joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43da60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9745
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x54b07c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0x10
jb 0x43da97
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x43dab5
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x43daa3
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0043e230
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x43dae6
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x43dbf2
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.0049dbb6
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00401d10
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx]
mov ecx, dword [ebx + 8]
mov dword [ebp + 0xc], eax
add ecx, 1
fld dword [ebp + 0xc]
mov dword [ebp + 0xc], ecx
fild dword [ebp + 0xc]
jns 0x43db4b
fadd dword [0x541ce4]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov eax, dword [ebx + 0x1c]
fild dword [ebx + 0x1c]
test eax, eax
jns 0x43db61
fadd dword [0x541ce4]
fstp dword [ebp + 0xc]
fdiv dword [ebp + 0xc]
fcompp
fnstsw ax
test ah, 0x41
jne 0x43db94
push ecx
mov ecx, ebx
call fcn.0043cd00
push eax
mov ecx, ebx
call fcn.0043cb20
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0043e230
mov edx, dword [eax]
jmp 0x43db97
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x43dbbf
mov dword [ecx + eax*8], edi
jmp 0x43dbd1
cmp esi, edx
jne 0x43dbc8
mov dword [ecx + eax*8], edi
jmp 0x43dbd5
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x43dbd5
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0049bd48
int3
Function at 0x4459d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa1fd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x54b07c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0xf5487c], 0
mov ebx, dword [0xf54888]
je 0x445ae4
push dword [0xf54738]
mov dword [0xf54888], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test edi, edi
jne 0x445ae4
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
push 0x20
mov dword [ebp - 0x14], 0xf
call fcn.00401df0
mov ecx, dword [str.Emulation_started]
mov edx, eax
mov dword [ebp - 0x14], 0x1f
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], 0x11
mov dword [edx], ecx
mov ecx, dword [0x536474]
mov dword [edx + 4], ecx
mov ecx, dword [0x536478]
mov dword [edx + 8], ecx
mov eax, dword [0x53647c]
mov dword [edx + 0xc], eax
mov al, byte [0x536480]
mov byte [edx + 0x10], al
lea eax, [ebp - 0x28]
mov byte [edx + 0x11], 0
cmp dword [ebp - 0x14], 0x10
jb 0x445aa0
mov eax, dword [ebp - 0x28]
push eax
push 0
push 0x401
push dword [0xf541f0]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x445ae4
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x445ada
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x445b3e
push ecx
push edx
call fcn.0049dbeb
add esp, 8
mov ecx, dword [0xf5487c]
mov edx, 1
call fcn.00422f70
mov esi, dword [0xf54888]
cmp esi, ebx
je 0x445b22
test edi, edi
jne 0x445b22
push dword [0xf54870]
neg esi
sbb esi, esi
and esi, 8
call dword [sym.imp.USER32.dll_GetMenu]
push esi
push 0x426
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret
call fcn.004cb586
int3
Function at 0x445b50
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f6e2d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x54b07c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0xf5487c], 0
mov eax, dword [0xf54888]
mov dword [ebp - 0x2c], eax
je 0x445c67
call fcn.0041e110
mov dword [0xf54888], 1
test esi, esi
jne 0x445c81
push dword [0xf54738]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
push 0x20
mov dword [ebp - 0x14], 0xf
call fcn.00401df0
mov ecx, dword [str.Emulation_paused]
mov edx, eax
mov dword [ebp - 0x14], 0x1f
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], 0x10
mov dword [edx], ecx
mov ecx, dword [0x5364b8]
mov dword [edx + 4], ecx
mov ecx, dword [0x5364bc]
mov dword [edx + 8], ecx
mov eax, dword [0x5364c0]
mov dword [edx + 0xc], eax
lea eax, [ebp - 0x28]
mov byte [edx + 0x10], 0
cmp dword [ebp - 0x14], 0x10
jb 0x445c1d
mov eax, dword [ebp - 0x28]
push eax
push 0
push 0x401
push dword [0xf541f0]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x445c81
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x445c5b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x445cdc
push ecx
push edx
call fcn.0049dbeb
add esp, 8
jmp 0x445c81
push 0
push 0x426
push dword [0xf54870]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ecx, dword [0xf5487c]
xor edx, edx
call fcn.00422f70
mov esi, dword [0xf54888]
cmp esi, dword [ebp - 0x2c]
je 0x445cc2
cmp dword [0x2693584], 0
jne 0x445cc2
push dword [0xf54870]
neg esi
sbb esi, esi
and esi, 8
call dword [sym.imp.USER32.dll_GetMenu]
push esi
push 0x426
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret
call fcn.004cb586
int3

Function at 0x446600
Capabilities:
Create thread

Disassembly:
cmp dword [0xf5487c], 0
je 0x44663f
push 0xf54734
push 0
push 0
push 0x446190
push 0
push 0
mov dword [0x195eabc], 0
mov dword [0xf5474c], 1
mov dword [0x2693584], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x448bb0
Capabilities:
Create thread

Disassembly:
movzx ecx, cx
sub ecx, 0x1772
js 0x448c1e
mov eax, dword [0x26933f8]
mov edx, dword [0x26933f4]
sub eax, edx
sar eax, 3
imul eax, eax, 0xaaaaaaab
cmp ecx, eax
jge 0x448c1e
lea eax, [ecx + ecx*2]
cmp dword [edx + eax*8 + 0x14], 0x10
lea eax, [edx + eax*8]
jb 0x448be4
mov eax, dword [eax]
mov edx, 0xf54200
sub edx, eax
jmp 0x448bf0
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x448bf0
push 0xf54628
push 0
push 0xf54200
push 0x445cf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
ret
xor eax, eax
ret
Function at 0x44c590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f606d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x54b07c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
call fcn.0049dbb6
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
mov edx, dword [edx]
mov dword [eax], edx
mov dword [eax + 4], ecx
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x44ccf0
push 0
push 0
call fcn.004cf27b
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x44c608
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 6
mov dword [edi], 0
call fcn.0049c2e9
int3

Function at 0x44c7b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa6fd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x54b07c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
call fcn.0049dbb6
mov dword [ebp - 0x10], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x44cd50
push 0
push 0
call fcn.004cf27b
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x44c81b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call fcn.0049c2e9
int3
Function at 0x456090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x110
push esi
mov dword [esp + 4], 0x3020181
mov edx, 0x195f2c0
mov dword [esp + 8], 0x7060504
mov dword [esp + 0xc], 0xb0a0908
mov dword [esp + 0x10], 0xf0e0d0c
mov dword [esp + 0x14], 0x13121110
mov dword [esp + 0x18], 0x17161514
mov dword [esp + 0x1c], 0x1b1a1918
mov dword [esp + 0x20], 0x1f1e1d1c
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0x135f1a05
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x3c], 0xff01ffff
mov dword [esp + 0x40], 0xcd992566
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x68], 0x135f1a05
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0xffffffff
mov dword [esp + 0x78], 0xffffffff
mov dword [esp + 0x7c], 0xff01ffff
mov dword [esp + 0x80], 0xcd992566
mov dword [esp + 0x84], 0xffffffff
mov dword [esp + 0x88], 0x135f1a05
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0xffffffff
mov dword [esp + 0x98], 0xffffffff
mov dword [esp + 0x9c], 0xff01ffff
mov dword [esp + 0xa0], 0xcd992566
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 0xffffffff
mov dword [esp + 0xc8], 0x135f1a05
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 0xffffffff
mov dword [esp + 0xd8], 0xffffffff
mov dword [esp + 0xdc], 0xff01ffff
mov dword [esp + 0xe0], 0xcd992566
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf8], 0
mov dword [esp + 0xfc], 0
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0x3007100
mov dword [esp + 0x108], 0x3000300
mov dword [esp + 0x10c], 0x3000300
mov dword [esp + 0x110], 0x3000300
push edi
lea esp, [esp]
lea eax, [edx + 1]
mov ecx, 0x4000
jmp 0x456340
mov word [eax - 1], 0x300
lea eax, [eax + 2]
sub ecx, 1
jne 0x456340
mov edi, edx
lea esi, [esp + 8]
add edx, 0x8000
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
cmp edx, 0x197f2c0
jl 0x456330
pop edi
pop esi
add esp, 0x110
ret
Function at 0x456ec0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
push 2
push 0xfffffe00
push ebx
mov dword [esp + 0x1c], edx
mov esi, ecx
mov edi, 0x80
call fcn.004ceda0
push ebx
push 0x200
push 1
push esi
call fcn.004cefce
push 0
push 0
push ebx
call fcn.004ceda0
mov ebx, dword [esi + 0x28]
add esp, 0x28
mov esi, dword [esi + 0x2c]
bswap ebx
bswap esi
shrd esi, ebx, 9
shr ebx, 9
test ebx, ebx
jne 0x456f15
test esi, esi
je 0x456f60
mov ebp, dword [esp + 0x1c]
lea esp, [esp]
xor eax, eax
cmp eax, ebx
jb 0x456f2e
ja 0x456f2c
cmp edi, esi
jbe 0x456f2e
mov edi, esi
push dword [esp + 0x18]
push 0x200
push edi
push ebp
call fcn.004cefce
push dword [esp + 0x20]
push 0x200
push edi
push ebp
call fcn.004ce0c0
add esp, 0x20
sub esi, edi
sbb ebx, 0
test ebx, ebx
ja 0x456f20
jb 0x456f60
test esi, esi
jne 0x456f20
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x457180
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x54b07c]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
mov ebp, dword [0x21812c8]
mov ebx, ecx
push esi
push edi
mov edi, dword [0x21812cc]
mov esi, edx
push 2
push 0xfffffe00
push ebx
call fcn.004ceda0
add esp, 0xc
test eax, eax
je 0x4571cc
push 0x40010
push esi
push str.Seek_1__error.
jmp 0x457274
push ebx
push 0x200
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004cefce
add esp, 0x10
cmp eax, 0x200
je 0x4571f5
push 0x40010
push esi
push str.Read_error.
jmp 0x457274
lea eax, [esp + 0x10]
cmp dword [eax], 0x656e6f63
jne 0x457269
cmp dword [eax + 4], 0x78697463
jne 0x457269
mov eax, dword [esp + 0x4c]
bswap eax
cmp eax, 2
je 0x457222
push 0x40010
push esi
push str.Invalid_VHD_type:_must_be_a_fixed_disk.
jmp 0x457274
mov ecx, dword [esp + 0x38]
xor eax, eax
mov edx, dword [esp + 0x3c]
bswap ecx
bswap edx
shrd edx, ecx, 9
shr ecx, 9
add ebp, edi
adc eax, eax
cmp eax, ecx
jb 0x457245
ja 0x45727c
cmp ebp, edx
ja 0x45727c
push 0
shl edi, 9
push edi
push ebx
call fcn.004ceda0
add esp, 0xc
test eax, eax
je 0x457265
push 0x40010
push esi
push str.Seek_2__error.
jmp 0x457274
xor eax, eax
jmp 0x45727f
push 0x40010
push esi
push str.Invalid_VHD_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049dba8
add esp, 0x20c
ret
Function at 0x4577c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x54b07c]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
push 0x10000
mov edi, ecx
call fcn.004cf109
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
je 0x4579e2
mov ecx, edi
call fcn.00457120
mov ebx, eax
test ebx, ebx
je 0x4579ad
call fcn.00456f70
mov edi, eax
test edi, edi
je 0x45796f
push 0x538044
push ebx
call fcn.004ce8d6
mov esi, eax
add esp, 8
test esi, esi
je 0x457924
push 0x538018
push edi
call fcn.004ce8d6
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x4578d0
push ecx
push dword [esp + 0x18]
mov edx, eax
lea ecx, [esp + 0x20]
push esi
call fcn.00456ec0
add esp, 0xc
push esi
push 0x2200
push 1
push 0x217f2c0
call fcn.004cefce
push dword [esp + 0x20]
lea eax, [esp + 0x2c]
push 0x200
push 1
push eax
call fcn.004ce0c0
push dword [esp + 0x30]
call fcn.004cea42
add esp, 0x24
push esi
call fcn.004cea42
add esp, 4
push edi
call fcn.004cedda
mov esi, dword [esp + 0x18]
add esp, 4
push ebx
call fcn.004cedda
add esp, 4
push esi
call fcn.004cedda
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret
push 0x40010
push 0x53801c
push str.Could_not_open_SD_image_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.004cea42
add esp, 4
push edi
call fcn.004cedda
mov esi, dword [esp + 0x18]
add esp, 4
push ebx
call fcn.004cedda
add esp, 4
push esi
call fcn.004cedda
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret
push 0x40010
push 0x538094
push str.Could_not_open_SD_state_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.004cedda
mov esi, dword [esp + 0x18]
add esp, 4
push ebx
call fcn.004cedda
add esp, 4
push esi
call fcn.004cedda
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret
push 0x40010
push 0x538068
push str.Could_not_generate_SD_image_path.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.004cedda
add esp, 4
push esi
call fcn.004cedda
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret
push 0x40010
push str.Load_error
push str.Could_not_generate_SD_state_path.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.004cedda
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret
push 0x40010
push 0x5380c4
push str.Could_not_allocate_buffer.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret
Function at 0x457aa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x10dc8d0]
and eax, 0xfffc
cmp eax, 0x10
ja case.0x457aeb.68
movzx eax, byte [eax + 0x457c48]
jmp dword [eax*4 + 0x457c34]
cmp byte [0x21812d2], 0
je case.0x457aeb.68
add edx, 0xffffffbd
mov dword [0x21812c0], 0x40000000
cmp edx, 0x30
ja case.0x457aeb.68
movzx eax, byte [edx + 0x457c78]
jmp dword [eax*4 + 0x457c5c]
mov eax, dword [0x21812c4]
sub eax, 1
je 0x457b1f
sub eax, 2
je 0x457b0a
sub eax, 3
jne case.0x457aeb.68
mov dword [0x21812c8], 0
mov dword [0x21812c0], 0
ret
movsx eax, byte [0x21812d0]
mov dword [0x21812c8], eax
mov dword [0x21812c0], 0
ret
mov eax, dword [0x21812c4]
sub eax, 1
jne case.0x457aeb.68
movsx eax, byte [0x21812d0]
cmp dword [0x21812c8], 0
mov dword [0x21812c8], eax
mov byte [0x21812d0], 1
jne case.0x457b80.0
mov byte [0x21812d0], 0
mov dword [0x21812c0], 0
ret
mov eax, dword [0x21812c8]
cmp eax, 5
ja case.0x457aeb.68
jmp dword [eax*4 + 0x457cac]
mov byte [0x21812d1], 1
mov dword [0x21812c0], 0
ret
mov byte [0x21812d1], 0
mov dword [0x21812c0], 0
ret
mov eax, dword [0x21812c4]
mov dword [0x21812cc], eax
mov dword [0x21812c0], 0
ret
jmp fcn.004572a0
jmp fcn.00457410
cmp byte [0x21812d2], 0
je case.0x457aeb.68
mov dword [0x21812c4], edx
ret
cmp byte [0x21812d2], 0
je case.0x457aeb.68
mov dword [0x21812c8], edx
ret
cmp edx, 0x4f434b5f
je 0x457c20
cmp edx, 0x5f554e4c
je 0x457c0f
cmp edx, 0xffffffff
je 0x457c07
mov byte [0x21812d3], 0
ret
mov byte [0x21812d2], 0
ret
cmp byte [0x21812d3], 0
jne case.0x457aeb.68
mov byte [0x21812d3], 2
ret
cmp byte [0x21812d3], 2
jne case.0x457aeb.68
mov word [0x21812d2], 1
ret
Function at 0x48b430
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
push str.Creating_lua_window..._n
mov esi, ecx
call fcn.00402650
add esp, 4
push 0
push 0x482df0
push dword [0xf54870]
push 0xb6
push dword [0xf54874]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov edi, eax
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push str.Setting_path..._n
call fcn.00402650
add esp, 4
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x252a
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push str.Simulating_run_button_click..._n
call fcn.00402650
add esp, 4
push 0x252c
push edi
call esi
push eax
push 0x252c
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ecx
ret
Function at 0x48b4c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x54b07c]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [0x26935b0]
push ebx
push esi
push edi
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp byte [eax + 0xd], 0
jne 0x48b5b3
lea esp, [esp]
mov esi, dword [eax + 0x14]
test esi, esi
je 0x48b59c
cmp dword [esi + 0x20], 0
je 0x48b59c
cmp dword [esi + 4], 2
jne 0x48b59c
mov eax, dword [esi + 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc0]
mov ecx, dword [esi + 0x30]
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x3f800000
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0x3f800000
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x78]
fld dword [0x541cd4]
lea edx, [esp + 0x1c]
fst qword [esp + 0x10]
fld qword [esp + 0x10]
fdiv st(0), st(0)
mov ecx, dword [esi + 0x30]
mov dword [esp + 0x28], 0x3f800000
push edx
push ecx
fstp dword [esp + 0x24]
fldz
fdiv st(1)
fstp dword [esp + 0x28]
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
fdiv st(0), st(0)
fstp dword [esp + 0x2c]
mov eax, dword [ecx]
call dword [eax + 0xbc]
lea ecx, [esp + 0xc]
call fcn.0044c3d0
mov eax, dword [esp + 0xc]
cmp byte [eax + 0xd], 0
je 0x48b4f0
sub esp, 0x28
mov ecx, 0x5393f8
mov eax, esp
mov dword [eax], vtable.std::_Func_impl_no_alloc_int____cdecl___struct_lua_State____int__struct_lua_State__.0
mov dword [eax + 4], 0x489730
mov dword [eax + 0x24], eax
call fcn.00482d40
mov eax, dword [0x26935b0]
add esp, 0x28
mov eax, dword [eax]
mov dword [esp + 0xc], eax
cmp byte [eax + 0xd], 0
jne 0x48b6b7
lea ebx, [ebx]
mov edi, dword [eax + 0x14]
mov eax, dword [edi + 4]
test eax, eax
je 0x48b6a0
cmp dword [edi + 0x20], 0
je 0x48b6a0
cmp eax, 2
jne 0x48b61d
mov eax, dword [edi + 0x30]
push 0
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc4]
push dword [0xf54870]
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [edi + 0x28]
mov ebx, eax
mov ecx, dword [edi + 0x24]
push 0xff00ff
push edx
push ecx
push 0
push 0
push dword [edi + 0x20]
push edx
push ecx
push 0
push 0
push ebx
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
cmp dword [edi + 4], 1
jne 0x48b693
mov eax, dword [edi + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x28]
push 0xff00ff
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, eax
lea eax, [esp + 0x1c]
push esi
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push dword [0xf54870]
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [esp + 0xc]
call fcn.0044c3d0
mov eax, dword [esp + 0xc]
cmp byte [eax + 0xd], 0
je 0x48b5f0
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049dba8
mov esp, ebp
pop ebp
ret