joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40f073
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
mov esi, dword [esp + 0x40]
mov edx, dword [esi]
push ecx
push edx
lea eax, [esp + 0xc]
push str._s._s
push eax
mov dword [esp + 0x48], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0x10
push esi
lea ecx, [esp + 0x10]
call fcn.0040bd50
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 1
call fcn.0040c630
test eax, eax
jne 0x40115e
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov esi, dword [esp + 0x4c]
push 0xffffffffffffffff
push 0
mov ecx, esi
call sub.MFC71.DLL_CStringArray::SetSize
lea ecx, [esp + 0x18]
call fcn.0040e318
mov ecx, dword [esp + 4]
push 0
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 2
call sub.MFC71.DLL_CFileFind::FindFile
test eax, eax
je 0x401254
push ebp
push edi
mov edi, dword [esp + 0x50]
lea esp, [esp]
lea ecx, [esp + 0x20]
call sub.MFC71.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x20]
mov ebp, eax
call sub.MFC71.DLL_CFileFind::IsDots
cmp eax, 1
je 0x40124a
mov edx, dword [esp + 0x20]
push 0x10
lea ecx, [esp + 0x24]
call dword [edx + 0x40]
cmp eax, 1
je 0x40124a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call sub.MFC71.DLL_CFileFind::GetFilePath
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 3
call fcn.0040bd50
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 5
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
cmp edi, 1
jne 0x40122b
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0040c180
mov ecx, dword [esi + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x48], 6
call sub.MFC71.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
jmp 0x40123b
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, esi
call sub.MFC71.DLL_CStringArray::SetAtGrow
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
test ebp, ebp
jne 0x4011a0
pop edi
pop ebp
lea ecx, [esp + 0x18]
call sub.MFC71.DLL_CFileFind::Close
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 1
call sub.MFC71.DLL_CFileFind::CFileFind
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x30]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x402e90
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x40f4c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
lea ecx, [esp]
call fcn.0040bd20
push str.SDD_HOME
mov dword [esp + 0x24], 0
call dword [sym.imp.MSVCR71.dll_getenv]
add esp, 4
test eax, eax
je 0x402f19
push eax
lea ecx, [esp + 0x10]
call dword [0x4101d8]
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.0040bd50
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x24], 2
call dword [0x410200]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp]
call fcn.0040c570
push str.commonwin32_bin_nse.bat
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Append_1]
lea ecx, [esp]
call fcn.0040c610
test eax, eax
jne 0x402f50
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
push esi
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
push edx
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
push ecx
mov ecx, dword [0x41323c]
push eax
push ecx
lea edx, [esp + 0x18]
push str.__nseid__s__execute__setattrib__owner_ICDBDXD__s__s__s_
push edx
mov byte [esp + 0x3c], 3
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0x18
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Append]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x10]
push 1
push eax
call fcn.00401010
add esp, 0x14
lea ecx, [esp + 8]
mov esi, eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x404300
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push esi
push edi
push 0x4110c8
xor edi, edi
push eax
mov dword [esp + 0x10], edi
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, eax
mov eax, dword [0x413174]
add esp, 8
cmp eax, edi
je 0x404344
push eax
call sub.MFC71.DLL_operator_delete_1
add esp, 4
mov dword [0x413174], edi
mov dword [0x41317c], edi
mov dword [0x413178], edi
cmp esi, edi
je 0x404444
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCR71.dll_fseek]
push 2
push edi
push esi
call ebp
mov ebx, dword [sym.imp.MSVCR71.dll_ftell]
push esi
call ebx
push 0
push 0
push esi
mov edi, eax
call ebp
inc edi
push edi
call sub.MFC71.DLL_operator_new
push esi
push 1
mov edi, eax
push 0x1c
push edi
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x30
cmp eax, 1
jne 0x40440d
push esi
push 0xffff
mov dword [0x413174], edi
add edi, 0x1c
push 4
push edi
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x10
cmp eax, 0xffff
jne 0x40440d
mov dword [0x41317c], edi
push esi
add edi, 0x3fffc
call ebx
push 2
push 0
push esi
mov dword [esp + 0x24], eax
call ebp
push esi
call ebx
mov ebx, eax
mov eax, dword [esp + 0x28]
push 0
push eax
push esi
sub ebx, eax
call ebp
push esi
push 1
push ebx
push edi
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x30
cmp eax, 1
jne 0x40440d
push esi
mov dword [0x413178], edi
mov dword [esp + 0x14], eax
call dword [sym.imp.MSVCR71.dll_fclose]
mov eax, dword [esp + 0x14]
add esp, 4
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
xor ebx, ebx
cmp edi, ebx
je 0x40441c
push edi
call sub.MFC71.DLL_operator_delete_1
add esp, 4
push esi
mov dword [0x413174], ebx
mov dword [0x413178], ebx
mov dword [0x41317c], ebx
call dword [sym.imp.MSVCR71.dll_fclose]
mov eax, dword [esp + 0x14]
add esp, 4
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
mov eax, edi
pop edi
pop esi
add esp, 8
ret
Function at 0x404f10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x620
mov eax, dword [0x413150]
xor eax, esp
push ebp
push esi
mov esi, dword [esp + 0x630]
lea ecx, [esp + 0x524]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x328]
push ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x630], eax
mov eax, dword [esp + 0x638]
push edx
push eax
xor ebp, ebp
call dword [sym.imp.MSVCR71.dll__splitpath]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.MSVCR71.dll__strlwr]
push str..ini
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x340]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.MSVCR71.dll__makepath]
push 0x411144
push esi
call dword [sym.imp.MSVCR71.dll_fopen]
add esp, 0x34
test eax, eax
je 0x4050b4
push eax
call dword [sym.imp.MSVCR71.dll_fclose]
mov al, byte [esi]
add esp, 4
test al, al
mov ebp, 1
jne 0x4050fd
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x120]
push str._s.ini
push edx
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
xor ebx, ebx
push edi
nop
test ebp, ebp
jne 0x4050e2
xor edi, edi
lea ebx, [ebx]
test ebp, ebp
jne 0x4050d6
mov ecx, dword [edi + 0x413058]
lea eax, [esp + 0x20]
push eax
push ecx
lea edx, [esp + 0x430]
push str._s_s
push edx
call dword [sym.imp.MSVCR71.dll_sprintf]
mov edx, dword [ebx + 0x413050]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebp
lea ecx, [esp + 0x434]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4050ca
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x228]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
push ebp
lea eax, [esp + 0x130]
push eax
push ecx
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4050bf
mov al, byte [esp + 0x224]
test al, al
je 0x4050bf
push ebp
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x22c]
push eax
push ebp
push esi
call dword [sym.imp.MSVCR71.dll__makepath]
push 0x411144
push esi
call dword [sym.imp.MSVCR71.dll_fopen]
add esp, 0x1c
test eax, eax
je 0x4050bc
push eax
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 4
mov ebp, 1
jmp 0x4050bf
mov byte [esi], 0
jmp 0x404fb0
mov byte [esi], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 4
cmp edi, 8
jb 0x404fe0
add ebx, 4
cmp ebx, 8
jb 0x404fd0
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0040e96e
add esp, 0x620
ret
mov ecx, dword [esp + 0x624]
pop esi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0040e96e
add esp, 0x620
ret
Function at 0x405270
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x134
mov eax, dword [0x413150]
xor eax, esp
push ebp
push esi
mov esi, dword [esp + 0x140]
mov dword [esp + 0x138], eax
mov eax, dword [esp + 0x144]
push 1
mov dword [esp + 0x14], eax
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push str.Lib_d
push ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
xor ebp, ebp
call dword [sym.imp.MSVCR71.dll_sprintf]
add esp, 0xc
push esi
push 0x104
lea edx, [esp + 0x3c]
push edx
push 0x410e72
lea eax, [esp + 0x24]
push eax
push str.Library_List
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4053b6
push ebx
push edi
push 0x214
call sub.MFC71.DLL_operator_new_1
mov esi, eax
or eax, 0xffffffff
mov dword [esi + 0x20c], eax
mov dword [esi + 0x208], eax
mov dword [esi + 0x204], eax
mov dword [esi + 0x200], eax
xor eax, eax
mov dword [esi + 0x210], 0
mov ecx, 0x40
mov edi, esi
rep stosd dword es:[edi], eax
push 0x100
lea ebx, [esi + 0x100]
mov ecx, 0x40
mov edi, ebx
push esi
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.004051d0
push 0x100
push ebx
push eax
lea edx, [esp + 0x5c]
push edx
call fcn.004051d0
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
add esp, 0x24
test ecx, ecx
jne 0x405361
mov dword [eax], esi
jmp 0x40536b
mov eax, dword [esp + 0x10]
mov dword [eax + 0x210], esi
inc ebp
movsx ecx, bp
inc ecx
push ecx
lea edx, [esp + 0x20]
push str.Lib_d
push edx
mov dword [esp + 0x1c], esi
call dword [sym.imp.MSVCR71.dll_sprintf]
mov eax, dword [esp + 0x20]
add esp, 0xc
push eax
push 0x104
lea ecx, [esp + 0x44]
push ecx
push 0x410e72
lea edx, [esp + 0x2c]
push edx
push str.Library_List
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x4052e3
pop edi
pop ebx
mov ecx, dword [esp + 0x138]
pop esi
mov ax, bp
pop ebp
xor ecx, esp
call fcn.0040e96e
add esp, 0x134
ret

Function at 0x405510
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x413150]
xor eax, esp
push esi
mov esi, dword [esp + 0x114]
push edi
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x114]
push eax
push 0x104
lea eax, [esp + 0x10]
push eax
push 0x410e72
push str.SystemDir
push str.directories
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jbe 0x4055a3
push edi
push str.padsfont.fnt
lea ecx, [esp + 0x10]
push ecx
push edi
push 0x104
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
call dword [sym.imp.MSVCR71.dll__makepath]
add esp, 0x14
push 0xffffffffffffffff
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::ReleaseBuffer]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0040e96e
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
mov ax, di
pop edi
pop esi
xor ecx, esp
call fcn.0040e96e
add esp, 0x108
ret
Function at 0x4057b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40f5f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [esp + 0xb0]
push ebp
push esi
push edi
xor edi, edi
push edi
push 1
push edi
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call sub.SLibs500.dll_public:_void___thiscall_SYS_Transform::constructor_class_SYS_Position_const___int__int__int_
mov ecx, dword [esp + 0xb4]
mov si, word [ecx + 6]
movsx edx, si
shl edx, 3
push edx
mov dword [esp + 0xb0], edi
call sub.MFC71.DLL_operator_new
mov ecx, 0xc069ec80
add esp, 4
cmp si, di
mov ebp, 0x3f961380
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
jle 0x4058aa
mov edi, eax
movzx eax, si
push ebx
mov ebx, dword [esp + 0xbc]
mov dword [esp + 0x24], eax
mov edi, edi
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
lea eax, [esp + 0x40]
mov dword [esp + 0x18], ecx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], edx
call sub.SLibs500.dll_public:_void___thiscall_SYS_Point::Transform_class_SYS_Transform_const__
mov ecx, dword [esp + 0x18]
mov dword [edi], ecx
mov edx, dword [esp + 0x1c]
mov eax, ecx
cmp ebp, eax
mov dword [edi + 4], edx
jl 0x405870
mov ebp, eax
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x20], ecx
jl 0x40587e
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x10], eax
jg 0x405888
mov dword [esp + 0x10], eax
cmp dword [esp + 0x14], ecx
jg 0x405892
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x24]
add ebx, 0xc
add edi, 8
dec eax
mov dword [esp + 0x24], eax
jne 0x405840
mov eax, dword [esp + 0x28]
xor edi, edi
pop ebx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x34], edx
push eax
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0xc8]
dec esi
push 1
mov word [esp + 0x34], di
mov word [esp + 0x36], si
mov dword [esp + 0x38], ebp
call fcn.00404730
mov eax, dword [esp + 0x24]
push eax
call sub.MFC71.DLL_operator_delete_1
add esp, 4
lea ecx, [esp + 0x3c]
mov dword [esp + 0xac], 0xffffffff
call sub.SLibs500.dll_public:_void___thiscall_SYS_Transform::destructor_void_
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0xa4
ret
Function at 0x408110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40f69c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
mov eax, dword [0x413150]
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
push edi
mov dword [esp + 0x13c], eax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push str.PowerPCB.Application
xor ebx, ebx
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
test eax, eax
jne 0x408253
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
xor edi, edi
push edx
mov dword [esp + 0x18], edi
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, edi
jne 0x408253
push str.CLSID_
lea ecx, [esp + 0x10]
call dword [0x4101d8]
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x150], edi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_3]
push str.LocalServer32
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push edi
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x408233
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
push 0x410e72
push eax
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x408228
lea ecx, [esp + 0x30]
push 0x20
push ecx
call dword [sym.imp.MSVCR71.dll__mbsrchr]
add esp, 8
cmp eax, edi
je 0x408228
mov byte [eax], 0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [esp + 0xc]
mov dword [esp + 0x14c], 0xffffffff
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov al, byte [esp + 0x30]
test al, al
je 0x408286
push 0x104
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer]
push eax
lea ecx, [esp + 0x34]
push ecx
call sym.PADSDecalBrowser.exe_int___cdecl_FindIniFile_char_const___char__
add esp, 8
push 0xffffffffffffffff
mov ecx, esi
mov ebx, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::ReleaseBuffer]
test ebx, ebx
jne 0x4082bc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x34]
push eax
push 0x104
push 0
push str.powerpcb.ini
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
je 0x4082bc
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call dword [0x4101d4]
mov eax, 1
jmp 0x4082be
mov eax, ebx
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e96e
mov esp, ebp
pop ebp
ret 4
Function at 0x40ad30
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
cmp edi, ebp
je 0x40ae4b
mov ecx, dword [esp + 0x18]
cmp ecx, 0x8028
jl 0x40ae4b
mov eax, dword [esp + 0x10]
lea esi, [eax + eax*8]
shl esi, 5
cmp dword [esi + 0x413360], ebp
je 0x40ad6c
pop edi
pop esi
mov eax, 0xf
pop ebp
ret
add ecx, 0xffffffe8
mov eax, 0x3ff801
mul ecx
shr edx, 4
cmp dx, bp
movsx eax, dx
lea eax, [edi + eax*8]
mov word [esi + 0x413352], 1
mov dword [esi + 0x413360], edi
mov dword [esi + 0x413364], eax
mov word [esi + 0x413354], dx
mov dword [esi + 0x413358], ebp
lea ecx, [eax + 0x18]
jle 0x40adc8
lea eax, [edi + 4]
movzx edx, dx
or edi, 0xffffffff
mov dword [eax], ecx
mov word [eax - 4], di
mov word [eax - 2], bp
add ecx, 0x4000
add eax, 8
dec edx
jne 0x40adb2
test byte [esi + 0x413351], 0x80
mov word [esi + 0x413356], bp
jne 0x40ae9c
mov ecx, dword [esi + 0x413248]
push ebp
push ebp
push ecx
call dword [sym.imp.MSVCR71.dll__lseek]
add esp, 0xc
test eax, eax
jge 0x40adfb
pop edi
pop esi
mov eax, 0xc
pop ebp
ret
mov edx, dword [esi + 0x413364]
mov eax, dword [esi + 0x413248]
push 0x18
push edx
push eax
call dword [sym.imp.MSVCR71.dll__read]
add esp, 0xc
cmp eax, 0x18
je 0x40ae22
pop edi
pop esi
mov eax, 5
pop ebp
ret
test byte [esi + 0x413350], 1
je 0x40ae36
mov ecx, dword [esi + 0x413364]
call fcn.0040ab80
mov ecx, dword [esi + 0x413364]
mov edx, dword [ecx + 0x10]
pop edi
mov dword [esi + 0x413358], edx
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [esp + 0x10]
lea esi, [eax + eax*8]
shl esi, 5
cmp dword [esi + 0x413360], ebp
je 0x40ae82
cmp word [esi + 0x413352], 2
jne 0x40ae72
push eax
call fcn.0040aa50
add esp, 4
jmp 0x40ae76
mov eax, dword [esp + 0x14]
cmp ax, bp
je 0x40ae82
pop edi
pop esi
movsx eax, ax
pop ebp
ret
mov word [esi + 0x413352], bp
mov dword [esi + 0x413360], ebp
mov dword [esi + 0x413364], ebp
mov word [esi + 0x413354], bp
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x40af60
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.MSVCR71.dll__lseek]
push ebp
mov ebp, dword [esp + 0xc]
push esi
lea esi, [edi + edi*8]
shl esi, 5
test byte [esi + 0x413351], 0x80
je 0x40afb3
mov eax, dword [esi + 0x413248]
push 0
push 0
push eax
call ebx
mov ecx, dword [esi + 0x413248]
push 0x18
push 1
push ecx
call dword [sym.imp.MSVCR71.dll__locking]
add esp, 0x18
test eax, eax
je 0x40afaa
pop esi
pop ebp
mov eax, 0xd
pop ebx
ret
test byte [esi + 0x413351], 0x80
jne 0x40afec
cmp word [esi + 0x413352], 0
je 0x40afec
mov edx, dword [esi + 0x413364]
mov eax, dword [edx]
mov dword [ebp], eax
mov ecx, dword [edx + 4]
mov dword [ebp + 4], ecx
mov eax, dword [edx + 8]
mov dword [ebp + 8], eax
mov ecx, dword [edx + 0xc]
mov dword [ebp + 0xc], ecx
mov eax, dword [edx + 0x10]
mov dword [ebp + 0x10], eax
mov ecx, dword [edx + 0x14]
pop esi
mov dword [ebp + 0x14], ecx
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 0x413248]
push 0
push 0
push edx
call ebx
add esp, 0xc
test eax, eax
jge 0x40b017
mov ecx, 0x18
xor ebx, ebx
mov eax, edi
call fcn.0040aa00
pop esi
pop ebp
mov eax, 0xc
pop ebx
ret
mov eax, dword [esi + 0x413248]
push 0x18
push ebp
push eax
call dword [sym.imp.MSVCR71.dll__read]
add esp, 0xc
cmp eax, 0x18
je 0x40b046
mov ecx, 0x18
xor ebx, ebx
mov eax, edi
call fcn.0040aa00
pop esi
pop ebp
mov eax, 5
pop ebx
ret
test byte [esi + 0x413350], 1
je 0x40b056
mov ecx, ebp
call fcn.0040ab80
cmp word [esi + 0x413352], 0
je 0x40b0a7
mov ecx, dword [esi + 0x413358]
cmp ecx, dword [ebp + 0x10]
je 0x40b0a7
test byte [esi + 0x413351], 0x80
jne 0x40b07d
pop esi
pop ebp
mov eax, 0xf
pop ebx
ret
mov cx, word [esi + 0x413354]
mov edx, dword [esi + 0x413360]
movsx ecx, cx
xor eax, eax
test ecx, ecx
jle 0x40b09e
mov word [edx + eax*8], 0xffff
inc eax
cmp eax, ecx
jl 0x40b093
mov edx, dword [ebp + 0x10]
mov dword [esi + 0x413358], edx
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x40c630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40c647
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
ret
movzx eax, al
shr eax, 4
and eax, 1
ret