joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10180690
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x101806ea
cmp dword [ebp + 0xc], 0
je 0x101806ea
cmp dword [ebp + 0x10], 0
je 0x101806ea
push 0xc
call sym.nss3.dll_PORT_ZAlloc_Util
add esp, 4
xor esi, esi
test eax, eax
je 0x10180712
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], 1
push 0x10
call sym.nss3.dll_PORT_ZAlloc_Util
add esp, 4
test eax, eax
je 0x10180719
mov esi, eax
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], ebx
mov dword [eax + 0xc], edi
jmp 0x10180712
cmp dword [0x101d4d40], 0
je 0x10180751
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10180740
xor esi, esi
mov dword [eax + 0x28], 0xffffe89d
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
lock dec dword [edi + 8]
jne 0x10180712
push dword [edi]
call sym.nss3.dll_SECKEY_DestroyPrivateKey
add esp, 4
push dword [edi + 4]
call sym.nss3.dll_SECKEY_DestroyPublicKey
add esp, 4
push edi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x10180712
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x10180703
call sym.nss3.dll_PR_Init
jmp 0x101806f3

Function at 0x101832a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx], 4
jne 0x10183349
mov ecx, dword [eax + 0x14]
cmp ecx, dword [0x101d6710]
jne 0x10183349
mov edi, dword [eax + 4]
test edi, edi
mov dword [edi], eax
je 0x10183371
mov ebx, dword [edi + 0x160]
mov eax, dword [ebp + 0x18]
test ebx, ebx
je 0x10183303
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1018338c
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x18]
mov dword [ebx + 8], esi
mov dword [edi + 0x154], eax
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
test byte [edi + 0x1d], 1
jne 0x1018331b
mov dword [edi + 0x150], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
push dword [ebp + 0x14]
push ebx
push esi
push edi
call ecx
add esp, 0x10
mov esi, eax
mov eax, dword [edi + 0x160]
test eax, eax
je 0x10183374
push eax
call sym.nss3.dll_PR_Unlock
add esp, 4
jmp 0x10183374
cmp dword [0x101d4d40], 0
je 0x101833a2
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1018337b
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe891
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x10183362
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x101832f3
call sym.nss3.dll_PR_Init
jmp 0x10183352
Function at 0x10189080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [0x101d2014]
xor eax, ebp
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
je 0x101890c3
mov eax, dword [ebp + 0x1c]
lea esi, [ebp - 0x28]
mov edi, dword [ebp + 0x48]
test eax, eax
cmovne esi, eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 0x18]
je 0x101890cf
cmp esi, eax
je 0x101890f6
push dword [ebp + 0x20]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x101890f6
push 0
push 0xffffe005
jmp 0x10189158
mov ebx, dword [ebp + 0x28]
push dword [ebp + 0x20]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
test ebx, ebx
je 0x101890f6
mov ecx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x24]
neg ebx
add ecx, esi
mov dl, byte [eax]
inc eax
xor byte [ecx + ebx], dl
inc ebx
jne 0x101890ed
mov eax, edi
mov edi, dword [ebp + 0x40]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x44]
sub eax, edi
test ebx, ebx
lea ebx, [ebp - 0x68]
lea ecx, [edx + eax]
cmove eax, dword [ebp + 0x48]
cmovne ebx, ecx
push eax
push edx
push edi
push ebx
mov eax, dword [ebp + 0x3c]
push eax
mov edi, dword [ebp + 0x38]
push edi
mov eax, dword [ebp + 0x34]
push eax
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x20]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sym.nss3.dll_PK11_AEADOp
add esp, 0x38
mov esi, eax
or eax, dword [ebp + 0xc]
jne 0x1018917b
mov eax, dword [edi]
mov edx, dword [ebp + 0x40]
lea ecx, [eax + edx]
cmp ecx, dword [ebp + 0x3c]
jbe 0x10189165
push 0
push 0xffffe003
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x1018917b
mov ecx, edx
mov edx, dword [ebp + 0x34]
add edx, eax
push ecx
push ebx
push edx
mov ebx, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi], ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10192d41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10192d50
pop dword [ebp - 0x10]
mov eax, 0x10192d50
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x7047678e
sub dword [ebp - 0x20], 0x21f52243
mov dword [ebp - 0x1c], 0x8e0afe8b
sub dword [ebp - 0x1c], 0x5bd7b246
mov dword [ebp - 0x18], 0xdb4d6cd8
sub dword [ebp - 0x18], 0x8f0128aa
mov dword [ebp - 0x14], 0xa9a65593
sub dword [ebp - 0x14], 0xa9a65593
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x5289dfe7
add dword [ebp - 0x20], 0x21e8896f
mov dword [ebp - 0x1c], 0x1686bc4f
sub dword [ebp - 0x1c], 0xd51a5ada
mov dword [ebp - 0x18], 0x71eaf50d
sub dword [ebp - 0x18], 0xe7b88a1
mov dword [ebp - 0x14], 0x647263c3
add dword [ebp - 0x14], 0x9b8d9c3d
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xa190d0d4
add eax, 0x6e8c3164
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3945e
push 0
call eax
mov ecx, 0xf9f6708a
sub ecx, 0xf9f61d5b
mov ebx, eax
mov esi, 0x9e5b1812
sub esi, 0x8e3c8a12
add esi, dword [ebp - 0x10]
mov edi, 0x34063b1b
mov dword [ebp - 4], 0x9ee49411
mov edx, dword [esi]
xor dword [ebp - 4], edx
xor edx, edi
xor dword [ebp - 0xc], edi
mov dword [ebx], edx
sub dword [ebp - 0xc], edx
add ebx, 4
add esi, 4
loop 0x10192e62
add eax, 0xbc0b3622
sub eax, 0xbc09f693
mov ebx, eax
add eax, 5
mov ecx, 0xc79b6dfa
sub ecx, 0xb79b6dfa
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1001b511
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1001b520
pop dword [ebp - 0x30]
mov eax, 0x1001b520
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x194ea929
add dword [ebp - 0x40], 0x35039c22
mov dword [ebp - 0x3c], 0x62c1a721
sub dword [ebp - 0x3c], 0x308e5adc
mov dword [ebp - 0x38], 0xfe38be48
add dword [ebp - 0x38], 0x4e1385e6
mov dword [ebp - 0x34], 0x956dc6d5
sub dword [ebp - 0x34], 0x956dc6d5
lea eax, [ebp - 0x40]
push eax
mov eax, 0x303f0fd7
sub eax, 0x203d1f8f
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x401cc0e5
add dword [ebp - 0x40], 0x3455a871
mov dword [ebp - 0x3c], 0x5245eb78
sub dword [ebp - 0x3c], 0x10d98a03
mov dword [ebp - 0x38], 0x6c069d44
add dword [ebp - 0x38], 0xf768cf28
mov dword [ebp - 0x34], 0x3c54af1d
add dword [ebp - 0x34], 0xc3ab50e3
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x489686a4
add eax, 0xc76b69a8
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3d4a5
push 0
call eax
mov ecx, 0xd4480e1d
sub ecx, 0xd447c79d
xor edi, edi
add edi, eax
mov ebx, 0x1002ac00
add ebx, dword [ebp - 0x30]
mov edx, 0x58f1bafe
add edx, 0x5af0bcb
mov dword [ebp - 0x1c], 0x8ac2a0d6
mov esi, dword [ebx]
xor dword [ebp - 0xc], edi
add esi, edx
xor dword [ebp - 0x24], 0x74813226
mov dword [edi], esi
add dword [ebp - 0x1c], edi
add edi, 0x44e0c662
add edi, 0xbb1f39a2
add ebx, 4
loop 0x1001b639
add eax, 0xe9772eab
add eax, 0x1689de28
mov ebx, eax
add eax, 5
mov ecx, 0xaab1970b
add ecx, 0x654e68f5
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x1001d7ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10026200]
jne 0x1001d7b6
repz ret
jmp fcn.1001dc29
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x403203
pop dword [ebp - 0x40]
mov eax, 0xd821461f
sub eax, 0xd7e1141c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x1845314a
add dword [ebp - 0x50], 0x360d1401
mov dword [ebp - 0x4c], 0x6a7c17eb
sub dword [ebp - 0x4c], 0x3848cba6
mov dword [ebp - 0x48], 0x4c6b0d32
add dword [ebp - 0x48], 0xffe136fc
mov dword [ebp - 0x44], 0x3c451edc
sub dword [ebp - 0x44], 0x3c451edc
lea eax, [ebp - 0x50]
push eax
mov eax, 0x7a6687a6
sub eax, 0x7a261742
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x955f10e4
add dword [ebp - 0x50], 0xdf135872
mov dword [ebp - 0x4c], 0xab399005
sub dword [ebp - 0x4c], 0x69cd2e90
mov dword [ebp - 0x48], 0xe059a4e
sub dword [ebp - 0x48], 0xaa962de2
mov dword [ebp - 0x44], 0x2937402
sub dword [ebp - 0x44], 0x2937402
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3c8b1
push 0
call eax
mov ecx, 0x5fcc
xor edi, edi
add edi, eax
mov esi, 0x410000
add esi, dword [ebp - 0x40]
mov ebx, 0xb6496c29
add dword [ebp - 0x30], 0x98c4061c
mov edx, dword [esi]
add dword [ebp - 0x1c], ecx
add edx, ebx
xor dword [ebp - 0xc], ebx
mov dword [edi], edx
sub dword [ebp - 0x38], ecx
add edi, 4
add esi, 0x4216fa9f
add esi, 0xbde90565
loop 0x403310
add eax, 0x5fbc56c
sub eax, 0x5fa5369
mov ebx, eax
add eax, 0x19073242
sub eax, 0x1907323d
mov ecx, 0xca3ca20e
add ecx, 0x36035df2
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0xdbf058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00dbf1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xdbf07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdbf06a
add dl, dl
jne 0xdbf089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdbf0dc
xor eax, eax
add dl, dl
jne 0xdbf096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdbf17d
add dl, dl
jne 0xdbf0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdbf0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdbf0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdbf0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdbf0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdbf075
mov eax, 1
add dl, dl
jne 0xdbf0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdbf0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdbf0e1
sub eax, ebx
mov ebx, 1
jne 0xdbf128
mov ecx, 1
add dl, dl
jne 0xdbf10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdbf119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdbf105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdbf075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdbf13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdbf14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdbf136
cmp eax, 0x7d00
jae 0xdbf16d
cmp eax, 0x500
jb 0xdbf168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdbf075
cmp eax, 0x7f
ja 0xdbf170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdbf075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdbf19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdbf075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401770
Capabilities:
Create directory
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [0x41f028]
test ecx, ecx
jne 0x40178c
mov dword [0x41f02c], 1
leave
ret
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.ERR:__Cannot_enable_both_allgprm_and_jumppad_n
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
mov dword [esp], 1
call sub.cygwin1.dll_exit

Function at 0x4017c0
Capabilities:
Create directory
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x41f02c]
test eax, eax
jne 0x4017db
mov dword [0x41f028], 1
leave
ret
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.ERR:__Cannot_enable_both_allgprm_and_jumppad_n
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
mov dword [esp], 1
call sub.cygwin1.dll_exit
nop

Function at 0x401810
Capabilities:
Create directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
push ebx
sub esp, 0x10
test eax, eax
je 0x4018b2
mov dword [esp + 4], 0x1ff
mov dword [esp], eax
call sub.cygwin1.dll_mkdir
test eax, eax
je 0x401846
call sub.cygwin1.dll___errno
cmp dword [eax], 0x11
nop
jne 0x401911
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_VIDEO_TS
mov dword [esp], 0x41f420
call sub.cygwin1.dll_sprintf
mov dword [esp + 4], 0x1ff
mov dword [esp], 0x41f420
call sub.cygwin1.dll_mkdir
test eax, eax
je 0x401882
call sub.cygwin1.dll___errno
cmp dword [eax], 0x11
nop
jne 0x4018ca
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_AUDIO_TS
mov dword [esp], 0x41f420
call sub.cygwin1.dll_sprintf
mov dword [esp + 4], 0x1ff
mov dword [esp], 0x41f420
call sub.cygwin1.dll_mkdir
test eax, eax
jne 0x4018c0
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
call sub.cygwin1.dll___errno
cmp dword [eax], 0x11
je 0x4018b2
lea esi, [esi]
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x41f420
mov dword [esp + 4], str.ERR:_cannot_create_dir__s:__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
jmp 0x4018f2
Function at 0x401d70
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x401db7
mov eax, dword [ebx]
lea eax, [eax*4 + 4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call sub.cygwin1.dll_realloc
mov edx, dword [ebx]
mov dword [eax + edx*4], esi
add edx, 1
mov dword [ebx + 0x1c], eax
mov dword [ebx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.ERR:__source_has_no_filename_n
mov dword [esp + 0xc], eax
call sub.cygwin1.dll_fwrite
mov dword [esp], 1
call sub.cygwin1.dll_exit
nop
lea esi, [esi]
Function at 0x402e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 8]
lea eax, [eax*4 + 4]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.cygwin1.dll_realloc
mov edx, dword [ebx + 8]
mov dword [ebx + 4], eax
mov dword [eax + edx*4], esi
mov eax, dword [esi + 0x30]
add edx, 1
mov dword [ebx + 8], edx
test eax, eax
jne 0x402ede
mov dword [esi + 0x30], ebx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0xc], str.p__pgcgroup0
mov dword [esp + 8], str.pgcgroup_add_pgc
mov dword [esp + 4], 0x569
mov dword [esp], str.dvdauthor.c
call sub.cygwin1.dll___assert_func
lea esi, [esi]
lea edi, [edi]
lea eax, [edx + 1]
mov dword [edi + 4], eax
mov dword [esp + 4], esi
mov dword [esp], 0x417d23
call sub.cygwin1.dll_strcasecmp
mov ecx, 1
test eax, eax
je 0x403015
mov dword [esp + 4], esi
mov dword [esp], str.letterbox
call sub.cygwin1.dll_strcasecmp
mov ecx, 2
test eax, eax
je 0x403015
mov dword [esp + 4], esi
mov dword [esp], str.panscan
call sub.cygwin1.dll_strcasecmp
test eax, eax
je 0x403010
call sub.cygwin1.dll___getreent
mov dword [esp + 8], esi
mov dword [esp + 4], str.ERR:__Cannot_parse_subpicture_stream_mode__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
nop
mov ecx, 3

Function at 0x402f10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
cmp ebx, 0xf
ja 0x402f4a
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x402f40
mov edx, dword [ebp + 0x10]
mov dword [eax + ebx*4 + 4], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.00401df0
mov dword [esi + 0x2c], eax
jmp 0x402f2e
mov dword [esp + 0xc], str.index_0__index_16
mov dword [esp + 8], str.pgc_set_color
mov dword [esp + 4], 0x4fe
mov dword [esp], str.dvdauthor.c
call sub.cygwin1.dll___assert_func
nop

Function at 0x403080
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov dword [ebp + 8], ebx
pop ebx
pop ebp
jmp fcn.00402f70

Function at 0x4030a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0x14]
mov dword [ebp + 8], ebx
pop ebx
pop ebp
jmp fcn.00402f70
Function at 0x4030c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 0x10]
mov dword [esp], str.normal
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov dword [esp + 4], ebx
call sub.cygwin1.dll_strcasecmp
xor ecx, ecx
test eax, eax
je 0x40315b
mov dword [esp + 4], ebx
mov dword [esp], 0x417d23
call sub.cygwin1.dll_strcasecmp
mov ecx, 1
test eax, eax
je 0x40315b
mov dword [esp + 4], ebx
mov dword [esp], str.letterbox
call sub.cygwin1.dll_strcasecmp
mov ecx, 2
test eax, eax
je 0x40315b
mov dword [esp + 4], ebx
mov dword [esp], str.panscan
call sub.cygwin1.dll_strcasecmp
test eax, eax
je 0x403156
call sub.cygwin1.dll___getreent
mov dword [esp + 8], ebx
mov dword [esp + 4], str.ERR:__Cannot_parse_subpicture_stream_mode__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov ecx, 3
mov edx, dword [ebp + 8]
lea eax, [edx + esi*4]
movzx eax, byte [ecx + eax + 0x34]
test al, al
je 0x403177
movzx edx, al
lea eax, [edi + 0x80]
cmp edx, eax
jne 0x40318e
mov eax, dword [ebp + 8]
lea edx, [eax + esi*4]
lea eax, [edi - 0x80]
mov byte [ecx + edx + 0x34], al
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], str.ERR:__Subpicture_stream_already_defined_for_subpicture__d_mode__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]

Function at 0x4032c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 2
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx*4 + 0x417020]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.cygwin1.dll_strcasecmp
test eax, eax
je 0x403318
add ebx, 1
cmp ebx, 8
jne 0x4032d0
nop
call sub.cygwin1.dll___getreent
mov dword [esp + 8], esi
mov dword [esp + 4], str.ERR:__Unknown_entry__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov ecx, ebx
mov edx, 1
shl edx, cl
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x14]
test edx, eax
jne 0x40333a
or eax, edx
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], eax
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
call sub.cygwin1.dll___getreent
mov dword [esp + 8], esi
mov dword [esp + 4], str.ERR:__Defined_entry__s_multiple_times_for_the_same_PGC_n
jmp 0x403301

Function at 0x403840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov dword [ebp + 8], ebx
pop ebx
pop ebp
jmp fcn.00403700

Function at 0x403860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0x14]
mov dword [ebp + 8], ebx
pop ebx
pop ebp
jmp fcn.00403700