joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467510
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
push 0x4f0a88
cmp dword [0x504274], ebx
je 0x4675f1
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x467590
mov edi, dword [sym.imp.MSVCR90.dll_ftell]
push esi
call edi
add esp, 4
push 2
push ebx
push esi
mov ebp, eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
push esi
call edi
add esp, 4
push 0
push ebp
push esi
mov ebx, eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
push ebx
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov edi, eax
push esi
test edi, edi
jne 0x46759a
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 1
push ebx
push edi
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
push esi
cmp eax, 1
jae 0x4675ca
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
push edi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
push ebx
mov eax, edi
call fcn.00466c90
mov esi, eax
add esp, 4
test esi, esi
je 0x4675b6
mov edi, dword [esp + 0x1c]
mov dword [esi + 0x18], 1
jmp 0x467604
mov edi, dword [esp + 0x20]
push edi
call fcn.00466c20
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x467590
push 0
push 0
push esi
call fcn.00466f50
add esp, 0xc
mov ebx, edi
call fcn.00461300
sub eax, 1
je 0x467624
call fcn.00467680
jmp 0x467630
push 0
mov ecx, esi
call fcn.00469410
add esp, 4
mov ebx, eax
mov eax, esi
call fcn.00466ee0
test ebx, ebx
je 0x467590
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00465fe0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
shr eax, 0xa
push eax
shr ecx, 0xa
push ecx
push edi
push str.SFF__s_estimated_mem_use:__uk_sys__uk_tex_n
mov edx, 7
call fcn.0046c3c0
add esp, 0x18
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x46ef30
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp dword [0x5044dc], 0
push ebx
push ebp
push esi
push edi
push 0x4f0a88
je 0x46f000
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x46efa8
mov edi, dword [sym.imp.MSVCR90.dll_ftell]
push esi
call edi
add esp, 4
push 2
push 0
push esi
mov ebx, eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
push esi
call edi
add esp, 4
push 0
push ebx
push esi
mov ebp, eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
push ebp
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov edi, eax
push esi
test edi, edi
jne 0x46efb2
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 1
push ebp
push edi
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
push esi
cmp eax, 0xffffffff
je 0x46ef9f
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
push ebp
mov eax, edi
call fcn.00466c90
mov esi, eax
add esp, 4
test esi, esi
jne 0x46eff3
push edi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x1c]
mov dword [esi + 0x18], 1
jmp 0x46f013
mov ebx, dword [esp + 0x20]
push ebx
call fcn.00466c20
mov esi, eax
add esp, 8
test esi, esi
je 0x46efa8
push 0
push 0
push esi
call fcn.00466f50
add esp, 0xc
call fcn.00461300
sub eax, 3
je 0x46f0af
sub eax, 1
jne 0x46efa8
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.0046f620
mov edi, eax
add esp, 8
test edi, edi
jne 0x46f05c
mov eax, esi
call fcn.00466ee0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x14]
mov eax, ecx
sub eax, 0
je 0x46f080
sub eax, 2
push ebx
mov edx, 5
je 0x46f091
push ecx
push str.Invalid_status_code__d_returned_while_loading_SND_file__engines_fault_:__s_n
call fcn.0046c3c0
add esp, 0xc
mov eax, esi
call fcn.00466ee0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push str.Ignored_error_s__while_loading_SND_file:__s_n
call fcn.0046c3c0
add esp, 8
mov eax, esi
call fcn.00466ee0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 1
call fcn.0046e7c0
mov edi, eax
add esp, 4
mov eax, esi
test edi, edi
je 0x46f04d
lea edx, [esp + 0x14]
call fcn.0046f120
test eax, eax
jne 0x46f0e5
mov eax, dword [esp + 0x14]
call fcn.00488c20
push eax
push ebx
push str.Error_loading_wave_file___s_:__s_n
mov edx, 5
jmp 0x46f078
push eax
push edi
xor ecx, ecx
xor edx, edx
call fcn.0046e810
add esp, 8
test eax, eax
jne 0x46f080
mov eax, esi
call fcn.00466ee0
push edi
call fcn.0046e870
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x47cba0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [sym.imp.MSVCR90.dll_ftell]
push esi
call edi
push 2
push 0
push esi
mov ebp, eax
call dword [sym.imp.MSVCR90.dll_fseek]
push esi
call edi
push 0
push ebp
push esi
mov ebx, eax
call dword [sym.imp.MSVCR90.dll_fseek]
lea eax, [ebx + 1]
push eax
push 1
call dword [sym.imp.MSVCR90.dll_calloc]
add esp, 0x28
mov edi, eax
push esi
test edi, edi
jne 0x47cbed
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
pop edi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
push 1
push edi
call dword [sym.imp.MSVCR90.dll_fread]
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x14
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop ebp
pop ebx
ret
Function at 0x4849b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_fread]
push ebp
push esi
push edi
push 1
lea eax, [esp + 0x17]
push 1
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x4849d9
movzx esi, byte [esp + 0xf]
xor eax, eax
jmp 0x4849eb
push edi
call dword [sym.imp.MSVCR90.dll_ferror]
mov esi, dword [esp + 0x14]
add esp, 4
neg eax
sbb eax, eax
mov ebp, esi
test eax, eax
jne 0x484a2f
push edi
push 1
lea ecx, [esp + 0x17]
push 1
push ecx
call ebx
add esp, 0x10
cmp eax, 1
jne 0x484a1e
movzx esi, byte [esp + 0xf]
mov edx, dword [esp + 0x18]
shl esi, 8
xor eax, eax
add esi, ebp
mov dword [edx], esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push edi
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
test eax, eax
je 0x484a0a
or eax, 0xffffffff
mov ecx, dword [esp + 0x18]
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
add esp, 8
ret

Function at 0x484a40
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCR90.dll_fread]
push esi
push edi
push 1
lea eax, [esp + 0x17]
push 1
push eax
call ebp
add esp, 0x10
cmp eax, 1
jne 0x484a69
movzx esi, byte [esp + 0xf]
xor eax, eax
jmp 0x484a7b
push edi
call dword [sym.imp.MSVCR90.dll_ferror]
mov esi, dword [esp + 0x14]
add esp, 4
neg eax
sbb eax, eax
mov ebx, esi
test eax, eax
jne 0x484aac
push edi
push 1
lea ecx, [esp + 0x17]
push 1
push ecx
call ebp
add esp, 0x10
cmp eax, 1
jne 0x484a9e
movzx esi, byte [esp + 0xf]
xor eax, eax
jmp 0x484aac
push edi
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
neg eax
sbb eax, eax
mov edx, esi
shl edx, 8
add ebx, edx
test eax, eax
jne 0x484ae2
push edi
push 1
lea eax, [esp + 0x17]
push 1
push eax
call ebp
add esp, 0x10
cmp eax, 1
jne 0x484ad4
movzx esi, byte [esp + 0xf]
xor eax, eax
jmp 0x484ae2
push edi
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
neg eax
sbb eax, eax
mov ecx, esi
shl ecx, 0x10
add ebx, ecx
test eax, eax
jne 0x484b2b
push edi
push 1
lea edx, [esp + 0x17]
push 1
push edx
call ebp
add esp, 0x10
cmp eax, 1
jne 0x484b1a
movzx esi, byte [esp + 0xf]
mov ecx, dword [esp + 0x18]
shl esi, 0x18
xor eax, eax
add esi, ebx
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push edi
call dword [sym.imp.MSVCR90.dll_ferror]
add esp, 4
test eax, eax
je 0x484b06
or eax, 0xffffffff
mov edx, dword [esp + 0x18]
pop esi
pop ebp
mov dword [edx], 0
pop ebx
add esp, 8
ret
Function at 0x484b90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
push 2
push 0
mov ebp, 0xffff
push esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
test eax, eax
je 0x484bc4
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
push edi
push esi
call dword [sym.imp.MSVCR90.dll_ftell]
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
cmp edi, ebp
jae 0x484bdf
mov dword [esp + 0xc], edi
mov ebp, eax
push 0x404
call dword [sym.imp.MSVCR90.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x484bfa
pop edi
pop esi
pop ebp
add esp, 0xc
ret
push ebx
mov ebx, 4
cmp ebp, ebx
jbe 0x484ca4
jmp 0x484c18
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
lea eax, [ebx + 0x400]
mov ebx, ebp
cmp eax, ebp
ja 0x484c26
mov ebx, eax
mov ebp, edi
sub ebp, ebx
mov eax, edi
sub eax, ebp
mov edi, 0x404
cmp eax, 0x404
ja 0x484c3c
mov edi, eax
mov eax, dword [esp + 0x20]
push 0
push ebp
push eax
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x484ca4
mov ecx, dword [esp + 0x20]
push ecx
push 1
push edi
push esi
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x484ca4
lea eax, [edi - 3]
test eax, eax
jle 0x484c9a
nop
dec eax
cmp byte [eax + esi], 0x50
jne 0x484c8c
cmp byte [eax + esi + 1], 0x4b
jne 0x484c8c
cmp byte [eax + esi + 2], 5
jne 0x484c8c
cmp byte [eax + esi + 3], 6
je 0x484c92
test eax, eax
jg 0x484c70
jmp 0x484c9a
add eax, ebp
mov dword [esp + 0x14], eax
jne 0x484ca4
cmp ebx, dword [esp + 0x10]
jb 0x484c10
push esi
call dword [sym.imp.MSVCR90.dll_free]
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x485550
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
test eax, eax
jne 0x48556f
mov eax, 0xffffff9a
add esp, 8
ret
push esi
mov esi, dword [eax + 0x7c]
test esi, esi
jne 0x48557f
lea eax, [esi - 0x66]
pop esi
add esp, 8
ret
cmp dword [esi], 0
jne 0x48558e
mov eax, 0xffffff9c
pop esi
add esp, 8
ret
test ecx, ecx
jne 0x485599
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x14], ecx
cmp ecx, eax
jbe 0x4855ad
mov dword [esi + 0x14], eax
cmp dword [esi + 0x14], 0
push ebx
push ebp
push edi
jbe 0x4856cd
lea ebx, [ebx]
cmp dword [esi + 8], 0
jne 0x485628
mov eax, dword [esi + 0x58]
test eax, eax
jbe 0x485628
mov edi, 0x4000
cmp eax, edi
jae 0x4855e0
mov edi, eax
test edi, edi
je 0x4856d9
mov ecx, dword [esi + 0x68]
add ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x60]
push 0
push ecx
push edx
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x4856e3
mov eax, dword [esi + 0x60]
mov ecx, dword [esi]
push eax
push 1
push edi
push ecx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4856e3
mov edx, dword [esi]
add dword [esi + 0x3c], edi
sub dword [esi + 0x58], edi
mov dword [esi + 4], edx
mov dword [esi + 8], edi
cmp dword [esi + 0x64], 0
jne 0x48567d
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 8]
cmp eax, edi
jae 0x48563a
mov edi, eax
xor eax, eax
test edi, edi
jbe 0x485651
mov ecx, dword [esi + 4]
mov cl, byte [eax + ecx]
mov edx, dword [esi + 0x10]
mov byte [eax + edx], cl
inc eax
cmp eax, edi
jb 0x485640
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x50]
push edi
push edx
push eax
call sub.zlib1.dll_crc32
sub dword [esi + 0x5c], edi
sub dword [esi + 8], edi
sub dword [esi + 0x14], edi
add dword [esi + 0x10], edi
add dword [esi + 4], edi
add dword [esi + 0x18], edi
add esp, 0xc
add dword [esp + 0x10], edi
mov dword [esi + 0x50], eax
jmp 0x4856bc
mov ebx, dword [esi + 0x18]
mov ebp, dword [esi + 0x10]
lea ecx, [esi + 4]
push 2
push ecx
call sub.zlib1.dll_inflate
mov edi, dword [esi + 0x18]
mov edx, dword [esi + 0x50]
sub edi, ebx
push edi
push ebp
push edx
mov dword [esp + 0x28], eax
call sub.zlib1.dll_crc32
sub dword [esi + 0x5c], edi
add dword [esp + 0x24], edi
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x28]
add esp, 0x14
cmp eax, 1
je 0x4856cd
test eax, eax
jne 0x4856ee
cmp dword [esi + 0x14], 0
ja 0x4855c0
cmp dword [esp + 0x14], 0
jne 0x4856ee
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 8
ret
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x4c95e0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4c9602
mov ecx, dword [esp + 0xc]
mov dword [eax + 0x44], ecx
mov edx, dword [esi + 0x70]
push 1
add edx, 4
push edx
call dword [sym.imp.MSVCR90.dll_longjmp]
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x10]
mov byte [esi + 6], al
cmp dword [ecx + 0x58], 0
je 0x4c9624
push eax
call fcn.004c9560
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 0x58]
push esi
call eax
add esp, 8
push 1
call dword [sym.imp.MSVCR90.dll_exit]
int3

Function at 0x4cd800
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, edi
shr eax, 5
inc eax
mov ebx, edi
mov ecx, edi
cmp edi, eax
jb 0x4cd83f
jmp 0x4cd820
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + ecx - 1]
mov esi, ebx
shl esi, 5
add edx, esi
mov esi, ebx
shr esi, 2
add edx, esi
sub ecx, eax
xor ebx, edx
cmp ecx, eax
jae 0x4cd820
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [eax]
dec ecx
and ecx, ebx
mov ebp, dword [edx + ecx*4]
test ebp, ebp
je 0x4cd8a7
cmp dword [ebp + 0xc], edi
jne 0x4cd8a0
mov esi, dword [esp + 0x18]
mov ecx, edi
lea edx, [ebp + 0x10]
cmp edi, 4
jb 0x4cd87c
mov eax, dword [esi]
cmp eax, dword [edx]
jne 0x4cd8a0
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x4cd868
test ecx, ecx
je 0x4cd8be
mov al, byte [edx]
cmp al, byte [esi]
jne 0x4cd8a0
cmp ecx, 1
jbe 0x4cd8be
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x4cd8a0
cmp ecx, 2
jbe 0x4cd8be
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x4cd8be
mov ebp, dword [ebp]
test ebp, ebp
jne 0x4cd855
mov edx, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x18]
push edx
call fcn.004cd760
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x10]
movzx edx, byte [ecx + 0x14]
mov al, byte [ebp + 5]
movzx ecx, al
not edx
and ecx, 3
test cl, dl
je 0x4cd8dd
xor al, 3
mov byte [ebp + 5], al
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x4d2530
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x500030]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x218]
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x14], eax
call fcn.004c6690
mov ebp, dword [sym.imp.MSVCR90.dll_fread]
add esp, 8
mov esi, 0x200
lea ecx, [ecx]
lea edx, [esp + 0x10]
push edx
call fcn.004c6530
add esp, 4
cmp esi, edi
jbe 0x4d2583
mov esi, edi
push ebx
push esi
push 1
push eax
call ebp
add dword [esp + 0x20], eax
add esp, 0x10
sub edi, eax
je 0x4d2599
cmp eax, esi
je 0x4d2570
lea eax, [esp + 0x10]
push eax
call fcn.004c65d0
add esp, 4
test edi, edi
pop edi
pop esi
pop ebp
je 0x4d25d6
mov ecx, dword [esp]
push 0xffffffffffffffff
push ecx
call fcn.004c5440
add esp, 8
test eax, eax
ja 0x4d25d6
xor eax, eax
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004dc814
add esp, 0x214
ret
mov ecx, dword [esp + 0x210]
xor ecx, esp
mov eax, 1
call fcn.004dc814
add esp, 0x214
ret
Function at 0x4d28d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push ebx
push esi
push edi
mov ebx, eax
call fcn.004c4fd0
add esp, 4
sub eax, 1
mov esi, 1
je 0x4d2938
jmp 0x4d28f6
mov eax, dword [esp + 0x3c]
dec eax
push ebx
push edi
mov dword [esp + 0x44], eax
call fcn.004c51c0
add esp, 8
cmp eax, 3
jne 0x4d295a
test esi, esi
je 0x4d292e
push ebx
push edi
call fcn.004c5320
fstp qword [esp]
mov eax, dword [ebp + 8]
push str._.14g
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0x10
test eax, eax
jg 0x4d2988
xor esi, esi
inc ebx
cmp dword [esp + 0x3c], 0
jne 0x4d28f2
call dword [sym.imp.MSVCR90.dll__errno]
mov ebx, dword [eax]
test esi, esi
je 0x4d298f
push 1
push edi
call fcn.004c57b0
add esp, 8
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x38]
push ecx
push ebx
push edi
call fcn.004c6d50
add esp, 0xc
test esi, esi
je 0x4d292e
mov edx, dword [ebp + 8]
mov ecx, dword [esp + 0x38]
push edx
push ecx
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, dword [esp + 0x38]
jne 0x4d292e
mov esi, 1
jmp 0x4d2930
push edi
call fcn.004c55a0
push ebx
call dword [sym.imp.MSVCR90.dll_strerror]
push eax
push 0x4f15dc
push edi
call fcn.004c56e0
push ebx
push edi
call fcn.004c55e0
add esp, 0x1c
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4dc814
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x500030]
jne 0x4dc81e
repz ret
jmp fcn.004dcd7e
Function at 0x4dcf80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x500030]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
push 0x5c
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.MSVCR90.dll_strrchr]
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4dcfbd
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4dcfe0
push 0x2f
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.MSVCR90.dll_strrchr]
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4dcfe0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 4], ecx
push 0x2e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR90.dll_strrchr]
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4dd009
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
mov dword [ebp - 8], eax
jmp 0x4dd012
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 1
call fcn.004dd710
mov dword [ebp - 0x18], esp
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x4dd036
call fcn.004dd110
jmp 0x4dd0c5
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.SDL.dll_SDL_strlcpy
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
push 0x100000
call sub.SDL.dll_SDL_Init
add esp, 4
test eax, eax
jge 0x4dd07b
call sub.SDL.dll_SDL_GetError
push eax
push str.WinMain___error
call fcn.004dd0e0
add esp, 8
xor eax, eax
jmp 0x4dd0c5
push 0x4dd140
call fcn.004dca6f
add esp, 4
push 0x4dd130
call fcn.004dca6f
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call sub.SDL.dll_SDL_SetModuleHandle
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00421500
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR90.dll_exit]
xor eax, eax
lea esp, [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004dc814
mov esp, ebp
pop ebp
ret
Function at 0x4dd240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x500030]
xor eax, ebp
mov dword [ebp - 0x20], eax
push str.DDRAW.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4dd26e
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.SDL_STDIO_REDIRECT
call sub.SDL.dll_SDL_getenv
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4dd29c
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.MSVCR90.dll_atoi]
add esp, 4
test eax, eax
je 0x4dd29a
call fcn.004dd550
jmp 0x4dd2a1
call fcn.004dd550
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call sub.MSVCR90.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.004dd710
mov dword [ebp - 0x24], esp
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4dd2da
call fcn.004dd110
jmp 0x4dd346
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.SDL.dll_SDL_strlcpy
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004dd360
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
lea eax, [edx*4 + 4]
call fcn.004dd710
mov dword [ebp - 0x28], esp
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4dd324
call fcn.004dd110
jmp 0x4dd346
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.004dd360
add esp, 8
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004dcf80
add esp, 8
xor eax, eax
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004dc814
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401280
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442ea3
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x459054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x60], 0x33007b
xor eax, eax
mov dword [ebp - 0x5c], 0x340037
mov word [ebp - 0x14], ax
mov dword [ebp - 0x68], eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x58], 0x310031
lea edx, [eax + 2]
mov dword [ebp - 0x54], 0x380044
mov dword [ebp - 0x50], 0x2d0044
mov dword [ebp - 0x4c], 0x370044
mov dword [ebp - 0x48], 0x410036
mov dword [ebp - 0x44], 0x34002d
mov dword [ebp - 0x40], 0x380046
mov dword [ebp - 0x3c], 0x2d0033
mov dword [ebp - 0x38], 0x300042
mov dword [ebp - 0x34], 0x300037
mov dword [ebp - 0x30], 0x45002d
mov dword [ebp - 0x2c], 0x450035
mov dword [ebp - 0x28], 0x350032
mov dword [ebp - 0x24], 0x300044
mov dword [ebp - 0x20], 0x370035
mov dword [ebp - 0x1c], 0x340030
mov dword [ebp - 0x18], 0x7d0038
mov dword [ebp - 0x64], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401351
sub eax, edx
lea ecx, [ebp - 0x78]
sar eax, 1
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00401e60
push 1
push 0x445360
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 0
call fcn.00401c10
lea eax, [ebp - 0x90]
push 2
push eax
call fcn.00402070
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.00401b00
mov eax, dword [ebp - 0x7c]
cmp eax, 8
jb 0x4013c0
inc eax
lea ecx, [ebp - 0x90]
push eax
push dword [ebp - 0x90]
call fcn.00401f60
cmp dword [ebp - 0x64], 8
lea eax, [ebp - 0x78]
cmovae eax, dword [ebp - 0x78]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4013fb
push dword [edi + 8]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], 0
mov ecx, dword [ebp - 0x64]
cmp ecx, 8
jb 0x401410
inc ecx
push ecx
push dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
call fcn.00401f60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424ea2
mov esp, ebp
pop ebp
ret

Function at 0x401870
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0xc]
call fcn.00407490
mov eax, dword [esi + 8]
test eax, eax
je 0x40189b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
call fcn.00401690
mov ecx, eax
call fcn.00408d70
call fcn.00401570
mov ecx, eax
pop esi
jmp fcn.00408d70