._fopen
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x131]
mov dword [esp], eax
call dbg.GetGhosts(char const*, _iobuf*)
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str.__get_ghosts_success
call sym._puts
mov dword [esp], str.___decode_ghosts..
call sym._puts
mov dword [esp + 4], str.data.csv
mov dword [esp], str.ghost.csv
call dbg.DecodeFile(char const*, char const*)
mov dword [esp], str.__decode_ghosts_success.
call sym._puts
mov dword [esp], str.___process_finished._check_data.csv
call sym._puts
mov dword [esp], str.pause
call sym._system
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x402f46
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call dbg.CSTR::length()
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x18], 0
js 0x40307e
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
jne 0x402f9c
shr dword [ebp - 0xc], 1
jmp 0x402fa9
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
jne 0x402fb8
shr dword [ebp - 0xc], 1
jmp 0x402fc5
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
jne 0x402fd4
shr dword [ebp - 0xc], 1
jmp 0x402fe1
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
jne 0x402ff0
shr dword [ebp - 0xc], 1
jmp 0x402ffd
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
jne 0x40300c
shr dword [ebp - 0xc], 1
jmp 0x403019
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
jne 0x403028
shr dword [ebp - 0xc], 1
jmp 0x403035
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
jne 0x403044
shr dword [ebp - 0xc], 1
jmp 0x403051
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
and eax, 1
test eax, eax
jne 0x403060
shr dword [ebp - 0xc], 1
jmp 0x40306d
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jl 0x40307e
jmp 0x402f7c
mov eax, dword [ebp - 0xc]
not eax
leave
ret

Function at 0x403758
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov dword [esp + 4], 0x4df508
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x403784
mov eax, 0xffffffff
jmp 0x4037df
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40379b
mov dword [ebp - 0xc], 0
jmp 0x4037a9
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov eax, 1
leave
ret 4
Function at 0x407544
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x40756f
mov dword [esp + 8], 0x513
mov dword [esp + 4], str.tinyxml_tinyxml.cpp
mov dword [esp], str.cfile
call sym.__assert
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jge 0x4075a7
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.
call sym._fwrite
add dword [ebp - 0xc], 1
jmp 0x407576
mov eax, dword [ebp - 0x1c]
add eax, 0x20
mov ecx, eax
call dbg.TiXmlString::c_str() const
mov dword [esp + 8], eax
mov dword [esp + 4], str._____s___
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fprintf
nop
leave
ret 8

Function at 0x4076e8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x48], sym.___gxx_personality_sj0
mov dword [ebp - 0x44], 0x4da36c
lea eax, [ebp - 0x40]
mov dword [eax], ebp
mov edx, 0x407826
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x60]
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
cmp dword [ebp + 8], 0
jne 0x407746
mov dword [esp + 8], 0x536
mov dword [esp + 4], str.tinyxml_tinyxml.cpp
mov dword [esp], str.cfile
mov dword [ebp - 0x5c], 0xffffffff
call sym.__assert
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + 0x2c]
test al, al
je 0x4077db
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0xa
mov dword [ebp - 0x5c], 0xffffffff
call sym._fputc
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0xc]
jge 0x4077ae
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.
mov dword [ebp - 0x5c], 0xffffffff
call sym._fwrite
add dword [ebp - 0x1c], 1
jmp 0x407776
mov eax, dword [ebp - 0x2c]
add eax, 0x20
mov ecx, eax
call dbg.TiXmlString::c_str() const
mov dword [esp + 8], eax
mov dword [esp + 4], str.___CDATA__s____n
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [ebp - 0x5c], 0xffffffff
call sym._fprintf
jmp 0x407848
lea eax, [ebp - 0x20]
mov ecx, eax
call dbg.TiXmlString::TiXmlString()
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], edx
mov dword [ebp - 0x5c], 1
call dbg.TiXmlBase::EncodeString(TiXmlString const&, TiXmlString*)
lea eax, [ebp - 0x20]
mov ecx, eax
call dbg.TiXmlString::c_str() const
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputs
lea eax, [ebp - 0x20]
mov ecx, eax
call dbg.TiXmlString::~TiXmlString()
jmp 0x407848
lea eax, [ebp - 0x60]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x407f74
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jge 0x407fb5
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.
call sym._fwrite
add dword [ebp - 0xc], 1
jmp 0x407f84
mov eax, dword [ebp - 0x1c]
add eax, 0x20
mov ecx, eax
call dbg.TiXmlString::c_str() const
mov dword [esp + 8], eax
mov dword [esp + 4], str.__s_
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fprintf
nop
leave
ret 8

Function at 0x414a30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x414a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4ec074]
test esi, esi
jle 0x414bb0
mov eax, dword [0x4ec078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x414ac4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x414b47
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x414ab0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x414bd7
mov eax, dword [0x4ec078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x4ec078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x414bb7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x414b40
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x414b50
add dword [0x4ec074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4ec078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x414b40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x414ace
mov eax, dword [0x4ec078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop