joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a381
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4970f0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x48a3c7
cmp word [ebx], dx
jne 0x48a3c7
or byte [eax + edi + 0x28], 4
jmp 0x48a3cc
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x48a52f
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x48a50f
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x48a40d
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x48a443
cmp eax, edx
jae 0x48a451
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x48a3e8
jmp 0x48a52f
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48a50a
cmp dword [ebp - 0x18], 0
je 0x48a50a
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4970f0]
test byte [eax + edi + 0x28], 0x48
je 0x48a4e0
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x48a4a4
mov word [esi], cx
jmp 0x48a4db
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4970f0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4970f0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4970f0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x48a52f
pop eax
cmp word [ebp - 4], ax
jne 0x48a4f0
cmp esi, ebx
jne 0x48a4f0
mov word [esi], ax
jmp 0x48a52c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0048a02d
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x48a52f
push 0xd
pop eax
jmp 0x48a4eb
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4970f0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x48a529
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x48a52f
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x48bba5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0048bb21
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x48bd14
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x48bd14
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x48bcc9
jg 0x48bc01
test eax, eax
je 0x48bcbf
push 1
push 0x1000
call fcn.00485c66
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x48bc24
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x48bcb6
push 0x8000
push ebx
call fcn.00482ea3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x48bc4d
jg 0x48bc48
cmp ecx, 0x1000
jb 0x48bc4d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004847f1
add esp, 0x10
cmp eax, 0xffffffff
je 0x48bc92
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x48bc48
jl 0x48bc79
test ecx, ecx
jne 0x48bc3a
push dword [ebp - 0xc]
push ebx
call fcn.00482ea3
push esi
call fcn.00485665
add esp, 0xc
xor ebx, ebx
jmp 0x48bd22
cmp byte [edi + 0x24], 0
je 0x48bca9
cmp dword [edi + 0x20], 5
jne 0x48bca9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x48bcb4
mov ebx, dword [edi + 0x18]
jmp 0x48bcb6
xor ebx, ebx
push esi
call fcn.00485665
pop ecx
jmp 0x48bd22
test ecx, ecx
jg 0x48bc8b
jl 0x48bcc9
test eax, eax
jae 0x48bc8b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0048a02d
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x48bce9
cmp byte [edi + 0x1c], 0
je 0x48bc8b
jmp 0x48bd1a
push ebx
call fcn.00487989
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x48bc8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x48bd22
cmp byte [edi + 0x1c], 0
je 0x48bd1f
mov ebx, dword [edi + 0x18]
jmp 0x48bd22
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0048a02d
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48dd10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48dd3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48dd3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x2b321e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x26a5015
lea edi, [esi - 0x22a4015]
push edi
or ebp, 0xffffffff
jmp 0x2b32202
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x2b32209
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2b321f8
mov eax, 1
add ebx, ebx
jne 0x2b3221b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x2b3222c
jne 0x2b3224b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2b3224b
dec eax
add ebx, ebx
jne 0x2b32238
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x2b32210
add ebx, ebx
jne 0x2b32247
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x2b3229d
xor ecx, ecx
sub eax, 3
jb 0x2b32263
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x2b322d2
sar eax, 1
mov ebp, eax
jmp 0x2b3226e
add ebx, ebx
jne 0x2b3226e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2b3223c
inc ecx
add ebx, ebx
jne 0x2b3227c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2b3223c
add ebx, ebx
jne 0x2b32289
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x2b3227e
jne 0x2b3229a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x2b3227e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x2b322bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x2b322ae
jmp 0x2b321fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x2b322bc
add edi, ecx
jmp 0x2b321fe
pop esi
mov edi, esi
mov ecx, 0x15e183
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x2b322da
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x2b322df
lea edi, [esi + 0x272f000]
mov eax, dword [edi]
or eax, eax
je 0x2b32350
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2732c7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2732cb8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x2b32305
mov ecx, edi
jns 0x2b32334
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2732cc0]
or eax, eax
je 0x2b3234a
mov dword [ebx], eax
add ebx, 4
jmp 0x2b32322
call dword [esi + 0x2732cbc]
mov ebp, dword [esi + 0x2732cc4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x2b32384
sub esp, 0xffffff80
jmp 0x410984
Function at 0x4049b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d55f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.004104ce
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x404a3b
push eax
push esi
call fcn.00410b6c
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x42f384
call fcn.0041069a
int3

Function at 0x411c94
Capabilities:
Encode data using xor

Disassembly:
wait
pop esp
xor ebx, dword [eax - 0x35]
mov byte [0xcbcf81bf], al
push eax
sub dword ss:[eax - 0x14edc777], ebp
sbb dl, byte [ebp + 0x28bb2381]
or dword [eax], 0x48
invalid

Function at 0x4133d0
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
shr byte ss:[eax + 0x18], 0x4a
mov eax, 0x8dcde862
aas
test eax, 0x9c34f6cf
add dword [esi - 0x6e], esi
in al, 0x73
mov ebx, 0x61ceaea4
add dword [edi - 0x38], edx
aaa
call 0xe8ba117
mov al, byte [0x3a0e1f23]
insb byte es:[edi], dx
dec esi
mov ebx, 0xbc3a0e5b
mov esi, 0xbeef843d
pop ds
push cs
cmp ch, byte [esi + ecx*2 - 0x45]
pop ebx
push cs
cmp bh, byte [esi + edi*4 - 0x41107bc3]
xchg dword [eax], ebx
out 0x99, al
mov eax, 0xc37f5436
sub dword [ebx + ebx*4 + 0x34], eax
pushfd
xor dh, cl
jb 0x41330f
pop esp
jbe 0x4133b4
mov eax, 0xa724da65
iretd
fsubr dword [esi + edi*2 + 0x4f]
mov bh, 0x78
loopne 0x413335
and cl, 0x31
pushfd
lcall 0x1f06, 0xc6f5097c
fidivr dword [ecx + 0x2b8ecdb0]
pop ebx
jbe 0x4133b3
sbb dword [edx], ecx
fnsave dword [edx - 0x5e4a122b]
xor eax, 0xbdd961c9
pop ecx
out dx, al
adc al, 0xe
jle 0x4133ad
invalid
xchg byte [edx - 0x31], dh
xor byte [edx], bl
fld qword [esi]
push es
push 0xdb406f8c
jecxz 0x4133c7
fadd dword [ebx - 0x50f513bf]
push edi
or dword [edx], edx
pop dword [esi + 0x46]
xchg edx, eax
fcom qword [esi - 0x27]
out dx, eax
or dword [ebx + 0x6dc9365d], edi
leave
insd dword es:[edi], dx
leave
insd dword es:[edi], dx
idiv dword [esp + edx - 0x31]
lodsd eax, dword [esi]
imul eax, ebx, 0x51a97770
pop esp
jae 0x413447
mov ch, 0xa9
jecxz 0x41336f
push 0x4b
cli
dec ebp
mov ecx, 0x191d14fd
movsb byte es:[edi], byte [esi]
lcall 0x8a8c, 0xf29a4388
dec ebp
dec edx
lss eax, [edx - 5]
mov esi, 0x8548646c
and bl, bl
xchg ecx, eax
test eax, 0x2d295d87
das
invalid
pushfd
invalid
Function at 0x4014e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x442134
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040eb28
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401518
push 0x442100
call fcn.0040f5db
add esp, 4
or eax, 0xffffffff
jmp 0x4016ce
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
mov edx, dword [ebp - 8]
add edx, 8
push edx
mov eax, dword [ebp - 8]
add eax, 0x130
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00401078
cmp eax, 0xffffffff
jne 0x401555
push 0x4420e0
call fcn.0040f5db
add esp, 4
or eax, 0xffffffff
jmp 0x4016ce
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
and eax, 0x10
je 0x401565
jmp 0x401672
mov ecx, dword [ebp - 8]
add ecx, 0x2c
push ecx
mov edx, dword [ebp - 8]
add edx, 0x130
push edx
mov eax, dword [ebp - 8]
add eax, 0x230
push eax
call fcn.0040ee80
add esp, 8
push eax
call fcn.0040ee90
add esp, 8
mov ecx, dword [ebp - 8]
add ecx, 0x230
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
imul eax, eax, 0x208
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x330]
push eax
call fcn.0040ee80
add esp, 8
mov edx, dword [ebp - 8]
add edx, 0x2c
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
imul ecx, ecx, 0x208
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x330]
lea ecx, [eax + ecx + 0x100]
push ecx
call fcn.0040ee80
add esp, 8
mov edx, dword [ebp - 8]
add edx, 0x230
push edx
mov ecx, dword [ebp - 8]
call fcn.0040101e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
imul edx, edx, 0x208
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x330]
mov dword [ecx + edx + 0x204], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
imul edx, edx, 0x208
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x330]
mov dword [ecx + edx + 0x200], eax
mov edx, dword [ebp - 4]
push edx
push 1
push 0x208
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
imul ecx, ecx, 0x208
mov edx, dword [ebp - 8]
add ecx, dword [edx + 0x330]
push ecx
call fcn.0040f54e
add esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x3e8
jne 0x401672
jmp 0x401690
mov ecx, dword [ebp - 8]
add ecx, 8
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call fcn.0040ed43
add esp, 8
test eax, eax
je 0x401555
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.0040104b
cmp eax, 0xffffffff
jne 0x4016ae
or eax, 0xffffffff
jmp 0x4016ce
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call fcn.0040f163
add esp, 4
mov eax, dword [ebp - 4]
push eax
call fcn.0040e6d6
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4019a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x4420d8
mov eax, dword [ebp + 8]
push eax
call fcn.0040eb28
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
jne 0x4019d2
or eax, 0xffffffff
jmp 0x401b3b
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040e7d9
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4019f4
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jge 0x401a9d
push 1
push 0x100
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040e7d9
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
push 1
push 0x100
mov eax, dword [ebp - 4]
imul eax, eax, 0x208
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
lea eax, [edx + eax + 0x100]
push eax
call fcn.00411374
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
push 1
push 4
mov edx, dword [ebp - 4]
imul edx, edx, 0x208
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
lea edx, [ecx + edx + 0x200]
push edx
call fcn.00411374
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
push 1
push 4
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x208
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
lea ecx, [eax + ecx + 0x204]
push ecx
call fcn.00411374
add esp, 0x10
push 1
push 4
mov edx, dword [ebp - 8]
push edx
call fcn.0040e7d9
add esp, 0xc
jmp 0x4019eb
mov dword [ebp - 4], 0
jmp 0x401aaf
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jge 0x401b2a
push str._Y__m__d__H:_M:_S
mov edx, dword [ebp - 4]
imul edx, edx, 0x208
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx + edx + 0x200]
cdq
push edx
push eax
mov ecx, dword [ebp - 0xc]
call fcn.004010a0
push eax
mov edx, dword [ebp - 4]
imul edx, edx, 0x208
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx + edx + 0x204]
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
add eax, 1
push eax
mov edx, dword [ebp - 4]
imul edx, edx, 0x208
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
lea edx, [ecx + edx + 0x100]
push edx
push str.__20s_t_10dK_t_s_n
call fcn.0040f5db
add esp, 0x10
jmp 0x401aa6
mov eax, dword [ebp - 8]
push eax
call fcn.0040e6d6
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x401bb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x4420d8
mov eax, dword [ebp + 8]
push eax
call fcn.0040eb28
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
jne 0x401be2
or eax, 0xffffffff
jmp 0x401da2
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp + 0xc]
jg 0x401d7b
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.0040e7d9
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x401c10
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jge 0x401cb9
push 1
push 0x100
mov edx, dword [ebp - 8]
push edx
call fcn.0040e7d9
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
push 1
push 0x100
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x208
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
lea ecx, [eax + ecx + 0x100]
push ecx
call fcn.00411374
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
push 1
push 4
mov eax, dword [ebp - 4]
imul eax, eax, 0x208
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
lea eax, [edx + eax + 0x200]
push eax
call fcn.00411374
add esp, 0x10
mov ecx, dword [ebp - 8]
push ecx
push 1
push 4
mov edx, dword [ebp - 4]
imul edx, edx, 0x208
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
lea edx, [ecx + edx + 0x204]
push edx
call fcn.00411374
add esp, 0x10
push 1
push 4
mov eax, dword [ebp - 8]
push eax
call fcn.0040e7d9
add esp, 0xc
jmp 0x401c07
mov dword [ebp - 4], 0
jmp 0x401ccb
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jge 0x401d79
push str._Y__m__d__H:_M:_S
mov eax, dword [ebp - 4]
imul eax, eax, 0x208
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + eax + 0x200]
cdq
push edx
push eax
mov ecx, dword [ebp - 0xc]
call fcn.004010a0
push eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x208
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + eax + 0x204]
cdq
and edx, 0x3ff
add eax, edx
sar eax, 0xa
add eax, 1
push eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x208
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
lea eax, [edx + eax + 0x100]
push eax
push str.__20s_t_10dK_t_s_n
call fcn.0040f5db
add esp, 0x10
mov eax, dword [ebp - 4]
add eax, 1
cdq
idiv dword [ebp + 0x10]
test edx, edx
jne 0x401d74
push 0xa
call fcn.004114e4
add esp, 4
push str.pause
call fcn.004113c0
add esp, 4
push 0xa
call fcn.004114e4
add esp, 4
jmp 0x401cc2
jmp 0x401d91
mov ecx, dword [ebp + 0x10]
push ecx
push 0x442184
call fcn.0040f5db
add esp, 8
or eax, 0xffffffff
jmp 0x401da2
mov edx, dword [ebp - 8]
push edx
call fcn.0040e6d6
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401ea0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0x4420d8
mov eax, dword [ebp + 8]
push eax
call fcn.0040eb28
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401ed8
push 0x4421b4
call fcn.0040f5db
add esp, 4
or eax, 0xffffffff
jmp 0x4020d3
cmp dword [ebp + 0xc], 0
jne 0x401ef3
push 0x4421a0
call fcn.0040f5db
add esp, 4
or eax, 0xffffffff
jmp 0x4020d3
mov dword [ebp - 0x10], 0
jmp 0x401f05
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0x10]
jge 0x401f98
push 1
push 0x100
mov eax, dword [ebp - 8]
push eax
call fcn.0040e7d9
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0x100
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x208
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
lea edx, [ecx + edx + 0x100]
push edx
call fcn.00411374
add esp, 0x10
push 1
push 4
mov eax, dword [ebp - 8]
push eax
call fcn.0040e7d9
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
push 1
push 4
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x208
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
lea edx, [ecx + edx + 0x204]
push edx
call fcn.00411374
add esp, 0x10
push 1
push 4
mov eax, dword [ebp - 8]
push eax
call fcn.0040e7d9
add esp, 0xc
jmp 0x401efc
mov dword [ebp - 4], 0
push 0x101
call fcn.0040ef91
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ecx
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.0040e7d9
add esp, 0xc
push 1
mov eax, dword [ebp + 0x10]
imul eax, eax, 0x208
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040e7d9
add esp, 0xc
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x10]
jge 0x4020b6
mov eax, dword [ebp - 4]
imul eax, eax, 0x208
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
lea eax, [edx + eax + 0x100]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040ee80
add esp, 8
push eax
call fcn.0040ee90
add esp, 8
mov eax, dword [ebp - 4]
imul eax, eax, 0x208
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
lea eax, [edx + eax + 0x100]
push eax
push 0x44219c
call fcn.0040f5db
add esp, 8
push 0x442134
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040eb28
add esp, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0
jmp 0x402061
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
imul eax, eax, 0x208
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [edx + eax + 0x204]
jge 0x40209c
mov edx, dword [ebp - 8]
push edx
call fcn.0040f9ad
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0040f72f
add esp, 8
jmp 0x402058
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.0040e6d6
add esp, 4
jmp 0x401fdd
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004114e9
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.0040e6d6
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4025f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c968
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4494cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
push 0x4420d8
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040eb28
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402637
jmp 0x4026e5
push 2
push 0xfffffffffffffffc
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0040e7d9
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
push 1
push 4
lea eax, [ebp + 0x10]
push eax
call fcn.00411374
add esp, 0x10
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.0040113b
lea ecx, [ebp - 0x10]
call fcn.004010f5
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x4026a4
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00401050
cmp eax, 0xffffffff
jne 0x4026a2
push 0x44221c
call fcn.0040f5db
add esp, 4
jmp 0x4026ca
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00401014
cmp eax, 0xffffffff
jne 0x4026ca
push 0x44221c
call fcn.0040f5db
add esp, 4
mov edx, dword [ebp - 0x14]
push edx
call fcn.0040e6d6
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401096
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc