joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x94
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0x110]
mov esi, dword [eax + 0x764]
call fcn.0047d640
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], edx
mov al, byte [ebx + 0x6fd]
test al, al
jne 0x455ee8
mov al, byte [ebx + 0x720]
test al, al
je 0x455e83
mov edx, dword [ebx + 0x714]
mov ecx, dword [ebx + 0x71c]
inc edx
mov eax, edx
mov dword [ebx + 0x714], edx
cmp eax, ecx
jl 0x455e5f
mov eax, dword [ebx + 0x758]
test eax, eax
je 0x455e5f
mov ecx, dword [ebx + 0x75c]
push ecx
push ebx
call eax
add esp, 8
mov ecx, dword [ebx + 0x718]
mov eax, dword [ebx + 0x714]
mov esi, dword [ebx + 0x71c]
sub eax, ecx
sub esi, ecx
cdq
inc esi
idiv esi
add edx, ecx
mov dword [ebx + 0x714], edx
jmp 0x455ee8
mov esi, dword [ebx + 0x7dc]
mov eax, dword [ebx + 0x71c]
inc esi
mov ecx, dword [esi - 0x77]
mov bl, 0x14
pop es
add byte [eax], al
cmp ecx, eax
jl 0x455ee8
mov ecx, dword [ebx + 0x148]
test ecx, ecx
jne 0x455ec0
mov dword [ebx + 0x714], eax
mov eax, dword [ebx + 0x758]
test eax, eax
je 0x455ee8
mov edx, dword [ebx + 0x75c]
push edx
push ebx
jmp 0x455ee3
mov ecx, ebx
call fcn.00459a70
mov esi, eax
mov ecx, ebx
push esi
call fcn.004596a0
mov eax, dword [ebx + 0x750]
test eax, eax
je 0x455ee8
mov ecx, dword [ebx + 0x754]
push ecx
push esi
call eax
add esp, 8
mov edx, dword [ebx + 0x714]
mov ecx, ebx
push edx
call fcn.00457f70
cmp dword [ebx + 0x118], 0xffffffff
jne 0x455f0d
mov ecx, ebx
call fcn.0045acb0
mov ecx, ebx
call fcn.0045b450
mov al, byte [ebx + 0x6fd]
test al, al
jne 0x455f2c
mov ecx, ebx
call fcn.0045a990
mov ecx, ebx
call fcn.0045b050
mov ecx, ebx
and byte [ebx + ebx*2 - 0x7c750000], dl
cmp al, 1
add byte [eax], al
mov eax, dword [ebx + 0x13c]
test eax, eax
je 0x455f6a
mov eax, dword [ebx + 0x134]
mov esi, dword [eax + 4]
mov eax, dword [ebx + 0x138]
cmp esi, eax
je 0x455f6a
mov ecx, dword [esi]
push 0x3d088880
call fcn.00455df0
test al, al
je 0x4562e1
mov esi, dword [esi + 4]
mov eax, dword [ebx + 0x138]
cmp esi, eax
jne 0x455f49
mov eax, dword [ebx + 0x178]
push ebp
test eax, eax
push edi
je 0x455fc4
mov ecx, dword [ebx + 0x170]
mov eax, dword [ebx + 0x174]
lea ebp, [ebx + 0x170]
mov esi, dword [ecx + 4]
cmp esi, eax
je 0x455fc4
mov edi, dword [esi]
mov ecx, dword [edi]
mov al, byte [ecx + 0x258]
test al, al
je 0x455fb4
mov eax, esi
mov esi, dword [esi + 4]
push eax
mov ecx, ebp
call fcn.0048c4b0
push edi
mov ecx, ebx
call fcn.0045aac0
jmp 0x455fbc
call fcn.00466050
mov esi, dword [esi + 4]
cmp esi, dword [ebx + 0x174]
jne 0x455f8f
mov eax, dword [ebx + 0x184]
test eax, eax
je 0x4562d4
mov edx, dword [ebx + 0x17c]
mov eax, dword [ebx + 0x180]
mov ecx, dword [edx + 4]
cmp ecx, eax
mov dword [esp + 0x14], ecx
je 0x4562d4
mov edi, dword [esp + 0x8c]
jmp 0x455ffa
Function at 0x460010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x134
lea eax, [esp + 0x128]
push ebx
push ebp
push esi
mov ebp, ecx
push edi
lea ecx, [esp + 0x12c]
push eax
push ecx

Function at 0x4635c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x4635d2
call fcn.004912c0
mov al, byte [esi + 0xb4]
test al, al
jne 0x4635f6
mov al, byte [esi + 0x9e]
test al, al
je 0x4636b1
push 0x7b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x4635fd
mov ecx, esi
call fcn.00463d30
mov al, byte [esi + 0x9e]
test al, al
je 0x4636b1
mov eax, dword [esi + 0x94]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push edi
fld dword [eax + 8]
sub esp, 8
lea ecx, [esp + 0x14]
scasb al, byte es:[edi]
sbb al, 0x24
push str.RFPS:__5.2f
push ecx
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0xc]
push 0
not ecx
dec ecx
lea edx, [esp + 0x10]
shl ecx, 3
push 0xffff0000
push edx
sub eax, ecx
mov ecx, dword [esi + 0xb0]
push 0
push eax
call fcn.00493030
mov ecx, dword [esi + 0x98]
sub esp, 8
lea edx, [esp + 0x14]
fld dword [ecx + 8]
fstp qword [esp]
push str.TFPS:__5.2f
push edx
call ebx
add esp, 0x10
lea eax, [esp + 0xc]
lea edi, [esp + 0xc]
or ecx, 0xffffffff
push 0
push 0xffff0000
push eax
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0xc]
push 0x10
not ecx
dec ecx
shl ecx, 3
sub edx, ecx
mov ecx, dword [esi + 0xb0]
push edx
call fcn.00493030
pop edi
pop ebx
mov ecx, dword [esi + 0x44]
call fcn.0046a1b0
pop esi
add esp, 0x20
ret
Function at 0x4712c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x80]
push 0xffffffffffffffff
push 0x4fbf2b
push eax
mov dword fs:[0], esp
push ebp
push esi
push edi
mov esi, ecx
push 0x12345
push 6
push 0x3f400000
lea ebp, [esi + 0xc]
push 0x20
push 0x40000000
push 0x100
mov ecx, ebp
call fcn.004b2370
push 0x54321
push 6
push 0x3f59999a
push 0x20
push 0x40000000
push 0x100
lea ecx, [esi + 0xf0]
call fcn.004b2370
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x238], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x254], eax
mov dword [esi + 0x23c], edx
mov edx, dword [esp + 0x30]
shl eax, 2
push eax
mov dword [esi + 0x240], ecx
mov dword [esi + 0xca44], edx
mov dword [esi + 0x258], 0
mov dword [esi + 8], 0
mov byte [esi + 4], 0
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [esi + 0x25c], eax
test eax, eax
jne 0x4713ad
mov ecx, dword [0x53251c]
push str.A3DLightning::Init____Not_enough_memory_
push ecx
call fcn.0047b060
add esp, 8
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0x18
mov eax, dword [esi + 0x254]
xor edi, edi
test eax, eax
jle 0x47142c
push 0x3c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x14], 0
je 0x4713dc
mov ecx, eax
call fcn.0049fe70
jmp 0x4713de
xor eax, eax
mov edx, dword [esi + 0x25c]
push 0xffffffffffffffff
push 3
push 0x3f800000
mov dword [edx + edi*4], eax
mov ecx, dword [esi + 0x25c]
mov eax, dword [esi]
push ebp
mov ecx, dword [ecx + edi*4]
push eax
mov dword [esp + 0x28], 0xffffffff
call fcn.0049fe90
test al, al
je 0x471397
mov edx, dword [esi + 0x25c]
push str.flash.bmp
mov ecx, dword [edx + edi*4]
call fcn.004a04d0
mov eax, dword [esi + 0x254]
inc edi
cmp edi, eax
jl 0x4713b9
mov eax, dword [esi + 0x23c]
mov edi, dword [ebp + 0x6a]
jmp [edx + 1]

Function at 0x4742e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x328
push ebx
push ebp
mov ebp, ecx
push esi
xor esi, esi
push edi
mov eax, dword [ebp + 0xc817b0]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x18], eax
mov al, byte [esp + 0x344]
test al, al
je 0x47433a
mov ecx, dword [ebp + 0x110]
mov edx, dword [ecx + 0x764]
mov ecx, dword [edx + 0x78]
cmp ecx, esi
je 0x4748f5
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp eax, esi
mov dword [esp + 0x2c], eax
jne 0x474342
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x328
ret 0xc
mov dword [esp + 0x18], 0x3f800000
mov eax, dword [ebp + 0x17ac]
mov dword [esp + 0x34], esi
cmp eax, esi
jle 0x4748f5
Function at 0x477e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
push ebp
push esi
mov esi, ecx
mov ebp, dword [esp + 0x48]
fld dword [esp + 0x6c]
mov ecx, dword [esi + 0x9c]
mov edx, dword [esp + 0x5c]
inc ecx
lea eax, [esp + 0x4c]
mov dword [esi + 0x9c], ecx
mov ecx, dword [esp + 0x58]
fmul dword [ebp + 0xc]
mov dword [esp + 0x18], eax
mov al, byte [esp + 0x60]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov byte [esp + 0x34], al
mov eax, ecx
fstp dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x78]
push edi
mov dword [esp + 0x24], edx
mov edx, ecx
xor edi, edi
cmp eax, ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x44], edx
jle 0x477f3a
mov dword [esp + 0x4c], ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x4c]
add eax, ecx
lea edx, [eax + 0xc]
push edx
push eax
lea eax, [ebp + 0xc]
push eax
push ebp
call fcn.00469440
add esp, 0x10
test al, al
jne 0x477f12
mov ecx, dword [esp + 0x4c]
mov eax, dword [esi + 0x78]
inc edi
add ecx, 0x8c
cmp edi, eax
mov dword [esp + 0x4c], ecx
jl 0x477edb
jmp 0x477f36
mov ecx, dword [esi + 0x14]
lea eax, [edi*8 + 0x8f0000]
sub eax, edi
lea eax, [eax + eax*4]
lea edx, [ecx + eax*4]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
mov dword [esi + 0x1a8], edx
call fcn.00478040
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 0x64]
pop edi
pop esi
pop ebp
test al, al
je 0x477f4d
fld dword [0x4fe5d0]
jmp 0x477f53
fld dword [0x4fe6b0]
fld dword [esp + 0x38]
fmul dword [esp + 0x38]
fld dword [esp + 0x34]
fmul dword [esp + 0x34]
faddp st(1)
fld dword [esp + 0x30]
fmul dword [esp + 0x30]
faddp st(1)
fsqrt
fcom qword [0x4fe6c0]
fnstsw ax
test ah, 5
jp 0x477fa7
fcom qword [0x4fe6b8]
fnstsw ax
and eax, 0x4100
jne 0x477fa7
fstp st(0)
fld dword [0x4fe6b0]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
jmp 0x477fd5
fld dword [0x4fe6cc]
fdiv st(1)
fstp dword [esp + 0x58]
fstp st(0)
fld dword [esp + 0x58]
fmul dword [esp + 0x30]
fld dword [esp + 0x58]
fmul dword [esp + 0x34]
fstp dword [esp + 0x48]
fld dword [esp + 0x58]
fmul dword [esp + 0x38]
fstp dword [esp + 0x4c]
fmul st(1)
test ecx, ecx
fstp dword [esp]
fld dword [esp + 0x48]
fmul st(1)
fstp dword [esp + 4]
fld dword [esp + 0x4c]
fmul st(1)
fstp dword [esp + 8]
fstp st(0)
jle 0x478022
mov edx, dword [esp + 0x50]
lea eax, [edx + 8]
mov edx, ecx
fld dword [esp]
fadd dword [eax - 8]
add eax, 0x1c
dec edx
fstp dword [eax - 0x24]
fld dword [esp + 4]
fadd dword [eax - 0x20]
fstp dword [eax - 0x20]
fld dword [esp + 8]
fadd dword [eax - 0x1c]
fstp dword [eax - 0x1c]
jne 0x477ffe
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x20]
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
mov al, 1
mov dword [ecx], edx
add esp, 0x3c
ret 0x28
Function at 0x47b0d4
Capabilities:
Read file on windows

Disassembly:
sub byte [ecx + 0x48892c48], cl
xor byte [ecx + 0x48893448], cl
and al, 0x89
dec eax
cmp bl, al
nop
nop
nop
nop
nop
nop
nop
mov al, byte [esp + 4]
push esi
mov esi, ecx
test al, 1
mov dword [esi], 0x504490
je 0x47b0ea
invalid
push esi
call fcn.00454990
add esp, 4
invalid
mov eax, esi
pop esi
ret 4

Function at 0x47b0e0
Capabilities:
Read file on windows

Disassembly:
or dword [esi - 0x18], edx
test eax, 0x83fffd98
les eax, [ebx + ecx*4]
add al, 0x8b
Function at 0x48d570
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fc416
push eax
mov eax, dword [0x51f198]
mov dword fs:[0], esp
push ebx
push ebp
push esi
cmp eax, 4
push edi
mov esi, ecx
jne 0x48d5a1
mov byte [esi + 0x114], 1
jmp 0x48d7b3
mov esp, dword [esi]
inc ebx
and byte [ebx - 0x74dbdb0c], cl
pop esp
and al, 0x2c
mov dl, byte [esp + 0x30]
mov dword [esi + 0x308], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x128], eax
mov dword [esi + 0x740130], eax
mov al, byte [esp + 0x34]
mov dword [esi + 0x120], ecx
mov byte [esi + 0x115], al
mov dword [esi + 0x12c], ebx
test al, al
mov dword [esi + 0x10f], ebx
mov byte [esi + 0x525], dl
mov eax, ebx
je 0x48d604
and eax, 0x80000001
jns 0x48d5fb
dec eax
or eax, 0xfffffffe
inc eax
je 0x48d614
xor al, al
jmp 0x48d7b5
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x48d745
mov ebp, dword [sym.imp.MSVCRT.dll_malloc]
lea edx, [ebx + ebx]
push edx
call ebp
add esp, 4
mov dword [esi + 0x11c], eax
test eax, eax
je 0x48d745
mov al, byte [esi + 0x525]
test al, al
je 0x48d67d
mov eax, dword [esi + 0x128]
add eax, eax
push eax
call ebp
add esp, 4
mov dword [esi + 0x528], eax
test eax, eax
je 0x48d745
mov ecx, dword [esi + 0x12c]
add ecx, ecx
push ecx
call ebp
add esp, 4
mov dword [esi + 0x52c], eax
test eax, eax
je 0x48d745
mov dword [esi + 0x530], 3
mov edx, dword [esi + 0x120]
shl edx, 2
push edx
call ebp
add esp, 4
mov dword [esi + 0x118], eax
test eax, eax
je 0x48d745
mov eax, dword [esi + 0x120]
xor edi, edi
test eax, eax
jle 0x48d6d9
mov eax, dword [esi + 0x128]
shl eax, 5
push eax
call ebp
mov ecx, dword [esi + 0x118]
add esp, 4
mov dword [ecx + edi*4], eax
mov edx, dword [esi + 0x118]
xor esp, 0xffffffba
add byte [edi], cl
test bh, al
add byte [eax], al
add byte [ebx + 0x812086], cl
add byte [edi + 0x3b], al
clc
jl 0x48d6a6
push 0x5c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x30], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x18], edi
je 0x48d6fa
mov ecx, eax
call fcn.0049efa0
jmp 0x48d6fc
xor eax, eax
or ebp, 0xffffffff
cmp eax, edi
mov dword [esp + 0x18], ebp
mov dword [esi + 0x110], eax
jne 0x48d714
push str.A3DMesh::Init___Not_enough_memory_
jmp 0x48d737
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x308]
push 1
push 1
push edi
push ebx
push ecx
push edi
push edx
mov ecx, eax
call fcn.0049f0b0
test al, al
jne 0x48d749
push str.A3DMesh::Init___m_pA3DStream_Init_Fail_
mov eax, dword [0x53251c]
push eax
call fcn.0047b060
add esp, 8
xor al, al
jmp 0x48d7b5
mov ecx, dword [esi + 0x308]
push ecx
lea ecx, [esi + 0x13c]
call fcn.004a7900
test al, al
je 0x48d7b5
push 0x3a4
call 0xff7d49bc
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, edi
mov dword [esp + 0x18], 1
je 0x48d785
mov ecx, eax
call fcn.0048c600
jmp 0x48d787
xor eax, eax
cmp eax, edi
mov dword [esp + 0x18], ebp
mov dword [esi + 0x314], eax
jne 0x48d799
xor al, al
jmp 0x48d7b5
mov edx, dword [esi + 0x308]
push 0xff000000
push ebp
push edx
mov ecx, eax
call fcn.0048c630
mov dword [esi + 0x124], edi
mov al, 1
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x18
Function at 0x4968b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1dc
xor eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov ecx, 0x1e
Function at 0x4b0f80
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
mov eax, dword [esi + 0x108]
cmp eax, ebx
jae 0x4b0fb7
mov eax, dword [0x532678]
test eax, eax
je 0x4b0faf
push ebx
push str.AFilePackage::ReadFile____Offset___d__beyond_the_end_of_the_file_
push eax
call fcn.004b27d0
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
ret 0x10
mov ecx, dword [esp + 0x1c]
sub eax, ebx
cmp dword [ecx], eax
jae 0x4b0fe0
mov eax, dword [0x532678]
test eax, eax
je 0x4b103c
push str.AFilePackage::ReadFile____Buffer_is_too_small_
push eax
call fcn.004b27d0
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
ret 0x10
mov edx, dword [esi + 0x104]
mov eax, dword [edi + 0x118]
add edx, ebx
push 0
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [esi + 0x108]
mov ecx, dword [esi + 0x10c]
add esp, 0xc
cmp eax, ecx
jbe 0x4b1089
push ecx
mov ecx, edi
mov dword [esp + 0x14], eax
call fcn.004b0760
test al, al
jne 0x4b1021
pop edi
pop esi
pop ebx
ret 0x10
test ebx, ebx
jbe 0x4b1044
mov eax, dword [0x532678]
test eax, eax
je 0x4b103c
push str.AFilePackage::ReadFile____use_a_offset_for_read_is_not_allowed_when_using_a_compressed_package_
push eax
call fcn.004b27d0
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
ret 0x10
mov ecx, dword [edi + 0x118]
mov edx, dword [esi + 0x10c]
mov eax, dword [edi + 0x11c]
push ecx
push 1
push edx
dec edi
call dword [sym.imp.MSVCRT.dll_fread]
mov ecx, dword [esi + 0x10c]
mov edx, dword [edi + 0x11c]
push ecx
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x24]
push edx
push eax
push ecx
call fcn.004b9450
add esp, 0x20
mov al, 1
pop edi
pop esi
pop ebx
ret 0x10
mov edx, dword [edi + 0x118]
sub eax, ebx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [0x674fe278]
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x4b1740
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x110
push ebx
mov ebx, dword [esp + 0x118]
push ebp
push esi
mov esi, ecx
push edi
push 0x104
push ebx
lea eax, [esi + 8]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea ebp, [esi + 0x10c]
push ebp
push ebx
call fcn.004b05d0
mov ecx, dword [0x532788]
add esp, 0x14
test ecx, ecx
jne 0x4b1881
push 0x514f80
push ebx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x4b17c1
mov eax, dword [0x532678]
test eax, eax
je 0x4b193a
push ebx
push str.AFileImage::Init_Cant_open_file___s__to_create_image_in_memory
push eax
call fcn.004b27d0
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push edi
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 0x10
mov dword [esi + 0x220], eax
test eax, eax
jne 0x4b180c
mov eax, dword [0x532678]
test eax, eax
je 0x4b18f7
push str.AFileImage::Init_The_file___s__is_zero_length_
push eax
call fcn.004b27d0
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push 0
push 0
push edi
call ebx
mov ecx, dword [esi + 0x220]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 0x10
mov dword [esi + 0x218], eax
test eax, eax
jne 0x4b1857
mov eax, dword [0x532678]
test eax, eax
je 0x4b18f7
push str.AFileImage::Init_Not_enough_memory_
push eax
call fcn.004b27d0
add esp, 8
xor bl, bh
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
adc byte [ecx], al
add byte [eax], al
ret 4
mov edx, dword [esi + 0x220]
push edi
push 1
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x110
ret 4
lea eax, [esp + 0x10]
push 0
push eax
push ebp
call fcn.004b0de0
jecxz 0x4b1850
jne 0x4b18bd
mov eax, dword [0x532678]
test eax, eax
je 0x4b193a
push ebp
push 0x526802
call 0x5a3e92
add byte [ebx - 0x3fcdf33c], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x118]
stc
mov esi, 0x220
push eax
mov dword [edi + edi*8], edi
adc eax, sym.imp.MSVCRT.dll_malloc
add esp, 4
mov dword [esi + 0x218], eax
test eax, eax
jne 0x4b1906
mov eax, dword [0x532678]
test eax, eax
je 0x4b18f7
push str.AFileImage::Init____Not_enough_memory_
push eax
call fcn.004b27d0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 4
push edi
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, dword [0x532788]
call fcn.004b0f80
test al, al
jne 0x4b1872
mov eax, dword [0x532678]
test eax, eax
je 0x4b193a
push ebp
push str.AFileImage::Init____Error_Reading_file___s__from_package_
push eax
call fcn.004b27d0
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 4
Function at 0x4b1eb0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x214]
test al, al
je 0x4b1ec8
mov eax, dword [esi]
call dword [eax + 0x10]
mov edi, dword [esp + 0x38]
lea ebp, [esi + 8]
push 0x104
push edi
push ebp
call dword [sym.imp.MSVCRT.dll_strncpy]
lea ecx, [esi + 0x10c]
push ecx
push edi
call fcn.004b05d0
mov ebx, dword [esp + 0x50]
add esp, 0x14
test bl, 1
mov byte [esp + 0x14], 0
je 0x4b1f10
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov bx, word [edx + 0x5269bc]
repne scasb al, byte es:[edi]
mov word [edi - 1], dx
mov eax, ebx
and eax, 2
mov dword [esp + 0x38], eax
je 0x4b1f30
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x5269b8]
mov word [edi - 1], ax
test bl, 4
je 0x4b1f4b
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov cx, word [0x51be3c]
mov word [edi - 1], cx
mov eax, ebx
lea edi, [esp + 0x14]
and eax, 8
mov dword [esp + 0x3c], eax
je 0x4b1f6e
or ecx, 0xffffffff
xor eax, eax
mov dx, word [0x5269b4]
repne scasb al, byte es:[edi]
mov word [edi - 1], dx
jmp 0x4b1f7f
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ax, word [str.btwr]
mov word [edi - 1], ax
lea ecx, [esp + 0x14]
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [esi + 4], eax
test eax, eax
jne 0x4b1fa1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x24
ret 8
mov ecx, dword [esp + 0x38]
push eax
push 1
push 4
test ecx, ecx
je 0x4b200e
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x210], ebx
test ecx, ecx
je 0x4b1fe5
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x54584f4d
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov byte [esi + 0x214], 1
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x42584f4d
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov byte [esi + 0x214], 1
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea ecx, [esp + 0x1c]
and ebx, 0xffffffe7
push ecx
mov dword [esi + 0x210], ebx
call dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp eax, 0x42584f4d
jne 0x4b2051
mov eax, dword [esi + 0x210]
mov byte [esi + 0x20b], 1
or al, 0x10
pop edi
mov dword [esi + 0x210], eax
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x24
ret 8
cmp eax, 0x54584f4d
jne 0x4b2079
mov eax, dword [esi + 0x210]
mov byte [esi + 0x214], 1
or al, 8
pop edi
mov dword [esi + 0x210], eax
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x24
ret 8
mov ebx, dword [esi + 0x670210]
mov edx, dword [esi + 4]
push 0
or ebx, 8
push 0
push edx
mov dword [esi + 0x210], ebx
popfd
adc eax, 0xf7e27c
add esp, 0xc
mov byte [esi + 0x214], 1
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8

Function at 0x4b2670
Capabilities:
Create directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push esi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x4b268f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop esi
ret
Function at 0x4c3165
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x506860
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4c31bd
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
jne 0x4c31a3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
je 0x4c3195
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4c31bd
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x4c31bd
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4c31e6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 0x506860
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4c3254
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c324b
cmp dword [ebp - 0xc], 4
jne 0x4c324b
cmp dword [ebp - 0x10], edi
je 0x4c324b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x528140], edi
xor eax, eax
jmp 0x4c327c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x528140], edi
jge 0x4c3277
mov dword [0x528140], edi
call fcn.004c31c1
test eax, eax
je 0x4c3277
emms
mov dword [0x528140], 1
mov eax, dword [0x528140]
pop edi
leave
ret