joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4741bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x118]
push esi
sub esp, 0x240
mov dword [ebp - 0x22c], edx
mov edx, edi
mov esi, eax
call fcn.00473ea4
test eax, eax
jne 0x4741e9
xor eax, eax
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov edx, edi
mov eax, esi
call fcn.0047402c
test eax, eax
je 0x4741e0
mov eax, 0x20
mov dword [ebp - 0x234], eax
jmp 0x474210
mov esi, edi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [esi]
add esi, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x474220
test edx, 0x8080
jne 0x474245
shr edx, 0x10
add esi, 2
add dl, dl
sbb esi, 3
sub esi, edi
cmp esi, 3
jle 0x47426e
mov eax, str..lnk
mov dword [esp + 4], eax
lea eax, [edi + esi - 4]
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x47437f
mov eax, 0x6b6e6c2e
xor ecx, ecx
lea edx, [ebp - 0x228]
mov dword [esi + ebp - 0x118], eax
mov eax, edi
mov byte [esi + ebp - 0x114], cl
call fcn.00473ea4
test eax, eax
je 0x4743c0
lea edx, [ebp - 0x228]
mov eax, edi
call fcn.0047402c
test eax, eax
je 0x4743c0
mov dword [esp], edi
lea edx, [ebp - 0x228]
mov dword [esp + 4], edx
call sub.msvcrt.dll_strcpy
mov eax, 1
test eax, eax
je 0x4741e0
dec dword [ebp - 0x234]
cmp dword [ebp - 0x234], 0xffffffff
jne 0x474210
mov edx, 1
test edx, edx
je 0x4741e0
mov dword [esp], edi
call sub.KERNEL32.dll_GetFileAttributesA
mov edx, eax
sub esp, 4
xor eax, eax
cmp edx, 0xffffffff
setne al
xor esi, esi
mov dword [ebp - 0x230], eax
test eax, eax
je 0x474317
test dl, 0x10
je 0x474317
mov esi, 1
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x474351
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
test esi, esi
je 0x47435e
mov edx, dword [ebp - 0x22c]
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x22c]
mov word [eax + edx], 0x5c
test esi, esi
mov eax, 3
jne 0x4741e2
mov eax, dword [ebp - 0x230]
test eax, eax
setne dl
xor eax, eax
test esi, esi
sete al
and eax, edx
cmp eax, 1
sbb eax, eax
add eax, 2
jmp 0x4741e2
lea edx, [ebp - 0x228]
mov eax, edi
call fcn.00473ea4
test eax, eax
je 0x4741e0
lea edx, [ebp - 0x228]
mov eax, edi
call fcn.0047402c
test eax, eax
je 0x4741e0
mov dword [esp], edi
lea eax, [ebp - 0x228]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
jmp 0x4742c4
xor edx, edx
mov byte [esi + ebp - 0x118], dl
jmp 0x4742df
Function at 0x474cc0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, eax
mov eax, dword [0x507fb4]
cmp eax, 0xffffffff
je 0x474d30
test eax, eax
je 0x474ceb
cmp dword [0x507fb0], 0xffffffff
je 0x474d46
test eax, eax
jne 0x474d04
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.KERNEL32.dll_MoveFileA
sub esp, 8
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [0x507fb0]
test eax, eax
je 0x474ceb
mov dword [esp + 4], esi
mov edx, 1
mov dword [esp], edi
mov dword [esp + 8], edx
call eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
sub esp, 0xc
mov esp, ebp
pop ebp
ret
mov dword [esp], str.kernel32.dll
call sub.KERNEL32.dll_LoadLibraryA
mov dword [0x507fb4], eax
sub esp, 4
jmp 0x474cda
mov dword [esp], eax
mov ecx, str.MoveFileExA
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x507fb0], eax
mov eax, dword [0x507fb4]
sub esp, 8
jmp 0x474ce7

Function at 0x47ace8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push edi
mov eax, 0x120
push esi
sub esp, 0x20
mov dword [ebp - 0x14], edx
call fcn.004ea990
lea esi, [esp + 0x1f]
and esi, 0xfffffff0
test cl, cl
je 0x47ada0
mov byte [ebp - 0xc], cl
mov eax, 0x104
lea edi, [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0xc]
mov byte [ebp - 0xb], 0x3a
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0
mov dword [0x698fa0], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp], eax
call sub.KERNEL32.dll_GetFullPathNameA
sub esp, 0x10
test eax, eax
mov edx, eax
je 0x47ae2c
cmp eax, 0x104
jb 0x47adc6
lea eax, [eax + 0x1f]
and eax, 0xfffffff0
call fcn.004ea990
mov dword [0x698fa0], ebx
lea esi, [esp + 0x1f]
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], edi
and esi, 0xfffffff0
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetFullPathNameA
sub esp, 0x10
xor edi, edi
test eax, eax
mov dword [0x698fa0], edi
jne 0x47adce
jmp 0x47ae33
mov dword [0x698fa0], ebx
mov dword [esp + 4], esi
mov dword [esp], 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
test eax, eax
mov edx, eax
je 0x47ae2c
cmp eax, 0x104
jae 0x47ae00
xor ecx, ecx
mov dword [0x698fa0], ecx
mov dword [esp], esi
call fcn.004209f0
add eax, esi
cmp byte [eax - 1], 0x5c
je 0x47ade5
mov byte [eax], 0x5c
mov byte [eax + 1], 0
mov edx, dword [0x4f99d8]
mov eax, esi
call fcn.004757ac
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
lea eax, [eax + 0x1e]
and eax, 0xfffffff0
call fcn.004ea990
mov dword [0x698fa0], ebx
lea esi, [esp + 0x1f]
and esi, 0xfffffff0
mov dword [esp + 4], esi
mov dword [esp], edx
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
jmp 0x47ad88
xor eax, eax
mov dword [0x698fa0], eax
mov dword [esp], 0x503be1
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call fcn.004396a0
nop
Function at 0x47c658
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x30
mov esi, dword [ebx - 4]
mov eax, esi
call fcn.004768fc
mov edx, eax
mov eax, dword [esi + 0xf]
mov eax, dword [eax - 3]
and eax, 7
cmp eax, 3
je 0x47c795
mov dword [esp], edx
call fcn.00452100
mov edx, eax
mov eax, dword [edx + 3]
cmp al, 0x17
jne 0x47c69a
nop
mov edx, dword [edx + 7]
mov eax, dword [edx + 3]
cmp al, 0x17
je 0x47c690
mov edi, eax
shr edi, 0xa
cmp edx, 0x4fa001
je 0x47c7a9
movsx eax, al
lea ecx, [eax - 0x11]
sar ecx, 1
cmp ecx, 2
je 0x47c79e
lea eax, [edi*4 + 0x1e]
and eax, 0x3fffff0
call fcn.004ea990
lea esi, [esp + 0x27]
and esi, 0xfffffff0
test edi, edi
je 0x47c6fc
cmp ecx, 1
je 0x47c7f9
test ecx, ecx
jne 0x47c780
mov dword [esp + 8], edi
lea eax, [edx + 7]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0044c124
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp - 0x14]
mov edx, dword [0x4f99d8]
mov dword [esp + 4], eax
lea esi, [eax + edi*4]
mov dword [esp + 8], esi
mov eax, dword [0x4f99d8]
mov dword [esp], eax
call dword [edx + 0x1f]
lea edx, [eax + 0x1f]
mov ecx, eax
and edx, 0xfffffff0
mov eax, edx
call fcn.004ea990
mov eax, dword [ebp - 0x14]
lea edi, [esp + 0x27]
and edi, 0xfffffff0
mov dword [ebp - 0xc], edi
lea ecx, [edi + ecx]
mov edx, dword [0x4f99d8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x10]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov eax, dword [0x4f99d8]
mov dword [esp], eax
call dword [edx + 0x23]
cmp dword [ebp - 0x10], esi
jne 0x47c780
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
je 0x47c7c0
mov dword [esp], str.c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_pathname.d
mov ecx, 0x1681
mov dword [esp + 4], ecx
call fcn.00420a64
sub ebx, 4
dec edx
jmp 0x47c67e
add edx, 7
mov dword [ebp - 0x14], edx
jmp 0x47c6ff
mov dword [ebp - 0x14], 0
test edi, edi
je 0x47c6ff
call fcn.0042a998
lea esi, [esi]
mov byte [eax], 0
mov dword [0x698fa0], ebx
mov dword [esp], edi
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
test eax, eax
je 0x47c811
xor eax, eax
mov dword [0x698fa0], eax
mov eax, dword [ebx - 4]
mov esp, dword [ebp - 0x18]
mov eax, dword [eax + 0xb]
mov dword [0x4f9da4], eax
call fcn.00476d24
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edi
lea eax, [edx + 7]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0044c194
jmp 0x47c6fc
mov eax, dword [ebx - 4]
xor edx, edx
mov dword [0x698fa0], edx
mov dword [esp], 0x503be1
mov dword [esp + 4], eax
call fcn.004396a0
push ebp
sub ebx, 4
mov ebp, esp
sub esp, 8
mov eax, dword [ebx]
call fcn.004755d0
call fcn.00476b8c
mov dword [0x698da0], eax
mov eax, 1
mov dword [0x699010], eax
leave
ret
Function at 0x47c8c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x30
mov edx, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 3]
cmp al, 0x17
jne 0x47c8ea
lea esi, [esi]
mov edx, dword [edx + 7]
mov eax, dword [edx + 3]
cmp al, 0x17
je 0x47c8e0
mov edi, eax
shr edi, 0xa
cmp edx, 0x4fa001
je 0x47c9f0
movsx eax, al
lea ecx, [eax - 0x11]
sar ecx, 1
cmp ecx, 2
je 0x47c9e5
lea eax, [edi*4 + 0x1e]
and eax, 0x3fffff0
call fcn.004ea990
lea esi, [esp + 0x27]
and esi, 0xfffffff0
test edi, edi
je 0x47c94c
cmp ecx, 1
je 0x47ca3d
test ecx, ecx
jne 0x47c9d0
mov dword [esp + 8], edi
lea eax, [edx + 7]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0044c124
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esp
mov eax, dword [ebp - 0x18]
mov edx, dword [0x4f99d8]
mov dword [esp + 4], eax
lea esi, [eax + edi*4]
mov dword [esp + 8], esi
mov eax, dword [0x4f99d8]
mov dword [esp], eax
call dword [edx + 0x1f]
lea edx, [eax + 0x1f]
mov ecx, eax
and edx, 0xfffffff0
mov eax, edx
call fcn.004ea990
mov edx, dword [ebp - 0x18]
lea edi, [esp + 0x27]
and edi, 0xfffffff0
mov dword [ebp - 0xc], edi
lea ecx, [edi + ecx]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov edx, dword [0x4f99d8]
mov dword [ebp - 0x20], ecx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x10]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov eax, dword [0x4f99d8]
mov dword [esp], eax
call dword [edx + 0x23]
cmp dword [ebp - 0x10], esi
jne 0x47c9d0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
je 0x47ca04
mov dword [esp], str.c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_pathname.d
mov ecx, 0x16ce
mov dword [esp + 4], ecx
call fcn.00420a64
add edx, 7
mov dword [ebp - 0x18], edx
jmp 0x47c94f
mov dword [ebp - 0x18], 0
test edi, edi
je 0x47c94f
call fcn.0042a998
mov byte [eax], 0
mov dword [0x698fa0], ebx
mov dword [esp], edi
call sub.KERNEL32.dll_GetFileAttributesA
mov edx, dword [ebp - 0x14]
sub esp, 4
mov dword [edx + 8], eax
xor edx, edx
mov dword [0x698fa0], edx
xor edx, edx
inc eax
je 0x47ca55
test edx, edx
sete al
movzx eax, al
mov esp, dword [ebp - 0x1c]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edi
lea eax, [edx + 7]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0044c194
jmp 0x47c94c
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x47ca73
call sub.KERNEL32.dll_GetLastError
cmp eax, 3
je 0x47ca73
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x35
jne 0x47ca7a
mov edx, 0xffffffff
jmp 0x47ca2b
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov eax, dword [eax]
mov dword [esp], 0x503be1
mov dword [esp + 4], eax
call fcn.004396a0
lea esi, [esi]
Function at 0x47cac8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov esi, eax
movzx eax, byte [ebp + 8]
mov byte [ebp - 5], dl
mov byte [ebp - 6], al
mov eax, dword [esi]
mov eax, dword [eax]
call fcn.004798d8
mov eax, dword [esi]
mov eax, dword [eax]
call fcn.0047ae48
cmp byte [ebp - 5], 0
mov edx, eax
mov eax, dword [esi]
mov dword [eax], edx
je 0x47cb02
cmp dword [edx + 0x13], 0x4fa001
je 0x47cb17
movzx eax, byte [ebp - 6]
xor edx, edx
mov dword [ebp + 8], eax
add esp, 0x14
mov eax, esi
pop esi
pop ebp
jmp fcn.0047c138
mov eax, edx
call fcn.0047c854
nop
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov edx, dword [ebx - 4]
mov eax, edx
and eax, 3
dec eax
je 0x47cbe0
mov dword [ebp - 0x14], 0
lea eax, [ebx - 4]
lea esi, [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, edx
mov dword [ebp - 0x10], 0
call fcn.00475748
call fcn.00476dc0
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
xor edx, edx
mov eax, esi
mov dword [esp], 0
call fcn.0047cac8
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
cmp dword [edx + 0x13], 0x4fa001
je 0x47cba4
mov eax, esi
call fcn.0047c8c4
test al, al
je 0x47cc04
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [0x698da0], eax
mov eax, 1
sub ebx, 4
mov dword [0x699010], eax
add esp, 0x24
pop esi
pop ebp
ret
cmp dword [edx + 0x17], 0x4fa001
je 0x47cb8a
mov dword [ebx], edx
lea edx, [ebx + 4]
mov eax, dword [edx - 4]
lea ebx, [edx + 4]
lea ebx, [edx + 8]
mov dword [edx], eax
mov eax, dword [0x6971f4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 6]
mov dword [edx + 4], eax
mov eax, str.S:_pathname_with_type_but_without_name_makes_no_sense:_S
mov dword [esp + 4], eax
mov dword [esp], 0x18
call fcn.004357dc
cmp byte [edx + 3], 0x26
jne 0x47cb36
mov eax, edx
call fcn.00475660
mov edx, eax
mov eax, dword [eax + 0x5b]
cmp eax, 0x4fa001
jne 0x47cb8c
mov eax, edx
call fcn.0047569c
call fcn.0047ca94
lea esi, [esi]

Function at 0x47cd0c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [esp + 4], edx
mov dword [0x698fa0], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
cmp eax, 0xffffffff
je 0x47cd44
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
sub esp, 4
test eax, eax
je 0x47cd6e
xor eax, eax
mov dword [0x698fa0], eax
leave
ret
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x47cd58
call sub.KERNEL32.dll_GetLastError
cmp eax, 3
jne 0x47cd64
xor eax, eax
mov dword [0x698fa0], eax
call fcn.0047ca94
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x35
je 0x47cd58
xor eax, eax
mov dword [0x698fa0], eax
mov eax, dword [ebx - 4]
mov dword [esp], 0x503be1
mov dword [esp + 4], eax
call fcn.004396a0
Function at 0x47cd88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x160
mov dword [0x698fa0], ebx
mov edi, dword [ebp + 8]
mov dword [esp + 4], edx
mov esi, edx
mov dword [esp], eax
call fcn.004743d0
test eax, eax
je 0x47ce92
mov dword [esp], esi
call sub.KERNEL32.dll_GetFileAttributesA
mov dword [ebp - 0x14c], eax
xor edx, edx
sub esp, 4
mov dword [0x698fa0], edx
inc eax
je 0x47ce57
mov eax, dword [ebp + 0xc]
or eax, edi
jne 0x47cdf0
xor eax, eax
test byte [ebp - 0x14c], 0x10
setne al
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
lea edx, [ebp - 0x148]
mov eax, esi
call fcn.0047cd0c
test edi, edi
je 0x47ce2b
mov eax, dword [ebp - 0x134]
test eax, eax
jne 0x47ce1b
mov esi, dword [ebp - 0x130]
lea eax, [ebp - 0x144]
test esi, esi
jne 0x47ce21
lea eax, [ebp - 0x134]
mov dword [esp], eax
call fcn.0049a828
mov dword [edi], eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x47cdd9
mov eax, dword [ebp - 0x128]
xor edi, edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x12c]
mov edx, eax
or edx, edi
mov dword [esp], edx
call fcn.00452768
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
jmp 0x47cdd9
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x47ce9a
call sub.KERNEL32.dll_GetLastError
cmp eax, 3
je 0x47ce9a
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x35
je 0x47ce9a
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7b
je 0x47ce9a
mov eax, dword [ebx - 4]
mov dword [esp], 0x503be1
mov dword [esp + 4], eax
call fcn.004396a0
xor edx, edx
mov dword [0x698fa0], edx
lea esp, [ebp - 8]
mov eax, 2
pop esi
pop edi
pop ebp
ret
Function at 0x48213c
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov esi, eax
movzx eax, byte [ebp + 0xc]
mov byte [ebp - 9], dl
mov edi, dword [ebp + 8]
mov dword [0x698fa0], ebx
mov byte [ebp - 0xa], al
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
test eax, eax
je 0x4821ed
cmp byte [ebp - 9], 0
jne 0x482192
cmp byte [ebp - 0xa], 0
jne 0x4821c0
xor eax, eax
mov dword [0x698fa0], eax
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
mov dword [esp], eax
call fcn.00481938
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test eax, eax
je 0x4821ed
cmp byte [ebp - 0xa], 0
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
je 0x482184
nop
lea esi, [esi]
mov eax, dword [edi]
mov dword [esp], eax
call fcn.00481938
mov esi, eax
mov eax, dword [edi]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test eax, eax
je 0x4821ed
mov dword [edi], esi
xor eax, eax
mov dword [0x698fa0], eax
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call fcn.00439640
nop

Function at 0x48386c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, ecx
and eax, 3
dec eax
je 0x4838c7
mov dword [ebx], ecx
lea eax, [ebx + 4]
lea ebx, [eax + 4]
mov dword [eax], ecx
mov eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x503fc1
call fcn.0044555c
mov edx, dword [0x698da0]
cmp edx, 0x502a01
je 0x483910
mov ecx, dword [ebx - 4]
mov dword [ebx - 4], edx
mov eax, ecx
call fcn.004830c4
lea eax, [ebx - 4]
mov ebx, eax
mov eax, dword [eax]
add esp, 0x14
pop esi
pop ebp
ret
cmp byte [ecx + 3], 0x26
jne 0x483880
movzx eax, byte [ecx + 8]
test al, 8
je 0x483917
and al, 0xf7
mov esi, dword [ecx + 0x27]
mov byte [ecx + 8], al
movzx eax, byte [ecx + 9]
cmp eax, 2
je 0x483928
jl 0x483909
cmp eax, 4
jg 0x483909
mov ecx, dword [ecx + 0x3f]
mov dword [ebx], ecx
lea eax, [ebx + 4]
mov ebx, eax
sub eax, 4
mov dword [esp], eax
call fcn.0048386c
cmp eax, esi
jne 0x483930
sub ebx, 4
mov eax, esi
jmp 0x4838c1
mov edx, 0x707f07bf
jmp 0x4838ad
mov dword [esp], esi
call dword [ecx + 0x1b]
mov ecx, dword [esi]
and byte [ecx + 8], 0xf7
mov dword [ecx + 0x27], eax
jmp 0x4838c1
mov eax, dword [ecx + 0x3f]
mov ecx, dword [eax + 1]
jmp 0x4838f0
mov dword [esp], str.c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_stream.d
mov edx, 0x2c4
mov dword [esp + 4], edx
call fcn.00420a64
lea esi, [esi]

Function at 0x483a42
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
xor eax, eax
call fcn.00483b82
Function at 0x483ad0
Capabilities:
Terminate process

Disassembly:
mov dword [esp], 0
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, eax
mov eax, dword [ebx + 0x1c]
test eax, eax
jbe 0x483b00
xor eax, eax
mov ecx, dword [ebx + 0x28]
mov esi, dword [ecx + eax]
mov dword [edx + eax], esi
mov edi, dword [ebx + 0x10]
add eax, edi
mov ecx, dword [ebx + 0x1c]
cmp eax, ecx
jb 0x483aeb
push eax
push eax
mov eax, dword [esp + 0xc]
call fcn.00483c7e
mov edi, eax
test edi, edi
je 0x483b73
lea esi, [esp]
push esi
mov esi, dword [ebx + 8]
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x1c]
push eax
push edx
push esi
call edi
mov edx, dword [ebx + 0x20]
add ebp, edx
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebp + 4]
cmp eax, 8
jbe 0x483b4b
push 8
pop eax
mov ecx, dword [ebp + eax]
add ecx, edx
mov dword [esi + eax], ecx
mov ecx, dword [ebx + 0x10]
add eax, ecx
mov ecx, dword [ebx + 0x2c]
cmp eax, ecx
jb 0x483b36
mov edx, dword [ebx + 0x14]
lea eax, [esp]
push eax
mov dword [esi + 8], edx
push dword [esp + 4]
mov ecx, dword [ebx + 0x2c]
push ecx
push esi
call edi
mov edx, dword [esi + 0xc]
add edx, esi
mov eax, dword [ebx + 0x38]
add edx, eax
mov ebx, dword [ebx + 0x38]
add esi, ebx
push esi
call edx
pop eax

Function at 0x483c7e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0xc
mov esi, eax
mov dword [esp], edx
test esi, esi
je 0x483cc9
mov ebp, dword [esi + 0x3c]
mov edx, dword [ebp + esi + 0x78]
mov dword [esp + 8], edx
mov ecx, dword [edx + esi + 0x18]
mov ebp, dword [edx + esi + 0x20]
add ebp, esi
mov dword [esp + 4], ecx
test ecx, ecx
jbe 0x483cc9
xor ebx, ebx
mov eax, dword [ebp + ebx*4]
push eax
push eax
add eax, esi
mov edx, dword [esp + 8]
call fcn.00483cfa
test al, al
jne 0x483ccd
inc ebx
cmp ebx, dword [esp + 4]
jb 0x483cad
xor eax, eax
jmp 0x483ce7
mov edx, dword [esp + 8]
mov ecx, dword [edx + esi + 0x24]
add ecx, esi
mov ebp, dword [edx + esi + 0x1c]
add ebp, esi
movzx ebx, word [ecx + ebx*2]
add esi, dword [ebp + ebx*4]
mov eax, esi
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
ret 8
Function at 0x4914e8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
sub esp, 0x20
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edx, esi
and eax, 0x3f
cmp eax, 7
je 0x491516
mov eax, esi
and eax, 3
dec eax
je 0x491556
mov dword [esp], esi
call fcn.00435e28
mov edx, eax
mov dword [esp], edx
call fcn.00452380
mov dword [ebp - 0xc], eax
mov eax, 4
mov esi, 0xffff
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.WS2_32.DLL_setsockopt
sub esp, 0x14
inc eax
je 0x49157f
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esi + 3]
cmp cl, 0x1a
jne 0x49150c
mov eax, ecx
shr eax, 8
test al, al
js 0x49150c
mov eax, ecx
shr eax, 0x10
cmp eax, 2
ja 0x49150c
cmp eax, 1
jbe 0x491516
mov eax, dword [esi + 7]
test eax, eax
je 0x491516
jmp 0x49150c
call fcn.00439640
Function at 0x494f10
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
cmp ebx, dword [0x699030]
ja 0x495140
mov dword [ebx], esi
mov eax, esi
and eax, 3
add ebx, 4
dec eax
je 0x494f66
mov dword [esp], 0x5040c1
mov ecx, 1
mov dword [esp + 4], ecx
call fcn.0044555c
xor eax, eax
cmp dword [0x698da0], 0x4fa001
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
setne al
mov esp, ebp
pop ebp
ret
cmp byte [esi + 3], 0x26
jne 0x494f38
movzx eax, byte [esi + 9]
cmp eax, 0x14
ja case.0x494f75.1
jmp dword [eax*4 + 0x568998]
xor edx, edx
lea eax, [ebx - 4]
test dl, dl
mov ebx, eax
mov esi, dword [eax]
je 0x494f94
and byte [esi + 8], 0xf7
mov dword [esi + 0x27], 0x4fa001
mov esi, dword [ebp - 8]
movzx eax, dl
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, esi
call fcn.00488f7c
mov dl, al
jmp 0x494f7e
mov eax, dword [esi + 0x4f]
mov eax, dword [eax + 7]
call fcn.00486c04
mov dword [ebx], esi
add ebx, 4
jmp 0x494fc9
lea eax, [ebx - 4]
mov dword [esp], eax
call fcn.0048386c
mov eax, dword [ebx - 4]
call fcn.0048d11c
test eax, eax
je 0x494fbe
sub ebx, 4
mov dl, 1
jmp 0x494f7e
mov dword [ebx], esi
mov edi, 1
add ebx, 4
mov dword [esp + 4], edi
mov esi, 1
mov dword [esp], 0x4f81e2
call fcn.0044555c
mov eax, dword [0x698da0]
mov dword [ebx], eax
add ebx, 4
mov dword [esp + 4], esi
mov dword [esp], 0x504201
call fcn.0044555c
cmp dword [0x698da0], 0x4fa001
setne dl
jmp 0x494f7e
mov edx, dword [esi + 0x4b]
mov eax, dword [esi + 0x4f]
cmp edx, eax
mov dword [esi + 0x4b], eax
setne dl
jmp 0x494f7e
mov edx, dword [esi + 0x3f]
xor ecx, ecx
mov eax, edx
and eax, 7
cmp eax, 3
je 0x495050
mov dl, cl
jmp 0x494f7e
mov eax, dword [edx - 3]
movzx esi, cl
mov dword [ebx], eax
mov eax, dword [edx + 1]
add ebx, 4
mov dword [esp], eax
call fcn.00494f10
movzx eax, al
or esi, eax
lea eax, [ebx - 4]
mov edx, dword [eax]
mov ebx, eax
setne cl
mov eax, edx
and eax, 7
cmp eax, 3
je 0x495050
jmp 0x495049
mov esi, dword [esi + 0x3f]
mov edx, dword [esi + 7]
mov eax, edx
and eax, 3
cmp eax, 1
je 0x495145
dec eax
mov edi, dword [0x4f9dcc]
je 0x4950ef
xor eax, eax
test al, al
je 0x495157
mov edx, dword [esi + 7]
mov dword [esp], edx
call fcn.00494f10
mov dl, al
jmp 0x494f7e
mov eax, dword [esi + 0x3f]
mov dword [esp], eax
call fcn.00494f10
jmp 0x4950b3
test byte [esi + 8], 0x40
je 0x4950d7
cmp byte [esi + 0x5f], 0
je case.0x494f75.14
cmp byte [esi + 0x9f], 0
mov byte [esi + 0x9f], 0
setne al
mov dl, al
jmp 0x494f7e
mov ecx, dword [edx + 3]
cmp cl, 0xff
je 0x495105
cmp cl, 0xfd
jne 0x49509e
mov eax, ecx
shr eax, 8
test al, al
jns 0x49509e
test ch, 1
mov eax, edx
je 0x495115
mov eax, dword [edx + 7]
test byte [eax + 4], 1
jne 0x49515e
mov eax, dword [eax + 7]
xor edx, edx
mov eax, dword [eax + 7]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x1f]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004d0ec0
test eax, eax
setne al
movzx eax, al
jmp 0x4950a0
call fcn.00426abc
cmp byte [edx + 3], 0x26
jne 0x495095
mov dword [esp], edx
jmp 0x4950ae
mov eax, esi
call fcn.0049210c
mov dword [esp], 0x567670
mov ecx, 0x3d3a
mov dword [esp + 4], ecx
call fcn.00420a64
nop