joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movdqa xmm0, xmmword [eax]
lea edx, [esi - 1]
pxor xmm0, xmmword [edi]
movdqa xmmword [eax], xmm0
cmp edx, 1
jbe 0x4984ce
add edx, 0xfffffffe
lea ecx, [edi + 0x10]
shr edx, 1
inc edx
mov edi, edi
movdqa xmm0, xmmword [eax]
lea ecx, [ecx + 0x20]
aesenc xmm0, xmmword [ecx - 0x20]
movdqa xmmword [eax], xmm0
aesenc xmm0, xmmword [ecx - 0x10]
movdqa xmmword [eax], xmm0
dec edx
jne 0x4984b0
movdqa xmm0, xmmword [eax]
add esi, esi
aesenc xmm0, xmmword [edi + esi*8 - 0x10]
movdqa xmmword [eax], xmm0
aesenclast xmm0, xmmword [edi + esi*8]
pop edi
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4984f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
sub esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movdqa xmm1, xmmword [eax]
movdqa xmm0, xmmword [ecx]
mov eax, dword [ebp + 0x14]
pxor xmm0, xmm1
movdqa xmmword [ecx], xmm0
movdqa xmm0, xmmword [edx]
push esi
mov esi, dword [ebp + 0x10]
pxor xmm0, xmm1
movdqa xmmword [edx], xmm0
push edi
mov edi, dword [ebp + 0x1c]
movdqa xmm0, xmmword [esi]
pxor xmm0, xmm1
movdqa xmmword [esi], xmm0
movdqa xmm0, xmmword [eax]
pxor xmm0, xmm1
movdqa xmmword [eax], xmm0
cmp edi, 1
jbe 0x4985a5
mov edi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
add edi, 0x10
dec ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
jmp 0x498560
dec dword [esp + 0xc]
lea edi, [edi + 0x10]
movdqa xmm1, xmmword [edi - 0x10]
movdqa xmm0, xmmword [ecx]
aesenc xmm0, xmm1
movdqa xmmword [ecx], xmm0
movdqa xmm0, xmmword [edx]
aesenc xmm0, xmm1
movdqa xmmword [edx], xmm0
movdqa xmm0, xmmword [esi]
aesenc xmm0, xmm1
movdqa xmmword [esi], xmm0
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
jne 0x498560
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
add edi, edi
movdqa xmm0, xmmword [ecx]
movdqa xmm1, xmmword [eax + edi*8]
mov eax, dword [ebp + 0x14]
aesenclast xmm0, xmm1
movdqa xmmword [ecx], xmm0
movdqa xmm0, xmmword [edx]
aesenclast xmm0, xmm1
movdqa xmmword [edx], xmm0
movdqa xmm0, xmmword [esi]
aesenclast xmm0, xmm1
movdqa xmmword [esi], xmm0
movdqa xmm0, xmmword [eax]
aesenclast xmm0, xmm1
pop edi
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49a2e0
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x651258
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6f77c8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, ecx
test ebx, ebx
je 0x49a312
lea eax, [ebx + 4]
jmp 0x49a314
xor eax, eax
push eax
push dword [esp + 0x48]
call fcn.0049a5d0
mov dword [ebx + 0x10], eax
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
lea esi, [eax*2 + 4]
cmp ecx, esi
je 0x49a361
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
call fcn.0061be55
push esi
call fcn.00465de0
add esp, 8
test esi, esi
jne 0x49a34f
xor edx, edx
jmp 0x49a361
lea eax, [esi*4]
push eax
call fcn.0045f350
add esp, 4
mov edx, eax
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x44]
add ecx, 3
mov dword [ebx + 0x1c], edx
shr ecx, 2
lea edx, [esp + 0x14]
cmp ecx, 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x44], 1
cmovae eax, edx
mov dword [ebx + 0x18], esi
mov ebp, dword [eax]
push ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
call fcn.00465de0
add esp, 4
test ebp, ebp
jne 0x49a3aa
xor edi, edi
mov dword [esp + 0x14], edi
jmp 0x49a3c0
lea eax, [ebp*4]
push eax
call fcn.0045f350
add esp, 4
mov dword [esp + 0x14], eax
mov edi, eax
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x40]
lea esi, [ebp*4]
push eax
push dword [esp + 0x40]
mov dword [esp + 0x3c], 0
push esi
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x54], 4
call fcn.0061f593
mov eax, dword [esp + 0x50]
sub esi, eax
push esi
add eax, edi
push 0
push eax
call fcn.00615df0
add esp, 0x1c
lea edx, [esp + 0x44]
lea ecx, [esp + 0x18]
call fcn.0046ad50
mov eax, dword [ebx + 0x1c]
mov edx, 1
mov dword [eax], 0xb7e15163
cmp dword [ebx + 0x18], edx
jbe 0x49a439
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
inc edx
mov eax, dword [ecx - 4]
sub eax, 0x61c88647
mov dword [ecx], eax
cmp edx, dword [ebx + 0x18]
jb 0x49a423
mov eax, dword [ebx + 0x18]
lea ecx, [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x44], eax
cmp eax, ebp
mov dword [esp + 0x40], 0
lea edx, [esp + 0x44]
cmovae ecx, edx
mov eax, dword [ecx]
lea ecx, [eax + eax*2]
xor eax, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], eax
test ecx, ecx
je 0x49a4b5
lea ebx, [ebx]
xor edx, edx
div dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
xor edx, edx
mov eax, dword [ecx]
add eax, esi
add eax, dword [esp + 0x40]
rol eax, 3
mov dword [ecx], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
div ebp
lea eax, [edi + edx*4]
mov edx, dword [esp + 0x40]
lea ecx, [esi + edx]
add esi, edx
add esi, dword [eax]
rol esi, cl
mov dword [eax], esi
mov eax, dword [esp + 0x44]
inc eax
mov dword [esp + 0x44], eax
cmp eax, dword [esp + 0x3c]
jb 0x49a470
push dword [esp + 0x14]
xor eax, eax
mov ecx, ebp
rep stosd dword es:[edi], eax
call fcn.0061be55
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x49a4e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x18]
push ebp
mov edx, dword [eax]
mov ebp, dword [eax + 8]
push esi
mov esi, dword [ebx]
add esi, dword [eax + 4]
push edi
mov edi, dword [ebx + 4]
add ebx, 8
add edi, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
test eax, eax
je 0x49a550
mov edi, edi
lea ecx, [esi*2 + 1]
imul ecx, esi
lea edx, [edi*2 + 1]
imul edx, edi
rol ecx, 5
mov eax, ecx
rol edx, 5
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], esi
mov esi, edx
xor esi, ebp
mov ebp, edi
rol esi, cl
mov edi, eax
add esi, dword [ebx + 4]
mov ecx, edx
rol edi, cl
add edi, dword [ebx]
add ebx, 8
dec dword [esp + 0x10]
jne 0x49a510
mov edx, dword [ebx]
add ebp, dword [ebx + 4]
mov eax, dword [esp + 0x1c]
add edx, dword [esp + 0x18]
test eax, eax
je 0x49a565
mov ecx, dword [eax]
jmp 0x49a567
xor ecx, ecx
xor ecx, edx
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
test eax, eax
je 0x49a57e
add eax, 4
test eax, eax
je 0x49a57e
mov ecx, dword [eax]
jmp 0x49a580
xor ecx, ecx
xor ecx, esi
mov dword [edx + 4], ecx
test eax, eax
je 0x49a594
add eax, 4
test eax, eax
je 0x49a594
mov ecx, dword [eax]
jmp 0x49a596
xor ecx, ecx
xor ecx, ebp
mov dword [edx + 8], ecx
test eax, eax
je 0x49a5b5
add eax, 4
test eax, eax
je 0x49a5b5
mov eax, dword [eax]
xor eax, edi
pop edi
pop esi
pop ebp
mov dword [edx + 0xc], eax
pop ebx
pop ecx
ret 0xc
xor eax, eax
xor eax, edi
pop edi
pop esi
pop ebp
mov dword [edx + 0xc], eax
pop ebx
pop ecx
ret 0xc
Function at 0x49d9a0
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x651258
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6f77c8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, ecx
test ebx, ebx
je 0x49d9d2
lea eax, [ebx + 4]
jmp 0x49d9d4
xor eax, eax
push eax
push dword [esp + 0x48]
call fcn.0049dc20
mov dword [ebx + 0x10], eax
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
lea esi, [eax*2 + 2]
cmp ecx, esi
je 0x49da21
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
call fcn.0061be55
push esi
call fcn.00465de0
add esp, 8
test esi, esi
jne 0x49da0f
xor edx, edx
jmp 0x49da21
lea eax, [esi*4]
push eax
call fcn.0045f350
add esp, 4
mov edx, eax
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x44]
add ecx, 3
mov dword [ebx + 0x1c], edx
shr ecx, 2
lea edx, [esp + 0x14]
cmp ecx, 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x44], 1
cmovae eax, edx
mov dword [ebx + 0x18], esi
mov ebp, dword [eax]
push ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
call fcn.00465de0
add esp, 4
test ebp, ebp
jne 0x49da6a
xor edi, edi
mov dword [esp + 0x14], edi
jmp 0x49da80
lea eax, [ebp*4]
push eax
call fcn.0045f350
add esp, 4
mov dword [esp + 0x14], eax
mov edi, eax
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x40]
lea esi, [ebp*4]
push eax
push dword [esp + 0x40]
mov dword [esp + 0x3c], 0
push esi
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x54], 4
call fcn.0061f593
mov eax, dword [esp + 0x50]
sub esi, eax
push esi
add eax, edi
push 0
push eax
call fcn.00615df0
add esp, 0x1c
lea edx, [esp + 0x44]
lea ecx, [esp + 0x18]
call fcn.0046ad50
mov eax, dword [ebx + 0x1c]
mov edx, 1
mov dword [eax], 0xb7e15163
cmp dword [ebx + 0x18], edx
jbe 0x49daf9
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
inc edx
mov eax, dword [ecx - 4]
sub eax, 0x61c88647
mov dword [ecx], eax
cmp edx, dword [ebx + 0x18]
jb 0x49dae3
mov eax, dword [ebx + 0x18]
lea ecx, [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x44], eax
cmp eax, ebp
mov dword [esp + 0x40], 0
lea edx, [esp + 0x44]
cmovae ecx, edx
mov eax, dword [ecx]
lea ecx, [eax + eax*2]
xor eax, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], eax
test ecx, ecx
je 0x49db75
lea ebx, [ebx]
xor edx, edx
div dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
xor edx, edx
mov eax, dword [ecx]
add eax, esi
add eax, dword [esp + 0x40]
rol eax, 3
mov dword [ecx], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
div ebp
lea eax, [edi + edx*4]
mov edx, dword [esp + 0x40]
lea ecx, [esi + edx]
add esi, edx
add esi, dword [eax]
rol esi, cl
mov dword [eax], esi
mov eax, dword [esp + 0x44]
inc eax
mov dword [esp + 0x44], eax
cmp eax, dword [esp + 0x3c]
jb 0x49db30
push dword [esp + 0x14]
xor eax, eax
mov ecx, ebp
rep stosd dword es:[edi], eax
call fcn.0061be55
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x49dba0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [ecx + 0x18]
push ebp
mov edx, dword [eax + 4]
mov ebp, dword [ecx + 0xc]
push esi
mov esi, dword [ebx]
add esi, dword [eax]
mov eax, dword [ebx + 4]
push edi
add eax, edx
xor edi, edi
test ebp, ebp
je 0x49dbd9
xor esi, eax
mov ecx, eax
rol esi, cl
add esi, dword [ebx + edi*8 + 8]
xor eax, esi
mov ecx, esi
rol eax, cl
add eax, dword [ebx + edi*8 + 0xc]
inc edi
cmp edi, ebp
jb 0x49dbc0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x49dbe5
mov edx, dword [ecx]
jmp 0x49dbe7
xor edx, edx
xor edx, esi
mov esi, dword [esp + 0x1c]
mov dword [esi], edx
test ecx, ecx
je 0x49dc08
add ecx, 4
test ecx, ecx
je 0x49dc08
mov ecx, dword [ecx]
pop edi
xor ecx, eax
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
ret 0xc
xor ecx, ecx
pop edi
xor ecx, eax
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x49e200
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx + 0x118]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [ecx + 0x11c]
push edi
push ebx
push dword [esp + 0x1c]
lea edi, [eax*4]
mov dword [esp + 0x18], ebx
push edi
push esi
mov dword [esp + 0x2c], 4
call fcn.0061f593
sub edi, ebx
lea eax, [esi + ebx]
push edi
push 0
push eax
call fcn.00615df0
lea edx, [esp + 0x38]
lea ecx, [esp + 0x2c]
call fcn.0046ad50
push eax
mov edx, esi
mov ecx, esi
call fcn.0046d3c0
add esp, 0x20
mov dword [esp + 0x1c], 0
mov ecx, dword [esi + 4]
mov edx, ecx
mov edi, dword [esi + 0x38]
mov eax, ecx
ror edx, 0x12
shr ecx, 3
ror eax, 7
xor edx, eax
mov eax, edi
xor edx, ecx
ror eax, 0x11
mov ecx, edi
shr edi, 0xa
ror ecx, 0x13
xor ecx, eax
xor ecx, edi
add edx, ecx
mov ecx, dword [esp + 0x1c]
add edx, dword [esi + 0x24]
add edx, dword [esi]
mov dword [esi + 0x40], edx
mov eax, dword [ecx + 0x6ac400]
add ecx, 4
add dword [esi], eax
add esi, 4
mov dword [esp + 0x1c], ecx
cmp ecx, 0xc0
jb 0x49e264
mov ecx, 0xc8
lea esp, [esp]
mov eax, dword [ecx + 0x6ac3f8]
lea esi, [esi + 0x10]
add dword [esi - 0x10], eax
mov eax, dword [ecx + 0x6ac3fc]
add dword [esi - 0xc], eax
mov eax, dword [ecx + 0x6ac400]
add dword [esi - 8], eax
mov eax, dword [ecx + 0x6ac404]
add ecx, 0x10
add dword [esi - 4], eax
cmp ecx, 0x108
jb 0x49e2c0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4abdc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jbe 0x4abdde
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.004cdfd0
add esp, 8
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [ebp + ecx - 0x14], edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp + eax - 0x14], ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jae 0x4abe3b
imul edx, dword [ebp - 8], 0x1000193
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x4abe12
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x52b6a0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6f77c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
call fcn.004c9500
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.0052b5f0
push 0x6711a0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00619da4
add esp, 8
mov dword [ebp - 0x2c], eax
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cvtss2sd xmm0, dword [ebp - 0x20]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x24]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x28]
sub esp, 8
movsd qword [esp], xmm0
push str.CenterPos__f__f__f_n
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0058d920
add esp, 0x24
cvtss2sd xmm0, dword [ebp - 0x10]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0xc]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 8]
sub esp, 8
movsd qword [esp], xmm0
push str.CameraSetting__f__f__f_n
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0058d920
add esp, 0x24
cvtss2sd xmm0, dword [ebp - 0x14]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x18]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x1c]
sub esp, 8
movsd qword [esp], xmm0
push str.CmrPos__f__f__f_n
push 0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0058d920
add esp, 0x24
cvttss2si eax, dword [ebp - 0x14]
push eax
cvttss2si ecx, dword [ebp - 0x18]
push ecx
cvttss2si edx, dword [ebp - 0x1c]
push edx
cvttss2si eax, dword [ebp - 0x10]
push eax
cvttss2si ecx, dword [ebp - 0xc]
push ecx
cvttss2si edx, dword [ebp - 8]
push edx
cvttss2si eax, dword [ebp - 0x20]
push eax
cvttss2si ecx, dword [ebp - 0x24]
push ecx
cvttss2si edx, dword [ebp - 0x28]
push edx
push str.Line__x__dy__dz__ddistance__dpitch__drot__dup__dview__dcross__d__n
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0058d920
add esp, 0x30
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00619c69
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0061693e
mov esp, ebp
pop ebp
ret 4

Function at 0x531b90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x533f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x6728d8
push 0x6728dc
call fcn.00619da4
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x533f48
xor al, al
jmp 0x533f73
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x2628
push ecx
call fcn.0061b105
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00619c69
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x533f80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2624], 0
jne 0x533f97
jmp 0x534010
push 0x6728ec
call dword [sym.imp.python27.dll_Py_BuildValue]
add esp, 4
push eax
push str.OnSaveInterfaceStatus
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2624]
push edx
call fcn.0060d9f0
add esp, 0xc
push 0x672908
push str.interface.cfg
call fcn.00619da4
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x533fe7
push str.Cannot_open_interface.cfg
call fcn.00574320
add esp, 4
jmp 0x534010
mov eax, dword [ebp - 8]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x2628
push ecx
call fcn.0061bd42
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.00619c69
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x536540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6f77c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x34]
push eax
push 3
mov ecx, dword [ebp - 0x2c]
call fcn.005930a0
movzx ecx, al
test ecx, ecx
jne 0x536570
mov al, 1
jmp 0x5366a9
movzx esi, word [ebp - 0x33]
mov ecx, dword [ebp - 0x2c]
call fcn.00592ff0
cmp esi, eax
jle 0x536587
mov al, 1
jmp 0x5366a9
lea edx, [ebp - 0x50]
push edx
push 7
mov ecx, dword [ebp - 0x2c]
call fcn.00593280
movzx eax, al
test eax, eax
jne 0x5365a3
xor al, al
jmp 0x5366a9
movzx ecx, word [ebp - 0x4f]
sub ecx, 7
mov word [ebp - 0x20], cx
mov edx, dword [ebp - 0x4d]
mov dword [ebp - 0x40], edx
movzx eax, word [ebp - 0x20]
push eax
call fcn.00614b2b
add esp, 4
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
movzx eax, word [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.00593280
movzx ecx, al
test ecx, ecx
jne 0x5365fb
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
push eax
call fcn.005660a0
add esp, 4
xor al, al
jmp 0x5366a9
mov ecx, 0x71153c
call fcn.0045ea90
push eax
call fcn.00574a80
add esp, 4
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.0055f280
add esp, 4
push eax
lea ecx, [ebp - 0x1c]
call fcn.0045e720
push 0x672d6c
lea ecx, [ebp - 0x1c]
call fcn.0045ea90
push eax
call fcn.00619da4
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x536665
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.005660a0
add esp, 4
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x1c]
call fcn.0045f010
mov al, byte [ebp - 0x21]
jmp 0x5366a9
mov ecx, dword [ebp - 0x30]
push ecx
push 1
movzx edx, word [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.0061bd42
add esp, 0x10
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.00619c69
add esp, 4
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
call fcn.005660a0
add esp, 4
mov byte [ebp - 0x22], 1
lea ecx, [ebp - 0x1c]
call fcn.0045f010
mov al, byte [ebp - 0x22]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0061693e
mov esp, ebp
pop ebp
ret
Function at 0x537370
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
lea eax, [ebp - 0xc]
push eax
push 1
call dword [sym.imp.DevIL.dll_ilGenImages]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.DevIL.dll_ilBindImage]
push 0x600
call dword [sym.imp.DevIL.dll_ilEnable]
push 0x602
call dword [sym.imp.DevIL.dll_ilOriginFunc]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.DevIL.dll_ilLoad]
movzx eax, al
test eax, eax
jne 0x5373c8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 2
xor al, al
jmp 0x5374da
push 0xde4
call dword [sym.imp.DevIL.dll_ilGetInteger]
cmp eax, 0x40
je 0x5373e8
mov edx, dword [ebp + 0xc]
mov dword [edx], 3
xor al, al
jmp 0x5374da
push 0xde5
call dword [sym.imp.DevIL.dll_ilGetInteger]
cmp eax, 0x80
je 0x53740a
mov eax, dword [ebp + 0xc]
mov dword [eax], 4
xor al, al
jmp 0x5374da
lea ecx, [ebp - 0xc]
push ecx
push 1
call dword [sym.imp.DevIL.dll_ilDeleteImages]
call dword [sym.imp.DevIL.dll_ilShutDown]
push 0x672da0
mov edx, dword [ebp + 8]
push edx
call fcn.00619da4
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x53743f
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0061b240
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.0061b653
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x394], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.0061b240
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x394]
push ecx
call fcn.00614b2b
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x39c], eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x394]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x39c]
push edx
call fcn.0061b105
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.00619c69
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00579610
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 0x398], eax
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x5392f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6564af
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x6f77c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0053c3b0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CGuildMarkManager.0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004ce130
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004ce130
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004b6c60
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.0045e3b0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.0053c380
mov byte [ebp - 4], 5
push str.mark
call fcn.0064d7c8
add esp, 4
mov dword [ebp - 0x14], 0
jmp 0x53939a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x1900
jae 0x5393b8
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004af240
jmp 0x539391
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret