joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479a20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x4f4008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x40c]
push esi
push edi
mov edi, ecx
push dword [edi + 8]
push str._04d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x4fc0fc]
add esp, 0xc
mov esi, dword [edi + 0x24]
add eax, 0x9a0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x40c]
mov edx, ebx
push 0x4dac44
push eax
push 0
push esi
lea ecx, [ebp - 0x20c]
call fcn.0048a950
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x479aed
mov eax, dword [0x4fc0fc]
mov esi, dword [edi + 0x24]
add eax, 0x9a0
push eax
lea eax, [ebp - 0x20c]
mov dword [0x4fc0e8], 1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x40c]
mov edx, ebx
push 0x4dac44
push eax
push 0
push esi
lea ecx, [ebp - 0x20c]
call fcn.0048a950
add esp, 0x14
mov dword [0x4fc0e8], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495852
mov esp, ebp
pop ebp
ret 8
Function at 0x479ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov esi, ecx
push ebx
mov dword [ebp - 4], esi
call fcn.00479e10
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x479f1f
push edi
push dword [esi + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push ebx
mov edi, eax
call esi
add edi, eax
cmp edi, 0xfa
pop edi
jge 0x479f1f
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push ebx
mov dword [0x4fc0e8], 1
call fcn.00479e10
mov dword [0x4fc0e8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x489be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4f4008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x50937c]
cmp dword [eax + 0xc], 0
je 0x489c27
push ecx
lea eax, [ebp - 0x404]
push 0x4d6770
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x404]
call fcn.0044b320
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495852
mov esp, ebp
pop ebp
ret

Function at 0x48ac70
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x4f4008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x509164], 0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov edi, ecx
mov dword [ebp - 0x81c], edi
je 0x48acdd
lea eax, [ebp - 0x818]
push eax
push 0
push 0
push 0x4bf480
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push str.SRPG_Studio
push dword [ebp - 0x818]
lea eax, [ebp - 0x20c]
push 0x4d4fd0
push eax
call esi
add esp, 0x10
push dword [ebp - 0x818]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x48acf5
mov eax, dword [0x4fc0fc]
add eax, 0x9a0
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48ad16
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.error_log.txt
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x4d4fd0
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x48ae05
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
call edi
mov esi, eax
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
push esi
mov esi, eax
mov dword [ebp - 0x818], eax
push esi
push 0xffffffffffffffff
push dword [ebp - 0x81c]
push 0
push 0
call edi
push esi
lea eax, [ebp - 0x814]
push str._s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x820]
push 0
push eax
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x48adfe
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495852
mov esp, ebp
pop ebp
ret
Function at 0x48af90
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4f4008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 1
mov eax, ecx
mov edi, edx
push SysReAllocString
push eax
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x410], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x48afe7
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495852
mov esp, ebp
pop ebp
ret
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea esi, [eax + 1]
cmp esi, 1
jne 0x48b003
mov dword [edi], 0
xor esi, esi
jmp 0x48b06f
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
mov edi, eax
lea eax, [ebp - 0x40c]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
mov byte [edi + esi - 1], 0
push dword [ebp - 0x40c]
push edi
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
mov edx, dword [ebp - 0x408]
test eax, eax
je 0x48b04e
mov dword [edx], edi
mov esi, 1
jmp 0x48b0a9
mov ecx, edi
call fcn.0048ae20
mov esi, eax
test edi, edi
je 0x48b06b
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jne 0x48b0a9
push dword [ebp - 0x410]
lea eax, [ebp - 0x404]
push 0x4db010
push str._s_n_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x404]
push 0x30
push str.SRPG_Studio
push eax
push dword [0x4fbff4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00495852
mov esp, ebp
pop ebp
ret
Function at 0x48b110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x4f4008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
push str.info.ini
push eax
lea eax, [ebp - 0x814]
mov dword [ebp - 0x818], ebx
push 0x4d4fd0
push eax
mov dword [ebp - 0x81c], edi
call esi
add esp, 0x10
lea eax, [ebp - 0x404]
cmp dword [ebx], 0
je 0x48b169
push str.RuntimeOrder
jmp 0x48b16e
push str.OriginalOrder
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
lea eax, [ebp - 0x204]
xor ebx, ebx
push 0x4c44b4
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push 0x100
lea eax, [ebp - 0x60c]
push eax
push ebx
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x48b296
nop word [eax + eax]
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov esi, eax
mov dword [esi + 8], ebx
mov edx, dword [edi + 4]
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x48b1de
mov edx, ecx
mov ecx, dword [edx + 4]
test ecx, ecx
jne 0x48b1d5
mov eax, dword [ebp - 0x818]
mov dword [edx + 4], esi
mov eax, dword [eax]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x60c]
push eax
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x48b24b
lea eax, [eax*2 + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
lea eax, [ebp - 0x60c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x48b242
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0xc], edi
mov edi, dword [ebp - 0x81c]
inc ebx
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0x204]
push 0x4c44b4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
push 0x100
lea eax, [ebp - 0x60c]
push eax
push 0
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x48b1c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495852
mov esp, ebp
pop ebp
ret 8
Function at 0x48b540
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x888
mov eax, dword [0x4f4008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov dword [ebp - 0x878], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x884], esi
cmp word [edi], 0
mov dword [ebp - 0x880], eax
jne 0x48b589
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x48b5a0
push edi
push eax
lea eax, [ebp - 0x214]
push 0x4d4fd0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x4d573c
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov dword [ebp - 0x87c], eax
push 0x4d5744
lea eax, [ebp - 0x848]
push eax
call ebx
test eax, eax
je 0x48b73a
push 0x4d574c
lea eax, [ebp - 0x848]
push eax
call ebx
test eax, eax
je 0x48b73a
test byte [ebp - 0x874], 0x10
lea eax, [ebp - 0x848]
je 0x48b652
cmp word [edi], 0
push eax
lea eax, [ebp - 0x624]
jne 0x48b623
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x48b633
push edi
push 0x4d4fd0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x624]
mov ecx, esi
push eax
push dword [ebp - 0x880]
push dword [ebp - 0x878]
call fcn.0048b540
jmp 0x48b73a
push str.Thumbs.db
push eax
call ebx
test eax, eax
je 0x48b73a
push str.desktop.ini
lea eax, [ebp - 0x848]
push eax
call ebx
test eax, eax
je 0x48b73a
cmp word [edi], 0
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x41c]
jne 0x48b694
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x48b6a4
push edi
push 0x4d4fd0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x878]
mov esi, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax]
mov ebx, eax
mov eax, dword [ebp - 0x878]
mov dword [ebx + 8], esi
mov edx, dword [eax + 4]
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x48b6cf
mov edx, ecx
mov ecx, dword [edx + 4]
test ecx, ecx
jne 0x48b6c6
lea eax, [ebp - 0x41c]
mov dword [edx + 4], ebx
push eax
mov dword [ebx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x48b72b
lea eax, [eax*2 + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
lea eax, [ebp - 0x41c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x48b728
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebx + 0xc], esi
mov esi, dword [ebp - 0x884]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
inc dword [esi + 4]
lea eax, [ebp - 0x874]
push eax
push dword [ebp - 0x87c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x48b5d2
push dword [ebp - 0x87c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495852
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48c6e0
Capabilities:
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 8
mov esi, ecx
call fcn.00495860
add esp, 4
mov edi, eax
push dword [ebp + 8]
mov dword [edi], vtable.CCryptKey.0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [esi + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8003
push esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x48c75f
push 0
push dword [ebp - 8]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp dword [ebp + 0xc], 0xffffffff
lea eax, [edi + 4]
push eax
push 0
push dword [ebp - 4]
mov ecx, 0x6602
mov eax, 0x6801
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x48c770
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push edi
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ecx
push 0
push 1
push 0
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 4]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
push edi
call fcn.0049a220
add esp, 0xc
lea eax, [ebp + 0xc]
push dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push edi
push 0
push 1
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
pop edi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x48c7f0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push dword [ebp + 8]
mov edi, eax
push edi
call fcn.0049a220
add esp, 0xc
mov dword [ebp + 0xc], esi
lea eax, [ebp + 0xc]
push eax
push edi
push 0
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [ecx], edi
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [edx], ecx
pop ebx
pop ebp
ret 0x10

Function at 0x48c9c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push 0
push 0x4bf480
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push str.SRPG_Studio
push dword [ebp - 4]
push 0x4d4fd0
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48d600
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4f4008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x4bf480
mov dword [edi + 0x70c], 0
mov dword [edi + 0x710], 0
mov dword [edi + 0x714], 0
mov dword [edi + 0x718], 0
mov dword [edi + 0x71c], 0
mov dword [edi + 0x720], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x428]
push str.SRPG_Studio
push dword [ebp - 0x14]
push 0x4d4fd0
push eax
call esi
add esp, 0x10
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.gamemenu.dat
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push 0x4d4fd0
push eax
call esi
add esp, 0x10
lea ecx, [ebp - 0x220]
xor edx, edx
call fcn.004919e0
mov edx, eax
test edx, edx
jne 0x48d6d0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495852
mov esp, ebp
pop ebp
ret
mov ecx, dword [edx + 4]
mov esi, dword [edx]
mov eax, dword [esi + ecx + 4]
mov ebx, dword [esi + ecx]
mov dword [ebp - 0x14], eax
lea eax, [ecx + 8]
mov dword [edx + 4], eax
movq xmm0, qword [str.SMNU]
movzx eax, bl
movq qword [ebp - 0x18], xmm0
cmp ax, word [ebp - 0x18]
jne 0x48d729
mov eax, ebx
shr eax, 8
movzx ecx, al
mov eax, dword [ebp - 0x18]
shr eax, 0x10
cmp cx, ax
jne 0x48d729
mov eax, ebx
shr eax, 0x10
movzx eax, al
cmp ax, word [ebp - 0x14]
jne 0x48d729
mov eax, dword [ebp - 0x14]
shr ebx, 0x18
shr eax, 0x10
cmp ebx, eax
je 0x48d741
mov ecx, edx
call fcn.00491aa0
xor edx, edx
lea ecx, [ebp - 0x220]
call fcn.004919e0
mov edx, eax
mov esi, dword [edx]
mov eax, dword [edx + 4]
mov eax, dword [esi + eax]
mov dword [edi + 0x70c], eax
add dword [edx + 4], 4
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [0x4fc0f8]
mov eax, dword [ecx + eax]
mov dword [edi + 0x710], eax
add dword [edx + 4], 4
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [edi + 0x714], eax
add dword [edx + 4], 4
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [edi + 0x718], eax
mov ecx, dword [edx + 4]
add ecx, 4
mov dword [edx + 4], ecx
cmp esi, 0x43d
jl 0x48d7ac
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [edi + 0x71c], eax
add dword [edx + 4], 4
mov ecx, dword [edx + 4]
cmp esi, 0x491
jl 0x48d7c3
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [edi + 0x720], eax
add dword [edx + 4], 4
mov ecx, edx
call fcn.00491aa0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495852
mov esp, ebp
pop ebp
ret
Function at 0x48d840
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4f4008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
call fcn.0048d7e0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0xbac], eax
cmp eax, 0xffffffff
jne 0x48d897
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495852
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
push 0
push 0
push 4
push eax
mov dword [edi + 0xbb0], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [edi + 0xbb4], esi
movq xmm0, qword [str.SRTS]
movq qword [ebp - 0x10], xmm0
movzx ecx, byte [esi]
cmp cx, word [ebp - 0x10]
jne 0x48d963
mov ecx, dword [ebp - 0x10]
movzx eax, byte [esi + 1]
shr ecx, 0x10
cmp ax, cx
jne 0x48d963
movzx eax, byte [esi + 2]
cmp ax, word [ebp - 0xc]
jne 0x48d963
mov ecx, dword [ebp - 0xc]
movzx eax, byte [esi + 3]
shr ecx, 0x10
cmp ax, cx
jne 0x48d963
push 1
lea eax, [edi + 0x4c8]
push eax
lea eax, [esi + 0xc]
push eax
push esi
call fcn.0048df50
push 1
lea eax, [edi + 0x510]
push eax
lea eax, [esi + 0x4c]
push eax
push dword [edi + 0xbb4]
call fcn.0048dbc0
push 1
lea eax, [edi + 0x554]
push eax
lea eax, [esi + 0x54]
push eax
push dword [edi + 0xbb4]
call fcn.0048dd80
mov esi, 1
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495852
mov esp, ebp
pop ebp
ret 4
push str.runtime.rts
lea eax, [ebp - 0x210]
xor esi, esi
push 0x4dc9a8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x30
push str.SRPG_Studio
push eax
push dword [0x4fbff4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00495852
mov esp, ebp
pop ebp
ret 4
Function at 0x490e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4f4008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x58c19454
mov al, 0x49
mov dword [ebp - 0x10], 0x1b924cf4
mov dword [ebp - 0xc], 0x3a9ee0ad
mov dword [ebp - 8], 0x92c9d149
push esi
cmp edx, 1
jne 0x490eca
mov byte [ebp - 0xa], 0x8e
jmp 0x490edb
cmp edx, 2
movzx eax, al
mov esi, 0x48
cmove eax, esi
mov byte [ebp - 8], al
lea edx, [ebp - 5]
lea eax, [ecx + 0xf]
cmp ecx, edx
ja 0x490f12
lea edx, [ebp - 0x14]
cmp eax, edx
jb 0x490f12
mov esi, edx
mov edx, 0x10
sub esi, ecx
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x490ef5
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495852
mov esp, ebp
pop ebp
ret
movups xmm1, xmmword [ecx]
pop esi
movups xmm0, xmmword [ebp - 0x14]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00495852
mov esp, ebp
pop ebp
ret

Function at 0x491240
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x491271
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x50940c]
test eax, eax
jne 0x4912bf
mov ecx, dword [0x5093dc]
push 0xffffffffffffffff
push str.keyset
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [0x50940c], eax
push dword [ebp + 8]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp - 4]
push edi
push ebx
call dword [edx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret