joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498920
Capabilities:
Print debug messages

Disassembly:
push ebx
push edi
push 0x80
lea ebx, [esi + 0x18]
push str.CMapObject
push ebx
call dword [sym.imp.MSVCR100.dll_strncpy]
lea eax, [esi + 4]
add esp, 0xc
cmp dword [eax], 0
mov dword [esi + 0xc], 0xa
jne 0x49895c
push eax
mov edi, 0x14
call fcn.004993c0
mov eax, dword [esi + 4]
add esp, 4
mov dword [esi + 8], eax
push 0xa
push 0x14
push ebx
lea edi, [esi + 0x9c]
push str._MemoryPooltempl__s_
push edi
mov dword [esi + 0x98], 0x14
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x98]
mov edx, dword [esi + 0x14]
lea ecx, [eax*4]
push ecx
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
push 0x14
push ebx
push str.__s__Init_t_d_t_d_t_d_t_d_t_d_n
push edi
call dword [sym.imp.MSVCR100.dll_sprintf]
push edi
call fcn.00574d40
add esp, 0x24
pop edi
pop ebx
ret

Function at 0x4989c0
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x4989cc
pop esi
ret
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4989e5
dec ecx
mov dword [eax + 0x10], ecx
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx*4]
test eax, eax
jne 0x498aca
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x14]
push ebx
push edi
test eax, eax
jne 0x498a5a
mov edi, dword [esi + 0xc]
lea ebx, [esi + 4]
push ebx
call fcn.004993c0
mov edx, dword [ebx]
mov ecx, dword [esi + 0x14]
inc dword [esi + 0x10]
mov eax, dword [esi + 0x10]
push ecx
mov dword [esi + 8], edx
mov edx, dword [esi + 0xc]
push edx
push eax
lea ebx, [esi + 0x18]
push ebx
lea edi, [esi + 0x9c]
push 0x588a30
push edi
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
add dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
lea edx, [ecx*4]
push edx
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push ecx
push eax
push edx
push ebx
push str.__s__Increse_t_d_t_d_t_d_t_d_t_d_n
jmp 0x498ab0
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x14]
push eax
push ecx
push edx
lea ebx, [esi + 0x18]
push ebx
lea edi, [esi + 0x9c]
push str.___s_alloc_Band
push edi
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0xc]
sub dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
lea edx, [ecx*4]
push edx
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
push ecx
push eax
push edx
push ebx
push str.__s__Decrese_t_d_t_d_t_d_t_d_t_d_n
push edi
call dword [sym.imp.MSVCR100.dll_sprintf]
push edi
call fcn.00574d40
add esp, 0x24
pop edi
pop ebx
mov ecx, esi
pop esi
jmp fcn.004989c0
inc dword [esi + 0x14]
pop esi
ret
Function at 0x4b6750
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x264], esi
test ebx, ebx
je 0x4b6879
test esi, esi
je 0x4b6879
push edi
lea eax, [ebp - 0x25c]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x4b682a
cmp byte [ebp - 0x25c], 0
je 0x4b682a
lea esi, [ebp - 0x25c]
lea ecx, [ecx]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x590ccc
push esi
call edi
test eax, eax
je 0x4b681c
push 0x590cd0
push esi
call edi
test eax, eax
je 0x4b681c
mov cl, byte [esi]
mov dl, byte [esi + 1]
push 0x64
lea eax, [ebp - 0x68]
mov byte [ebp - 0x260], cl
push eax
lea ecx, [ebp - 0x260]
push ecx
mov byte [ebp - 0x25f], dl
mov byte [ebp - 0x25e], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x4b6832
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
push edi
lea eax, [ebp - 0x68]
push eax
push ebx
call dword [sym.imp.MSVCR100.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
je 0x4b6845
add esi, 4
cmp byte [esi], 0
jne 0x4b67b0
mov esi, dword [ebp - 0x264]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005762ee
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x260]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebx, edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005762ee
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.005762ee
mov esp, ebp
pop ebp
ret
Function at 0x4b6890
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5801db
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x220], 0xf
push eax
mov dword [ebp - 4], edi
push edi
push 0x400
mov dword [ebp - 0x224], edi
mov byte [ebp - 0x234], 0
mov byte [ebp - 0x114], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
jne 0x4b6938
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], 0xf
lea edi, [ebp - 0x234]
mov esi, ebx
mov byte [ebx], 0
call fcn.004b7fd0
cmp dword [ebp - 0x220], 0x10
jb 0x4b6a01
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
jmp 0x4b6a01
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
test eax, eax
jne 0x4b698f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], 0xf
lea edi, [ebp - 0x234]
mov esi, ebx
mov byte [ebx], 0
call fcn.004b7fd0
cmp dword [ebp - 0x220], 0x10
jb 0x4b6a01
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
jmp 0x4b6a01
lea edx, [ebp - 0x114]
lea ecx, [ebp - 0x218]
call fcn.004b6750
push esi
test eax, eax
jne 0x4b69b0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x10], edi
jmp 0x4b69e3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x114]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b69c0
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x114]
lea esi, [ebp - 0x234]
call fcn.004051c0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
lea edi, [ebp - 0x234]
mov esi, ebx
mov byte [ebx], 0
call fcn.004b7fd0
mov esi, edi
call fcn.004b7fa0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005762ee
mov esp, ebp
pop ebp
ret

Function at 0x4bb5c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x659331], 0
je 0x4bb5e1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x64f3fc], eax
mov dword [0x69ce10], eax
mov byte [0x659331], 0
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x64f3fc]
mov ecx, eax
sub ecx, edx
mov dword [0x69ce10], eax
cmp eax, edx
jae 0x4bb5fb
dec ecx
add dword [0x65fab8], ecx
mov dword [0x64f3fc], eax
mov eax, dword [0x64f3f8]
add eax, ecx
mov dword [0x65f2d4], ecx
mov dword [0x64f3f8], eax
cmp eax, 0x5265c00
jb 0x4bb62f
inc dword [0x64f3f4]
sub dword [0x64f3f8], 0x5265c00
ret
Function at 0x4c4610
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._INI_MacroUserSet.mcr
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c4640
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
push 0x500
push 0x67e7fc
push esi
call edi
test eax, eax
jne 0x4c466d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 4]
push ecx
push 0xc0
push 0x67edbc
push esi
call edi
push esi
test eax, eax
je 0x4c465f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c46a0
Capabilities:
Create directory
Delete file
Read file on windows
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
jmp dword [eax*4 + 0x4c5098]

Function at 0x4c9e00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push str.._ini_GameOption.opt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c9e32
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x4c9e73
cmp dword [ebp - 8], 0x61208
jne 0x4c9e73
push 0
lea edx, [ebp - 4]
push edx
push 0xac
push 0x64f534
push esi
call edi
test eax, eax
jne 0x4c9e82
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], 0xac
push esi
ja 0x4c9e74
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c9ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._ini_GameOption.opt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c9f03
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 4]
push ecx
push esi
mov dword [ebp - 4], 0x61208
call edi
push 0
lea edx, [ebp - 8]
push edx
push 0xac
push 0x64f534
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e64a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57878c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
mov eax, dword [0x5b107c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x3d
lea ecx, [esi + 0x3c]
xor eax, eax
push ebx
push ecx
mov dword [esi], vtable.COBalloonName.0
mov dword [esi + 0x7c], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x120], ebx
mov word [esi + 0x11c], ax
mov dword [esi + 0x124], ebx
mov byte [esi + 0x128], bl
mov dword [esi + 0x80], 0xffffff
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call sub.MSVCR100.dll_memset
xor eax, eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov byte [esi + 0x94], al
mov dword [esi + 0x95], eax
mov dword [esi + 0x99], eax
mov dword [esi + 0x9d], eax
mov dword [esi + 0xa1], eax
mov dword [esi + 0xa5], eax
mov dword [esi + 0xa9], eax
mov dword [esi + 0xad], eax
mov dword [esi + 0xb1], eax
mov byte [esi + 0xb5], al
mov dword [esi + 0xb6], eax
mov dword [esi + 0xba], eax
mov dword [esi + 0xbe], eax
mov dword [esi + 0xc2], eax
mov dword [esi + 0xc6], eax
mov dword [esi + 0xca], eax
mov dword [esi + 0xce], eax
mov dword [esi + 0xd2], eax
mov byte [esi + 0xd6], al
mov dword [esi + 0xd7], eax
mov dword [esi + 0xdb], eax
mov dword [esi + 0xdf], eax
mov dword [esi + 0xe3], eax
mov dword [esi + 0xe7], eax
mov dword [esi + 0xeb], eax
mov dword [esi + 0xef], eax
mov dword [esi + 0xf3], eax
mov byte [esi + 0xf7], al
mov dword [esi + 0xf8], eax
mov dword [esi + 0xfc], eax
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], eax
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], eax
push 0x160
mov byte [esi + 0x118], al
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4e6642
push eax
call fcn.00428c20
jmp 0x4e6644
xor eax, eax
mov dword [esi + 0x130], eax
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e6fa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x57f468
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5b107c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x5b107c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], vtable.cImage.0
mov eax, dword [ebp + 0xc]
sub eax, edi
mov ecx, 0xede234
mov dword [esp + 0x58], edi
mov dword [esp + 0x10], ecx
je 0x4e701a
dec eax
je 0x4e7010
dec eax
jne 0x4e701e
mov dword [esp + 0x10], 0xf83232
jmp 0x4e701e
mov dword [esp + 0x10], 0x4dc025
jmp 0x4e701e
mov dword [esp + 0x10], ecx
mov esi, 0x3f
mov ecx, 0x67cb38
call fcn.0056e550
cmp eax, edi
je 0x4e705c
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov edi, dword [eax]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0x10]
lea ebx, [esp + 0x18]
lea esi, [esp + 0x28]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], edx
call fcn.0042a9c0
mov eax, dword [esp + 0x14]
mov ebx, dword [eax + 0x130]
call fcn.00428e10
xor ecx, ecx
lea esi, [ebx + 0x10]
lea edi, [esp + 0x28]
mov word [ebx + 0xc], cx
mov dword [ebx + 0x30], 0xffffff
call fcn.00401a10
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ebx + 0x34], edx
mov eax, dword [esi + 0x130]
mov dword [eax + 0x50], 0xdc
mov edi, dword [esi + 0x130]
push ecx
call fcn.00429530
mov dword [esi + 0x12c], 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.005762ee
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f1760
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x6573a4]
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push edi
lea eax, [ebp - 0x104]
push eax
push ecx
push 0x58638c
push 0x69cf68
mov byte [ebp - 0x104], 0
call esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x69cf68
lea edx, [ebp - 0x208]
push str._sData
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x1c
push 0
lea eax, [ebp - 0x208]
push eax
call ebx
mov edx, dword [0x6573a4]
lea ecx, [ebp - 0x104]
push ecx
push edx
push 0x58638c
push 0x69cf68
mov byte [ebp - 0x104], 0
call esi
mov eax, dword [0x656840]
push eax
push 0x69cf68
lea ecx, [ebp - 0x208]
push str._sData_d
push ecx
call edi
add esp, 0x20
push 0
lea edx, [ebp - 0x208]
push edx
call ebx
mov bl, byte [ebp + 8]
test bl, 1
je 0x4f1864
mov ecx, dword [0x6573a4]
lea eax, [ebp - 0x104]
push eax
push ecx
push 0x58638c
push 0x69cf68
mov byte [ebp - 0x104], 0
call esi
mov eax, dword [0x656840]
push eax
push eax
push 0x69cf68
lea edx, [ebp - 0x208]
push str._sData_d_d.UII
push edx
call edi
add esp, 0x24
lea eax, [ebp - 0x208]
push eax
call fcn.004f21c0
test bl, 2
je 0x4f18bb
mov edx, dword [0x6573a4]
lea ecx, [ebp - 0x104]
push ecx
push edx
push 0x58638c
push 0x69cf68
mov byte [ebp - 0x104], 0
call esi
mov eax, dword [0x656840]
push eax
push eax
push 0x69cf68
lea eax, [ebp - 0x208]
push str._sData_d_d.UIS
push eax
call edi
add esp, 0x24
call fcn.00401050
test eax, eax
je 0x4f18bb
lea ecx, [ebp - 0x208]
call fcn.004f2b60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005762ee
mov esp, ebp
pop ebp
ret 4
Function at 0x4f2a70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f2b48
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x14]
push eax
push 4
lea ecx, [ebp - 0x18]
push ecx
push esi
call edi
test eax, eax
jne 0x4f2adb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005762ee
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x18], 0x6060801
jne 0x4f2ac2
push 0
lea edx, [ebp - 0x14]
push edx
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
call edi
push esi
test eax, eax
je 0x4f2ac3
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x656844], 0
je 0x4f2b48
call fcn.00401050
test eax, eax
je 0x4f2b48
call fcn.00401050
mov esi, eax
mov eax, dword [ebp - 0xc]
call fcn.0048fc70
call fcn.00401050
mov cx, word [ebp - 0x10]
mov word [eax + 0x6c4], cx
mov ecx, dword [0x65fd6c]
call fcn.0043d5a0
fld dword [ebp - 8]
push ecx
xor ecx, ecx
fstp dword [esp]
call fcn.00553820
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005762ee
mov esp, ebp
pop ebp
ret 4

Function at 0x4f2b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00401050
mov eax, dword [eax + 0x9e0]
mov dword [ebp - 0xc], eax
call fcn.00401050
fld dword [0x69ae80]
mov cx, word [eax + 0x6c4]
fstp dword [ebp - 8]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
mov word [ebp - 0x10], cx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f2bee
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x14]
push edx
push 4
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x18], 0x6060801
call edi
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea edx, [ebp - 0x10]
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005762ee
mov esp, ebp
pop ebp
ret
Function at 0x4fdbd0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e931
mov eax, dword fs:[0]
push eax
sub esp, 0x654
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x524]
mov dword [ebp - method.CMHFile.virtual_0], vtable.CMHFile.0
call fcn.004061b0
xor ebx, ebx
xor eax, eax
push 0x104
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x638], eax
lea eax, [ebp - 0x628]
push ebx
push eax
mov dword [ebp - 0x654], ebx
mov word [ebp - 0x634], bx
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x62c], ebx
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edi, 4
cmp dword [0x6573f0], edi
je 0x4fdc8e
mov ecx, dword [0x6573b8]
push ecx
call esi
mov dword [0x6573f0], edi
push 0x10
push str.Client_motionList.bin
mov ecx, 0x587394
lea edi, [ebp - 0x658]
call fcn.00528720
test eax, eax
jne 0x4fdcbf
mov dword [ebp - method.CMHFile.virtual_0], vtable.CMHFile.0
mov dword [ebp - 4], 1
jmp 0x4fdda3
cmp dword [0x6573f0], ebx
je 0x4fdcd6
mov edx, dword [0x6573a8]
push edx
call esi
mov dword [0x6573f0], ebx
push 0x69d3c8
lea esi, [ebp - 0x658]
call fcn.00528970
push 0x69d3c8
call dword [sym.imp.MSVCR100.dll_atoi]
add esp, 4
jmp 0x4fdd00
push 0x69d3c8
lea esi, [ebp - 0x658]
call fcn.00528970
push 0x69d3c8
call dword [sym.imp.MSVCR100.dll_atoi]
mov eax, dword [ebp - 0x650]
add esp, 4
sub eax, ebx
je 0x4fdd3b
dec eax
jne 0x4fdd7b
mov eax, dword [ebp - 0x638]
cmp eax, dword [ebp - 0x644]
je 0x4fdd92
jmp 0x4fdd53
mov ecx, dword [ebp - 0x654]
push ecx
call dword [sym.imp.MSVCR100.dll_feof]
add esp, 4
neg eax
sbb eax, eax
neg eax
jne 0x4fdd92
lea edx, [ebp - 0x110]
push edx
lea esi, [ebp - 0x658]
call fcn.00528970
lea ecx, [ebp - 0x110]
call fcn.004fd670
mov edi, dword [eax + 4]
push eax
call fcn.004fd600
jmp 0x4fdd00
dec eax
jne 0x4fdd92
push str.MHFile.cpp
xor ecx, ecx
mov edx, 0x258
call fcn.0052cb10
add esp, 4
mov dword [ebp - method.CMHFile.virtual_0], vtable.CMHFile.0
mov dword [ebp - 4], 2
lea esi, [ebp - 0x658]
call fcn.00528910
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005762ee
mov esp, ebp
pop ebp
ret
Function at 0x5073f0
Capabilities:
Check for software breakpoints

Disassembly:
call fcn.00401050
cmp dword [eax + 0x9e0], 0
jne 0x507573
push edi
call fcn.00401050
movzx edi, word [eax + 0x454]
call fcn.00401050
mov ecx, eax
xor edx, edx
mov eax, 0xc9
div dword [ecx + 0x9f0]
mov eax, dword [ecx + 0x9f4]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x50743f
cmp dword [edx], 0xc9
je 0x50743f
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x507430
push esi
call fcn.00401050
mov ecx, eax
xor edx, edx
mov eax, 0xcc
div dword [ecx + 0x9f0]
mov ecx, dword [ecx + 0x9f4]
mov edx, dword [ecx + edx*4]
test edx, edx
je 0x507470
cmp dword [edx], 0xcc
je 0x5074da
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x507461
xor esi, esi
call fcn.00401050
mov ecx, eax
xor edx, edx
mov eax, 0xcf
div dword [ecx + 0x9f0]
mov eax, dword [ecx + 0x9f4]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x5074a2
cmp dword [edx], 0xcf
je 0x5074df
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x507493
xor edx, edx
cmp edi, 0x28
jb 0x5074e4
test edx, edx
je 0x5074e4
call fcn.00401050
cmp byte [eax + 0x128], 1
mov ecx, 0xa2c
mov word [eax + 0x210], cx
jne 0x5074ce
mov esi, eax
call fcn.0049a450
call fcn.00401050
mov edx, 0xa2c
jmp 0x50754e
mov esi, dword [edx + 4]
jmp 0x507472
mov edx, dword [edx + 4]
jmp 0x5074a4
lea eax, [edi - 0x19]
cmp ax, 0xe
ja 0x50751e
test esi, esi
je 0x50751e
call fcn.00401050
cmp byte [eax + 0x128], 1
mov ecx, 0xa2a
mov word [eax + 0x210], cx
jne 0x507512
mov esi, eax
call fcn.0049a450
call fcn.00401050
mov edx, 0xa2a
jmp 0x50754e
cmp edi, 0x18
ja 0x507571
call fcn.00401050
cmp byte [eax + 0x128], 1
mov ecx, 0xa28
mov word [eax + 0x210], cx
jne 0x507544
mov esi, eax
call fcn.0049a450
call fcn.00401050
mov edx, 0xa28
mov word [eax + 0x6c4], dx
mov ecx, dword [0x65fd6c]
call fcn.0043d5a0
call fcn.00401050
mov esi, eax
mov eax, 1
call fcn.0048fc70
pop esi
pop edi
ret
Function at 0x5105e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5b107c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, edx
push 0xff
lea edx, [ebp - 0x104]
push edx
push 0
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x10c], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_strrchr]
mov byte [eax + 1], 0
mov eax, esi
add esp, 8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x510634
lea edi, [ebp - 0x104]
sub eax, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x510644
mov edx, dword [ebp - 0x10c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x108]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x104]
push ecx
push 0xff
push edx
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005762ee
mov esp, ebp
pop ebp
ret