joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov esi, dword [edi]
test esi, esi
je 0x462da0
mov eax, dword [esi - 8]
add esi, 0xfffffff8
cmp eax, 0xffffffff
je 0x462d97
dec eax
mov dword [esi], eax
test eax, eax
jg 0x462d97
push esi
call fcn.00501c9e
mov edx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 8]
mov dword [edi], 0
test edx, edx
jne 0x462dac
mov dword [edi], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x563dac]
push ebx
push str..wav
push edx
mov edx, eax
call fcn.00497ad0
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
add esp, 8
test esi, esi
je 0x462e0f
push esi
call ebx
cmp eax, 0xffffffff
je 0x462ddb
test al, 0x10
je 0x462e58
mov eax, dword [esi - 4]
push esi
mov dword [eax + esi - 4], 0x67676f2e
call ebx
cmp eax, 0xffffffff
je 0x462df2
test al, 0x10
je 0x462e58
mov eax, dword [esi - 8]
add esi, 0xfffffff8
cmp eax, 0xffffffff
je 0x462e16
dec eax
mov dword [esi], eax
test eax, eax
jg 0x462e16
push esi
call fcn.00501c9e
add esp, 4
jmp 0x462e16
mov dword [esi - 4], 0x67676f2e
mov edx, dword [ebp - 8]
mov ecx, dword [0x55f1c4]
push str..wav
push dword [ebp - 4]
call fcn.00497ad0
mov esi, eax
add esp, 8
test esi, esi
je 0x462e89
push esi
call ebx
cmp eax, 0xffffffff
je 0x462e41
test al, 0x10
je 0x462e58
mov eax, dword [esi - 4]
push esi
mov dword [eax + esi - 4], 0x67676f2e
call ebx
cmp eax, 0xffffffff
je 0x462e61
test al, 0x10
jne 0x462e61
pop ebx
mov dword [edi], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi - 8]
add esi, 0xfffffff8
cmp eax, 0xffffffff
je 0x462e90
dec eax
mov dword [esi], eax
test eax, eax
jg 0x462e90
push esi
call fcn.00501c9e
add esp, 4
mov dword [edi], 0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi - 4], 0x67676f2e
pop ebx
mov dword [edi], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x468fb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x552064]
xor eax, esp
mov dword [esp + 0x20], eax
mov byte [0x560200], cl
push ebx
push esi
push edi
test cl, cl
je 0x469025
push 0x90080000
push 0xfffffffffffffff0
push dword [0x563870]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, 0x560208
call fcn.00468d50
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x120
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0xffffffffffffffff
push dword [0x563870]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x469058
push 0xc80000
push 0xfffffffffffffff0
push dword [0x563870]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x123
push 0
push 0
push 0
push 0
push 0
push dword [0x563870]
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.00469200
push 5
push dword [0x563870]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x564b50], 0
mov ebx, dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [sym.imp.USER32.dll_FillRect]
je 0x46913e
mov ecx, dword [0x560210]
mov eax, 0x66666667
sub ecx, dword [0x560208]
imul ecx
mov ecx, dword [0x560214]
mov eax, 0x88888889
sub ecx, dword [0x56020c]
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
imul ecx
mov eax, dword [0x564b6d]
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x564b5d]
imul eax, ecx
mov esi, dword [edx]
push eax
mov eax, dword [0x564b69]
imul eax, ebx
push eax
mov eax, dword [0x564b65]
imul eax, ecx
add eax, dword [0x56020c]
push eax
mov eax, dword [0x564b61]
imul eax, ebx
add eax, dword [0x560208]
push eax
push edx
call dword [esi + 0x9c]
push dword [0x563870]
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.USER32.dll_GetClientRect]
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push dword [0x563870]
call ebx
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x20]
push eax
push esi
call edi
push esi
push dword [0x563870]
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.004692f0
mov eax, dword [0x560210]
movsd xmm2, qword [0x5454e0]
test eax, eax
jg 0x469159
movsd qword [0x5602b0], xmm2
jmp 0x469179
movd xmm1, dword [0x55312c]
movd xmm0, eax
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [0x5602b0], xmm1
mov eax, dword [0x560214]
test eax, eax
jg 0x46918c
movsd qword [0x5602b8], xmm2
jmp 0x4691ac
movd xmm1, dword [0x5530c4]
movd xmm0, eax
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [0x5602b8], xmm1
push dword [0x563870]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push dword [0x563870]
call ebx
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x20]
push eax
push esi
call edi
push esi
push dword [0x563870]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e66f2
mov esp, ebp
pop ebp
ret
Function at 0x469b60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x55695e], 0
push esi
push edi
mov edi, ecx
je 0x469bb3
push edi
push 3
push 0x8001
push dword [0x563870]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp byte [0x556bc2], 0
jne 0x469bb3
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x556b23], 0
jne 0x469bb3
cmp byte [0x556961], 0
je 0x469bb3
push 0xa
call esi
cmp byte [0x556bc2], 0
je 0x469b94
push 0x30
push 0x544d50
push edi
push dword [0x563870]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp byte [0x556bc1], 0
jne 0x469bd8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x54fe2c
lea eax, [ebp - 1]
push eax
call fcn.004fe0ba
int3

Function at 0x469bf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x552064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x400
push 0
push 0x564c18
call fcn.004fdf60
push esi
push 0x400
push 0x564c18
call fcn.00506096
push 0x544d4c
push 0x400
push 0x564c18
call fcn.00506096
mov ebx, dword [ebp + 0xc]
add esp, 0x24
test ebx, ebx
jle 0x469ca9
lea edi, [ebp + 0xc]
nop dword [eax + eax]
mov esi, dword [edi + 4]
lea eax, [ebp - 0x24]
push 0xa
push 0x10
lea edi, [edi + 4]
push eax
push esi
call fcn.00504c41
push 0x10
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00504c41
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x424]
push str._s_0x_s__
push eax
call fcn.00469dd0
lea eax, [ebp - 0x424]
push eax
push 0x400
push 0x564c18
call fcn.00506096
add esp, 0x3c
sub ebx, 1
jne 0x469c50
cmp byte [0x55695e], 0
je 0x469cff
push 0x564c18
push 3
push 0x8001
push dword [0x563870]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp byte [0x556bc2], 0
jne 0x469cff
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
cmp byte [0x556b23], 0
jne 0x469cff
cmp byte [0x556961], 0
je 0x469cff
push 0xa
call esi
cmp byte [0x556bc2], 0
je 0x469ce0
push 0x30
push 0x544d50
push 0x564c18
push dword [0x563870]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp byte [0x556bc1], 0
jne 0x469d28
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x54fe2c
lea eax, [ebp - 0x425]
push eax
call fcn.004fe0ba
int3
Function at 0x4702d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x556b21], 0
push esi
je 0x4702f3
test dword [0x563c58], 0x200
jne 0x470486
cmp byte [0x56057f], 0
jne 0x470486
mov eax, dword [0x5603b8]
cmp eax, 0xffffffff
jne 0x470318
mov ecx, dword [0x560531]
call fcn.004a13e0
mov eax, dword [eax + 0x2b]
test eax, eax
je 0x470486
push dword [0x560539]
mov edx, dword [0x560535]
mov ecx, dword [0x563cc8]
call fcn.004a00a0
add esp, 4
cmp eax, 0x1388
jl 0x47034d
movzx eax, byte [eax + 0x55f040]
add eax, 0x1388
mov ecx, eax
call fcn.00466df0
cmp eax, 0xa1
ja 0x470368
mov ecx, dword [0x5603c0]
movzx eax, word [ecx + eax*2 + 0xc]
jmp 0x47036a
xor eax, eax
movzx ecx, ax
call fcn.00466a20
mov edx, dword [0x5605c2]
mov esi, eax
mov ecx, dword [0x5603b8]
add edx, dword [esi + 0x18]
mov dword [0x5605c2], edx
cmp ecx, 0xffffffff
jne 0x4703a2
mov ecx, dword [0x560531]
call fcn.004a13e0
mov edx, dword [0x5605c2]
mov ecx, dword [eax + 0x2b]
lea eax, [ecx + ecx*4]
movd xmm1, ecx
shl eax, 2
cvtdq2pd xmm1, xmm1
cmp eax, edx
jle 0x4703be
movsd xmm0, qword [0x5454c0]
jmp 0x47042b
mov eax, ecx
shl eax, 4
sub eax, ecx
shl eax, 2
cmp eax, edx
jle 0x4703d6
movsd xmm0, qword [0x5454c8]
jmp 0x47042b
imul eax, ecx, 0x64
cmp eax, edx
jle 0x4703e7
movsd xmm0, qword [0x5454d0]
jmp 0x47042b
imul eax, ecx, 0x8c
cmp eax, edx
jle 0x4703fb
movsd xmm0, qword [0x5454f8]
jmp 0x47042b
lea eax, [ecx + ecx*4]
shl eax, 5
cmp eax, edx
jle 0x47040f
movsd xmm0, qword [0x545518]
jmp 0x47042b
imul eax, ecx, 0xb4
cmp eax, edx
jle 0x470423
movsd xmm0, qword [0x545538]
jmp 0x47042b
movsd xmm0, qword [0x545548]
divsd xmm0, xmm1
mov ecx, 0x10000
movd xmm1, dword [esi + 0x18]
cvtdq2pd xmm1, xmm1
imul eax, dword [0x563db0], 0x8088405
mulsd xmm1, xmm0
inc eax
divsd xmm1, qword [0x545590]
mov dword [0x563db0], eax
mul ecx
mulsd xmm1, qword [0x5455f0]
mov dword [esp + 8], eax
movd xmm0, edx
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x470486
mov dword [0x5605c2], 0
mov byte [0x5605c6], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47c7d2
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
xorps xmm0, xmm0
movsd qword [esp + 0x18], xmm0
push dword [edi]
push ebx
call fcn.0045fa90
add esp, 8
test al, al
je 0x47c837
mov al, byte [edi + 0x18]
dec al
cmp al, 2
jbe 0x47c837
movzx eax, byte [edi + 0x20]
cmp eax, 4
ja case.default.0x47c666
jmp dword [eax*4 + 0x47c844]
mov eax, dword [0x55f180]
xor esi, esi
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
jle case.default.0x47c666
nop word [eax + eax]
push dword [eax + esi*4]
mov edx, edi
mov ecx, ebx
call fcn.0047c860
movaps xmm1, xmm0
add esp, 4
movsd xmm0, qword [esp + 0x18]
comisd xmm0, xmm1
ja 0x47c6b4
movsd qword [esp + 0x18], xmm1
mov eax, dword [esp + 0x14]
inc esi
cmp esi, dword [esp + 0x10]
jl 0x47c690
movsd xmm1, qword [esp + 0x18]
comisd xmm1, xmmword [0x545478]
jbe 0x47c82d
imul eax, dword [0x563db0], 0x8088405
mov ecx, 0x64
inc eax
mov dword [0x563db0], eax
mul ecx
mov dword [esp + 0x18], eax
movd xmm0, edx
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x545590]
addsd xmm1, xmm0
movaps xmm0, xmm1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x55f180]
xor esi, esi
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
test ecx, ecx
jle case.default.0x47c666
nop dword [eax]
push dword [eax + esi*4]
mov edx, edi
mov ecx, ebx
call fcn.0047c860
addsd xmm0, qword [esp + 0x1c]
mov eax, dword [esp + 0x14]
inc esi
add esp, 4
movaps xmm1, xmm0
movsd qword [esp + 0x18], xmm1
cmp esi, dword [esp + 0x14]
jl 0x47c730
jmp 0x47c6c5
push ebx
mov edx, edi
mov ecx, ebx
call fcn.0047c860
add esp, 4
movaps xmm1, xmm0
jmp 0x47c6c5
mov eax, dword [0x5605e8]
xor esi, esi
mov ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jle case.default.0x47c666
cmp esi, eax
jb 0x47c790
xor eax, eax
jmp 0x47c79e
mov eax, dword [0x5605ec]
movzx ecx, word [eax + esi*2]
call fcn.004800c0
push eax
mov edx, edi
mov ecx, ebx
call fcn.0047c860
movsd xmm1, qword [esp + 0x1c]
add esp, 4
comisd xmm1, xmm0
ja 0x47c7c0
movaps xmm1, xmm0
movsd qword [esp + 0x18], xmm1
inc esi
cmp esi, dword [esp + 0x14]
jge 0x47c6c5
mov eax, dword [0x5605e8]
jmp 0x47c788
mov eax, dword [0x5605e8]
xor esi, esi
mov ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jle case.default.0x47c666
cmp esi, eax
jb 0x47c7eb
xor eax, eax
jmp 0x47c7f9
mov eax, dword [0x5605ec]
movzx ecx, word [eax + esi*2]
call fcn.004800c0
push eax
mov edx, edi
mov ecx, ebx
call fcn.0047c860
addsd xmm0, qword [esp + 0x1c]
inc esi
add esp, 4
movaps xmm1, xmm0
movsd qword [esp + 0x18], xmm1
cmp esi, dword [esp + 0x14]
jge 0x47c6c5
mov eax, dword [0x5605e8]
jmp 0x47c7e3
movsd xmm1, qword [esp + 0x18]
movaps xmm0, xmm1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xorps xmm0, xmm0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47cb40
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, edx
xorps xmm0, xmm0
push edi
movsd qword [esp + 8], xmm0
cmp byte [esi + 0xbc], 0
je 0x47cc2b
cmp dword [esi + 0x10], 0
jle 0x47cc2b
call fcn.0045fd30
mov edx, dword [esi + 0x10]
mov ecx, edx
cmp eax, edx
movsd xmm2, qword [0x5454e8]
cmovle ecx, eax
movd xmm0, edx
cvtdq2pd xmm0, xmm0
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
divsd xmm1, xmm0
ucomisd xmm1, qword [0x5454e0]
lahf
test ah, 0x44
jp 0x47cbab
movaps xmm1, xmm2
jmp 0x47cbb1
movsd xmm1, qword [esp + 8]
mov eax, dword [0x55f180]
mov edx, dword [eax + 4]
mov edi, dword [eax + 8]
xor eax, eax
test edx, edx
jle 0x47cbeb
mov ecx, dword [edi + eax*4]
cmp byte [ecx + 0xbc], 0
je 0x47cbd8
cmp dword [ecx + 0x10], 0
jle 0x47cbd8
cmp ecx, esi
je 0x47cbdf
inc eax
cmp eax, edx
jl 0x47cbc2
jmp 0x47cbeb
mulsd xmm1, xmm2
addsd xmm1, qword [0x5454d0]
comisd xmm1, xmmword [0x545478]
jbe 0x47cc28
imul eax, dword [0x563db0], 0x8088405
mov ecx, 0x64
mulsd xmm1, xmm2
inc eax
mov dword [0x563db0], eax
mul ecx
mov dword [esp + 8], eax
movd xmm0, edx
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x545590]
addsd xmm1, xmm0
movaps xmm0, xmm1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x481e40
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
movaps xmm0, xmmword [0x545850]
sub esp, 0xc
mov ecx, dword [0x563db0]
xorps xmm1, xmm1
movups xmmword [0x560658], xmm0
mov dword [0x5606c4], 0
movaps xmm0, xmmword [0x545930]
push ebx
movups xmmword [0x560668], xmm0
mov ebx, 0x28
mov dword [0x5606c8], 0
movaps xmm0, xmmword [0x545930]
push esi
movups xmmword [0x560678], xmm0
push edi
xorps xmm0, xmm0
movsd qword [0x560698], xmm1
movups xmmword [0x560688], xmm0
mov esi, 0x5606d4
mov edi, 0xff
movups xmmword [0x5606a0], xmm0
movups xmmword [0x5606b0], xmm0
nop
imul ecx, ecx, 0x8088405
lea esi, [esi + 0x30]
mov dword [esi - 0x2c], 0
movups xmmword [esi - 0x28], xmm1
movups xmmword [esi - 0x18], xmm1
inc ecx
mov eax, ecx
imul ecx, ecx, 0x8088405
mul ebx
inc ecx
mov dword [esi - 0x38], edx
mov eax, ecx
mov edx, 0x140
imul ecx, ecx, 0x8088405
mul edx
inc ecx
mov dword [esi - 0x34], edx
mov eax, ecx
mov edx, 0xa0
mul edx
mov dword [esi - 0x30], edx
sub edi, 1
jne 0x481ec0
mov dword [0x563db0], ecx
mov dword [0x56369c], edi
mov dword [0x5636a0], edi
mov dword [0x5636b4], edi
mov dword [0x5636b8], edi
call fcn.00481990
xor ecx, ecx
call fcn.00481d80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489510
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
imul eax, dword [0x563db0], 0x8088405
mov edx, 2
inc eax
mov dword [0x563db0], eax
mul edx
mov dword [ebp - 8], eax
mov al, byte [ecx + 0x15]
movzx eax, al
test edx, edx
je 0x48954e
cmp eax, 3
ja case.0x489553.3
jmp dword [eax*4 + 0x489574]
mov byte [ecx + 0x15], 1
mov esp, ebp
pop ebp
ret
cmp eax, 3
ja case.0x489553.3
jmp dword [eax*4 + 0x489584]
mov byte [ecx + 0x15], 3
mov esp, ebp
pop ebp
ret
mov byte [ecx + 0x15], 0
mov esp, ebp
pop ebp
ret
mov byte [ecx + 0x15], 2
mov esp, ebp
pop ebp
ret
Function at 0x4986d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x498701
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4986f0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4a1af0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, eax
mov eax, dword [0x564b98]
mov ecx, esi
inc eax
sub ecx, dword [0x564b94]
mov dword [0x564b98], eax
cmp ecx, 0x3e8
ja 0x4a1b4b
cmp eax, 3
jle 0x4a1b5b
push 4
push 0x544d50
push str.Outputting_multiple_files_in_a_short_time._Do_you_want_to_continue___Select_No_to_exit_.
push dword [0x563870]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x4a1b4b
cmp byte [0x556bc1], 0
jne 0x4a1b60
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x564b94], esi
mov dword [0x564b98], 0
pop esi
mov esp, ebp
pop ebp
ret
push 0x54fe2c
lea eax, [ebp - 1]
push eax
call fcn.004fe0ba
int3
Function at 0x4a1de0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x552064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x108
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.004fdf60
push 0x108
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.004fdf60
push dword [0x563dac]
lea eax, [ebp - 0x214]
push 0x108
push eax
call fcn.00506096
push str._RPG_RT.ini
lea eax, [ebp - 0x214]
push 0x108
push eax
call fcn.00506096
add esp, 0x30
lea eax, [ebp - 0x214]
push eax
push 0x108
lea eax, [ebp - 0x10c]
push eax
push str.Untitled
push str.GameTitle
push 0x545308
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x214]
push eax
push 0x140
push str.Winw
push 0x545308
call ebx
cmp eax, 0x40
jl 0x4a1ea3
mov ecx, 0x780
cmp eax, ecx
cmovle ecx, eax
jmp 0x4a1ea8
mov ecx, 0x40
lea eax, [ebp - 0x214]
mov dword [0x55312c], ecx
push eax
push 0xf0
push str.Winh
push 0x545308
call ebx
cmp eax, 0x20
jl 0x4a1ed7
mov ecx, 0x5a0
cmp eax, ecx
cmovle ecx, eax
jmp 0x4a1edc
mov ecx, 0x20
lea esi, [ebp - 0x10c]
mov dword [0x5530c4], ecx
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4a1ef0
sub esi, ecx
jne 0x4a1eff
xor edi, edi
jmp 0x4a1f2b
lea ecx, [esi + 0xc]
and ecx, 0xfffffffc
call fcn.004a2590
push esi
lea edi, [eax + 8]
mov dword [eax], 1
mov dword [eax + 4], esi
lea eax, [ebp - 0x10c]
push eax
push edi
call fcn.004fe1f0
add esp, 0xc
mov byte [edi + esi], 0
lea eax, [ebp - 0x214]
mov dword [0x563db4], edi
push eax
push 0
push str.Encoding
push 0x545308
call ebx
push 0x108
mov dword [0x563dc0], eax
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.004fdf60
push str.Software_
lea eax, [ebp - 0x10c]
push 0x108
push eax
call fcn.00506096
add esp, 0x18
lea eax, [ebp - 0x214]
push eax
push 0xff
lea eax, [ebp - 0x103]
push eax
push str.KADOKAWA_rpg2003
push str.RuntimePackageKey
push 0x545308
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [ebp - 0x10c]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4a1fa8
sub edi, ecx
jne 0x4a1fc6
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e66f2
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
and ecx, 0xfffffffc
call fcn.004a2590
push edi
lea esi, [eax + 8]
mov dword [eax], 1
mov dword [eax + 4], edi
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.004fe1f0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov byte [esi + edi], 0
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e66f2
mov esp, ebp
pop ebp
ret

Function at 0x4a2380
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
imul edi, dword [0x563db0], 0x8088405
mov eax, ecx
cdq
mov ecx, eax
mov eax, edx
inc edi
mul edi
mov dword [0x563db0], edi
mov esi, eax
mov eax, ecx
mul edi
pop edi
add esi, edx
mov dword [ebp - 8], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a46f0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
push ebx
push esi
imul esi, dword [0x563db0], 0x8088405
mov dword [ebp - 0xc], edx
cdq
mov ecx, eax
mov ebx, dword [0x5530c4]
mov eax, edx
mov dword [ebp - 0x1c], ebx
inc esi
mul esi
mov dword [0x563db0], esi
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [ebp - 4]
mul esi
mov esi, dword [0x560204]
mov dword [ebp - 0x28], eax
add ecx, edx
mov eax, dword [ebp + 8]
cdq
sub eax, edx
push edi
mov edi, eax
mov eax, dword [esi + 0x14]
sar edi, 1
add ecx, edi
cdq
xor eax, edx
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x1c]
sub eax, edx
dec ecx
mov dword [ebp - 0x14], edi
imul eax, ecx
add eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x20], eax
test ebx, ebx
jle 0x4a480c
mov ecx, dword [ebp - 4]
dec ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ecx
mov eax, ecx
cdq
idiv dword [ebp + 8]
mov eax, ecx
sub eax, edx
sub eax, edi
js 0x4a478b
cmp eax, ebx
mov esi, ebx
cmovle esi, eax
jmp 0x4a478d
xor esi, esi
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
cdq
mov ebx, eax
mov eax, dword [ebp - 0xc]
xor ebx, edx
sub ebx, edx
mov ecx, dword [eax + 0x1c]
sub ecx, esi
xor esi, esi
dec ecx
imul ebx, ecx
add ebx, dword [eax + 8]
mov eax, dword [0x55312c]
test eax, eax
jle 0x4a47f2
mov edi, dword [ebp - 4]
lea ecx, [eax - 1]
mov dword [ebp - 0x10], ecx
nop dword [eax]
mov eax, edi
cdq
idiv dword [ebp + 8]
mov eax, edi
sub eax, edx
sub eax, dword [ebp - 0x14]
js 0x4a47d7
cmp eax, dword [ebp - 0x10]
cmovle ecx, eax
jmp 0x4a47d9
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
inc edi
mov ecx, dword [ebp - 8]
mov dword [ecx + esi*4], eax
inc esi
mov ecx, dword [ebp - 0x10]
cmp esi, dword [0x55312c]
jl 0x4a47c0
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
inc ecx
add dword [ebp - 8], eax
sub dword [ebp - 0x1c], 1
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x18], ecx
jne 0x4a4774
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aec20
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
call fcn.0045f680
mov edx, dword [0x55f1a8]
mov dword [ebp - 0x10], eax
mov ecx, dword [edx + 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
test ecx, ecx
jle 0x4aee5c
mov dword [ebp - 4], 1
mov edi, 1
Function at 0x4b0120
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0xbd], 0
jne 0x4b0244
imul eax, dword [0x563db0], 0x8088405
mov ecx, 0x64
inc eax
mov dword [0x563db0], eax
mul ecx
mov dword [ebp - 8], eax
cmp edx, dword [0x563e38]
jl 0x4b0201
cmp byte [0x563eba], 0
jne 0x4b0201
mov ecx, dword [0x563e20]
call fcn.004a8de0
mov ebx, dword [0x563e20]
mov edi, dword [0x56410c]
mov eax, dword [ebx + 0x75]
cmp eax, edi
je 0x4b01c1
test eax, eax
je 0x4b01ae
lea ecx, [eax - 8]
mov eax, dword [ecx]
cmp eax, 0xffffffff
je 0x4b01a7
dec eax
mov dword [ecx], eax
test eax, eax
jg 0x4b01a7
push ecx
call fcn.00501c9e
add esp, 4
mov dword [ebx + 0x75], 0
test edi, edi
je 0x4b01c1
mov dword [ebx + 0x75], edi
mov eax, dword [edi - 8]
cmp eax, 0xffffffff
je 0x4b01c1
inc eax
mov dword [edi - 8], eax
push ebx
call fcn.004a8e60
mov edx, 0x1e
add esp, 4
lea ecx, [edx - 0x14]
call fcn.004aa8f0
push dword [0x563e20]
call fcn.004c57d0
add esp, 4
add dword [0x563e38], 0xa
mov eax, dword [esi + 0xc]
mov byte [eax + 1], 7
mov byte [esi + 0xc0], 0xf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5605e8]
xor esi, esi
mov edi, eax
test edi, edi
jle 0x4b0238
nop
cmp esi, eax
jb 0x4b0218
xor eax, eax
jmp 0x4b0226
mov eax, dword [0x5605ec]
movzx ecx, word [eax + esi*2]
call fcn.004800c0
mov eax, dword [eax + 0xc]
inc esi
mov byte [eax], 4
cmp esi, edi
jge 0x4b0238
mov eax, dword [0x5605e8]
jmp 0x4b0210
call fcn.004ae3a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x564654]
cmp dword [ecx + 4], 0
cmove ecx, dword [0x564098]
call fcn.00492480
pop edi
mov byte [esi + 0xbc], 0
mov dword [esi + 0xd4], 0x24
pop esi
pop ebx
mov esp, ebp
pop ebp
ret