joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407940
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push 0x20000
push 0
push ebx
mov edi, ebx
call fcn.00563ba0
mov eax, dword [0x26415c8]
mov ebp, dword [sym.imp.WS2_32.dll_recv]
add esp, 0xc
push 0
push 0x20000
push ebx
push eax
call ebp
cmp eax, 0xffffffff
mov esi, eax
je 0x40799d
movzx ecx, word [ebx]
cmp esi, ecx
jge 0x407998
mov edx, dword [0x26415c8]
push 0
push 0x20000
add edi, eax
push edi
push edx
call ebp
add esi, eax
cmp esi, 0xffffffff
jne 0x407977
cmp eax, 0xffffffff
jne 0x4079a4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x408380
Capabilities:
Set console window title

Disassembly:
sub esp, 0x24
cmp dword [0x264d3cc], 0
jne 0x408424
push esi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push str.Ps2_Output
push str.pcsx2
call dword [sym.imp.gnu_gettext.dll_Ordinal_3]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov word [esp + 4], 0x64
mov word [esp + 6], 0x400
mov eax, dword [esp + 4]
push eax
push 0xfffffffffffffff5
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
lea ecx, [esp + 0x10]
push ecx
push 0xfffffffffffffff5
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov edx, dword [esp + 0x1e]
mov eax, dword [esp + 0x1a]
mov dword [esp + 0xc], edx
lea ecx, [eax + 0x63]
lea edx, [esp + 8]
mov dword [esp + 8], eax
push edx
shr eax, 0x10
push 1
add eax, 0x40
push 0xfffffffffffffff5
mov word [esp + 0x18], cx
mov word [esp + 0x1a], ax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push 0xfffffffffffffff5
call esi
mov dword [0x264d3cc], eax
pop esi
add esp, 0x24
ret

Function at 0x409b50
Capabilities:
Create directory
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
mov edx, 0x263dd20
sub edx, eax
jmp 0x409b60
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x409b60
call fcn.00406360
jmp fcn.00405e90

Function at 0x409b80
Capabilities:
Create directory
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push str.memcards
call esi
push 0
push str.sstates
call esi
push 0
push str.logs
call esi
mov eax, dword [0x2640de4]
test eax, eax
pop esi
je 0x409bc1
push 0x582cd8
push eax
call fcn.00563b54
add esp, 8
mov dword [0x263d00c], eax
jmp 0x409bc6
mov eax, dword [0x263d00c]
test eax, eax
jne 0x409be5
push 0x582cd8
push str.logsemuLog.txt
call fcn.00563b54
add esp, 8
test eax, eax
mov dword [0x263d00c], eax
je 0x409bf4
push 0
push 4
push 0
push eax
call fcn.00564b79
add esp, 0x10
call fcn.004185b0
cmp eax, 0xffffffff
jne 0x409c01
or eax, eax
ret
call fcn.004378f0
cmp eax, 0xffffffff
jne 0x409c28
jmp 0x409c10
push 0
call fcn.00405830
add esp, 4
test eax, eax
je 0x409c35
call fcn.004378f0
cmp eax, 0xffffffff
je 0x409c10
mov dword [0x601ea8], 1
xor eax, eax
ret
push 1
call fcn.00563615
int3
Function at 0x409f20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x40
push 0x2000
push esi
push eax
call edi
push 0x40
push 0x1000
push esi
push eax
call edi
pop edi
pop esi
ret
Function at 0x421520
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x230
xor eax, eax
jmp 0x421530
mov cl, byte [eax + 0x263dc20]
mov byte [esp + eax + 0x130], cl
add eax, 1
test cl, cl
jne 0x421530
mov eax, 0x263d020
mov edx, eax
jmp 0x421550
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x421550
push ebx
push esi
push edi
lea edi, [esp + 0x13c]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x421568
mov ebx, dword [esp + 0x240]
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
lea eax, [esp + 0x140]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x44]
push str._s._s
push ecx
call fcn.00563254
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x3c]
call fcn.00408370
cmp eax, 0xffffffff
je 0x4215ef
lea edx, [esp + 0x3c]
push 0x585808
push edx
call fcn.00563b54
mov ecx, dword [esp + 0x24c]
mov esi, eax
mov eax, dword [esp + 0x28]
push esi
push eax
push 1
push ecx
call fcn.00566160
push esi
call fcn.00563a14
add esp, 0x1c
pop edi
pop esi
pop ebx
add esp, 0x230
ret
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0x40]
push 0x58240c
push eax
call fcn.00563254
lea eax, [esp + 0x48]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x421610
sub eax, edx
test eax, eax
jle 0x42162e
mov cl, 0x2e
cmp byte [esp + eax + 0x3c], cl
je 0x42162e
sub eax, 1
test eax, eax
jg 0x421621
mov byte [esp + eax + 0x3d], 0
mov eax, ebx
mov ecx, ebx
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x421637
lea edi, [esp + 0x3c]
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
jmp 0x421650
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x421650
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x3c]
call fcn.00408370
cmp eax, 0xffffffff
lea ecx, [esp + 0x3c]
je 0x4216b3
push 0x585808
push ecx
call fcn.00563b54
mov edx, dword [esp + 0x28]
mov esi, eax
mov eax, dword [esp + 0x24c]
push esi
push edx
push 1
push eax
call fcn.00566160
push esi
call fcn.00563a14
add esp, 0x1c
pop edi
pop esi
pop ebx
add esp, 0x230
ret
push ebx
push 0x263dc20
push str._s_s.bin
push ecx
call fcn.00563254
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x3c]
call fcn.00408370
cmp eax, 0xffffffff
jne 0x4215b6
push 0x5857f8
call fcn.00409cc0
push str._n
call fcn.00409cc0
push ebx
push str._s_NOT_FOUND_n
call fcn.00409cc0
push str._n_n_n
call fcn.00409cc0
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x230
ret
Function at 0x421720
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x263e8a8]
sub esp, 0x130
push 0x2000000
push 0
push eax
call fcn.00563ba0
mov ecx, dword [0x263e8cc]
push 0x4000
push 0
push ecx
call fcn.00563ba0
add esp, 0x18
xor eax, eax
mov cl, byte [eax + 0x263dc20]
mov byte [esp + eax + 0x30], cl
add eax, 1
test cl, cl
jne 0x421750
mov eax, 0x263d020
mov edx, eax
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x421768
push esi
push edi
lea edi, [esp + 0x38]
sub eax, edx
add edi, 0xffffffff
lea esp, [esp]
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x421780
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 8]
lea ecx, [esp + 0x38]
call fcn.00408370
cmp eax, 0xffffffff
jne 0x4217d6
lea edx, [esp + 0x38]
push edx
push str.Unable_to_load_bios:__s__PCSX2_cant_run_without_that
push str.pcsx2
call dword [sym.imp.gnu_gettext.dll_Ordinal_3]
add esp, 8
push eax
call fcn.00409e50
add esp, 8
pop edi
pop esi
add esp, 0x130
ret
lea eax, [esp + 0x38]
push 0x585808
push eax
call fcn.00563b54
mov ecx, dword [esp + 0x24]
mov edx, dword [0x263e8c8]
mov esi, eax
push esi
push ecx
push 1
push edx
call fcn.00566160
push esi
call fcn.00563a14
call fcn.00472410
movzx ecx, al
mov dword [0x263d000], eax
push ecx
shr eax, 8
push eax
push str.Bios_Version__d._d_n
call fcn.00409cc0
mov edx, dword [0x263e8a4]
push edx
push str.rom1
call fcn.00421520
mov eax, dword [0x263e8b4]
push eax
push str.rom2
call fcn.00421520
mov ecx, dword [0x263e8b0]
push ecx
push str.erom
call fcn.00421520
add esp, 0x40
pop edi
pop esi
add esp, 0x130
ret
Function at 0x42e210
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 7
push str.cdrom0:
push esi
call fcn.0057de38
add esp, 0xc
test eax, eax
je 0x42e293
push 7
push str.cdrom1:
push esi
call fcn.0057de38
add esp, 0xc
test eax, eax
je 0x42e293
push 0x585808
push esi
call fcn.00563b54
mov esi, eax
add esp, 8
test esi, esi
je 0x42e29f
mov eax, dword [0x263e294]
mov edi, dword [esp + 0x14]
cdq
xor ecx, ecx
cmp ecx, edx
jb 0x42e268
ja 0x42e29f
cmp edi, eax
jae 0x42e29f
push 0
push edi
push esi
call fcn.00563fde
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push esi
push eax
push 1
push ecx
call fcn.00566160
push esi
mov edi, eax
call fcn.00563a14
add esp, 0x20
mov eax, edi
pop edi
pop esi
ret
mov edi, dword [esp + 0x14]
cmp edi, dword [0x263e2c4]
jb 0x42e2a5
pop edi
or eax, 0xffffffff
pop esi
ret
push 1
add esi, 7
push esi
call fcn.004aff70
mov esi, eax
add esp, 8
test esi, esi
jl 0x42e29f
push 0
push edi
push esi
call fcn.004b0090
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
push edx
push eax
push esi
call fcn.004b0160
push esi
mov edi, eax
call fcn.004b0390
add esp, 0x1c
mov eax, edi
pop edi
pop esi
ret
Function at 0x432230
Capabilities:
Create thread
Terminate process

Disassembly:
test byte [0x263de20], 1
je 0x432312
push 4
push 0x3000
push 0x300000
push 0x10200000
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, 0x10200000
mov dword [0x6075f0], eax
je 0x432274
push str.Cannot_alloc_GS_ring_buffer_n
call fcn.00409e50
add esp, 4
push 0
call fcn.00563615
push 0x2000
push 0x605588
push 0x603580
call fcn.00565810
add esp, 0xc
mov eax, 0x10200000
mov ecx, 0x6075f4
xchg dword [ecx], eax
mov eax, dword [0x2620b44]
test eax, eax
je 0x4322a7
push 0x603580
call eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x6075c0], eax
call esi
push 0
push 0
push 0
push 0
mov dword [0x6075c4], eax
call esi
push 0
push 0
push 0
push 0
mov dword [0x6075c8], eax
call esi
push str.gsInit_n
mov dword [0x6075cc], eax
call fcn.00409cc0
add esp, 4
push 0
push 0
push 0
push 0x431770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6075d0], eax
pop esi
ret
Function at 0x475a80
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5808c8
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [esp + 0x34]
test esi, esi
mov ebx, ecx
jne 0x475ac3
push esi
push esi
push esi
push 2
call fcn.00477c10
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
push edi
call fcn.004747a0
lea ecx, [ebx + 4]
call fcn.00474720
push 2
push 0
push esi
call fcn.00563fde
push esi
call fcn.00563ee9
push 0
push 0
push esi
mov edi, eax
call fcn.00563fde
add esp, 0x1c
test edi, edi
jne 0x475b16
push edi
push edi
push edi
push 0xd
mov ecx, ebx
call fcn.00477c10
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
push ebp
lea ecx, [esp + 0x10]
call fcn.004751d0
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0
call fcn.00475400
lea eax, [edi + 1]
push eax
call fcn.00567e88
push esi
push 1
mov ebp, eax
push edi
push ebp
mov byte [ebp], 0
call fcn.00566160
add esp, 0x14
cmp eax, 1
je 0x475b8b
push ebp
call fcn.00567b2d
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, ebx
call fcn.00477c10
lea ecx, [esp + 0x10]
call fcn.00433160
pop ebp
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, ebp
mov esi, ebp
je 0x475bf8
lea esp, [esp]
mov cl, byte [esi]
cmp cl, 0xa
jne 0x475bc0
mov ecx, esi
sub ecx, eax
add ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00475730
add esi, 1
mov eax, esi
jmp 0x475bf3
cmp cl, 0xd
jne 0x475bf0
mov ecx, esi
sub ecx, eax
test ecx, ecx
jle 0x475bd8
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00475730
push 0xa
lea ecx, [esp + 0x14]
call fcn.00475700
cmp byte [esi + 1], 0xa
jne 0x475bb9
add esi, 2
mov eax, esi
jmp 0x475bf3
add esi, 1
cmp byte [esi], 0
jne 0x475ba0
sub esi, eax
je 0x475c07
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00475730
push ebp
call fcn.00567b2d
mov edx, dword [esp + 0x44]
mov esi, dword [ebx]
add esp, 4
push edx
push 0
lea ecx, [esp + 0x18]
call fcn.004333f0
push eax
mov eax, dword [esi + 8]
mov ecx, ebx
call eax
mov ecx, ebx
call fcn.00474790
test al, al
lea ecx, [esp + 0x10]
jne 0x475b6f
call fcn.00433160
mov ecx, dword [esp + 0x2c]
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x4767f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x580ae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
push eax
lea ecx, [esp + 0xc]
call fcn.00433760
lea ecx, [esp + 8]
lea esi, [edi + 0x20]
push ecx
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00475d40
push 0x585808
mov ecx, esi
call fcn.004333f0
push eax
call fcn.00563b54
mov esi, eax
add esp, 8
test esi, esi
mov ecx, edi
je 0x476884
mov edx, dword [esp + 0x38]
push ebx
push edx
push esi
call fcn.00475a80
push esi
mov bl, al
call fcn.00563a14
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00433160
mov al, bl
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
push 0
push 0
push 0
push 2
call fcn.00477c10
lea ecx, [esp + 8]
call fcn.00433160
mov ecx, dword [esp + 0x24]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x47b990
Capabilities:
Set console window title

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x178
push eax
lea ecx, [esp + 0x7c]
push str.patches_s.xml
push ecx
call fcn.00563254
add esp, 0xc
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 4]
mov dword [0x2634fd0], 0
call fcn.00476770
push 0
lea ecx, [esp + 4]
call fcn.00476f00
test al, al
jne 0x47b9e6
lea ecx, [esp]
call fcn.00476730
or eax, 0xffffffff
add esp, 0x178
ret
push esi
lea eax, [esp + 0x7c]
push eax
push str.XML_Patch_Loader:__s_Found_n
call fcn.00409cc0
add esp, 8
push str.GAME
lea ecx, [esp + 8]
call fcn.00475150
mov esi, eax
test esi, esi
jne 0x47ba2e
push str.XML_Patch_Loader:_Root_node_is_not_GAME__invalid_patch_file._n
call fcn.00409cc0
add esp, 4
lea ecx, [esp + 4]
call fcn.00476730
or eax, 0xffffffff
pop esi
add esp, 0x178
ret
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
push edi
mov ecx, esi
call eax
push str.title
mov ecx, eax
call fcn.00475170
mov edi, eax
test edi, edi
je 0x47ba58
push edi
push str.XML_Patch_Loader:_Game_Title:__s_n
call fcn.00409cc0
add esp, 8
push 0xffffffffffffffff
push esi
call fcn.0047b230
mov esi, eax
add esp, 8
test esi, esi
je 0x47ba87
lea ecx, [esp + 8]
mov dword [0x2634fd0], 0
call fcn.00476730
pop edi
mov eax, esi
pop esi
add esp, 0x178
ret
cmp dword [0x264d3cc], 0
je 0x47baa2
test edi, edi
je 0x47ba97
push edi
jmp 0x47ba9c
push str._No_Title_
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea ecx, [esp + 8]
call fcn.00476730
pop edi
xor eax, eax
pop esi
add esp, 0x178
ret
Function at 0x495c00
Capabilities:
Terminate process

Disassembly:
sub esp, 0x200
xor eax, eax
jmp 0x495c10
mov cl, byte [eax + 0x263dc20]
mov byte [esp + eax + 0x100], cl
add eax, 1
test cl, cl
jne 0x495c10
mov eax, 0x263d020
mov edx, eax
jmp 0x495c30
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x495c30
push esi
push edi
lea edi, [esp + 0x108]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x495c47
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x108]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push 0x58240c
push ecx
call fcn.00563254
lea eax, [esp + 0x14]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x495c82
sub eax, edx
test eax, eax
jle 0x495ca0
mov cl, 0x2e
cmp byte [esp + eax + 8], cl
je 0x495ca0
sub eax, 1
test eax, eax
jg 0x495c93
lea edi, [esp + 8]
mov byte [esp + eax + 9], 0
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x495cb0
mov edx, dword [0x58f024]
lea eax, [esp + 8]
push 0x58f020
push eax
mov dword [edi], edx
call fcn.00563b54
mov esi, eax
add esp, 8
test esi, esi
jne 0x495d38
push str.MEC_File_Not_Found___Creating_Blank_File_n
call fcn.00409cc0
lea ecx, [esp + 0xc]
push 0x586830
push ecx
call fcn.00563b54
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x495d15
lea edx, [esp + 8]
push edx
push str._cdvdOpenMechaVer:_Error_creating__s
call fcn.00409e50
add esp, 8
push 1
call fcn.00563615
push esi
push 3
call fcn.00567b5c
push esi
push 6
call fcn.00567b5c
push esi
push 2
call fcn.00567b5c
push esi
push 0
call fcn.00567b5c
add esp, 0x20
pop edi
mov eax, esi
pop esi
add esp, 0x200
ret

Function at 0x495d50
Capabilities:
Read file on windows

Disassembly:
push esi
call fcn.00495c00
mov esi, eax
test esi, esi
jne 0x495d63
mov eax, 1
pop esi
ret
push 0
push 0
push esi
call fcn.00563fde
mov eax, dword [esp + 0x14]
push esi
push 4
push 1
push eax
call fcn.00566160
push esi
call fcn.00563a14
add esp, 0x20
xor eax, eax
pop esi
ret
Function at 0x495d90
Capabilities:
Terminate process

Disassembly:
sub esp, 0x200
xor eax, eax
jmp 0x495da0
mov cl, byte [eax + 0x263dc20]
mov byte [esp + eax + 0x100], cl
add eax, 1
test cl, cl
jne 0x495da0
mov eax, 0x263d020
mov edx, eax
jmp 0x495dc0
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x495dc0
push esi
push edi
lea edi, [esp + 0x108]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x495dd7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x108]
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push 0x58240c
push ecx
call fcn.00563254
lea eax, [esp + 0x14]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x495e12
sub eax, edx
test eax, eax
jle 0x495e30
mov cl, 0x2e
cmp byte [esp + eax + 8], cl
je 0x495e30
sub eax, 1
test eax, eax
jg 0x495e23
lea edi, [esp + 8]
mov byte [esp + eax + 9], 0
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x495e40
mov edx, dword [0x58f074]
lea eax, [esp + 8]
push 0x58f020
push eax
mov dword [edi], edx
call fcn.00563b54
mov esi, eax
add esp, 8
test esi, esi
jne 0x495ec0
push str.NVM_File_Not_Found___Creating_Blank_File_n
call fcn.00409cc0
lea ecx, [esp + 0xc]
push 0x586830
push ecx
call fcn.00563b54
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x495ea5
lea edx, [esp + 8]
push edx
push str._cdvdOpenNVM:_Error_creating__s
call fcn.00409e50
add esp, 8
push 1
call fcn.00563615
mov edi, 0x400
lea ebx, [ebx]
push esi
push 0
call fcn.00567b5c
add esp, 8
sub edi, 1
jne 0x495eb0
pop edi
mov eax, esi
pop esi
add esp, 0x200
ret

Function at 0x495ed0
Capabilities:
Read file on windows

Disassembly:
push esi
call fcn.00495d90
mov esi, eax
test esi, esi
jne 0x495ee3
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0xc]
push 0
push eax
push esi
call fcn.00563fde
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push esi
push ecx
push 1
push edx
call fcn.00566160
push esi
call fcn.00563a14
add esp, 0x20
xor eax, eax
pop esi
ret

Function at 0x495f10
Capabilities:
Write file on windows

Disassembly:
push esi
call fcn.00495d90
mov esi, eax
test esi, esi
jne 0x495f23
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0xc]
push 0
push eax
push esi
call fcn.00563fde
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push esi
push ecx
push 1
push edx
call fcn.005663b7
push esi
call fcn.00563a14
add esp, 0x20
xor eax, eax
pop esi
ret

Function at 0x4a6d50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor al, al
xor dl, dl
test esi, esi
jbe 0x4a6d72
push edi
mov edi, dword [esp + 0xc]
xor ecx, ecx
xor al, byte [ecx + edi]
add dl, 1
movzx ecx, dl
cmp ecx, esi
jb 0x4a6d64
pop edi
pop esi
ret
Function at 0x4a7200
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 4], 1
jne 0x4a724b
mov eax, dword [0x2623748]
test eax, eax
jne 0x4a7225
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
push eax
push 0
push ecx
call fcn.00563ba0
add esp, 0xc
ret
mov edx, dword [esp + 0xc]
push edx
push eax
call fcn.004a7190
mov eax, dword [0x2623748]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push eax
push ecx
push 1
push edx
call fcn.00566160
add esp, 0x18
ret
mov eax, dword [0x2623744]
test eax, eax
je 0x4a7210
mov edx, dword [esp + 0xc]
push edx
push eax
call fcn.004a7190
mov eax, dword [0x2623744]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push eax
push ecx
push 1
push edx
call fcn.00566160
add esp, 0x18
ret

Function at 0x4a7280
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 1
jne 0x4a72b4
mov eax, dword [esp + 0xc]
mov ecx, dword [0x2623748]
push eax
push ecx
call fcn.004a7190
mov edx, dword [0x2623748]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push edx
push eax
push 1
push ecx
call fcn.005663b7
add esp, 0x18
ret
mov edx, dword [esp + 0xc]
mov eax, dword [0x2623744]
push edx
push eax
call fcn.004a7190
mov ecx, dword [0x2623744]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push ecx
push edx
push 1
push eax
call fcn.005663b7
add esp, 0x18
ret
Function at 0x53f9e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [esp + 0xc], esi
call fcn.0053a920
movzx edi, word [esi + 4]
lea eax, [esp + 0x20]
add esi, 0x14
push eax
mov ecx, esi
call fcn.0053a970
mov ecx, dword [eax]
mov edx, dword [eax + 4]
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ecx
push eax
mov ecx, esi
mov dword [esp + 0x18], edx
call fcn.0053a9f0
push eax
lea ecx, [esp + 0x14]
call fcn.0053a460
test al, al
mov ebx, dword [ebp + 8]
je 0x53fa72
lea ecx, [esp + 0x10]
call fcn.0053aa20
test word [eax + 0x5e], 0x83c0
jne 0x53fa4f
cmp edi, ebx
je 0x53fa72
add edi, 8
lea ecx, [esp + 0x10]
call fcn.0053a480
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0053a9f0
push eax
lea ecx, [esp + 0x14]
call fcn.0053a460
test al, al
jne 0x53fa37
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.0053a9f0
push eax
lea ecx, [esp + 0x14]
call fcn.0053a460
test al, al
je 0x53faaf
lea ecx, [esp + 0x10]
call fcn.0053aa10
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
call fcn.0053f520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x26211ec
call fcn.0053a970
lea edx, [esp + 0x20]
push edx
mov ecx, 0x26211ec
call fcn.0053a9f0
push eax
lea ecx, [esp + 0x1c]
call fcn.0053a460
test al, al
je 0x53fb6f
nop
lea ecx, [esp + 0x18]
call fcn.0053aa10
mov ecx, dword [esp + 0xc]
cmp dword [eax], ecx
je 0x53fb45
lea ecx, [esp + 0x18]
call fcn.0053aa10
mov edx, dword [eax]
movzx eax, word [edx + 4]
cmp ebx, eax
jl 0x53fb45
lea ecx, [esp + 0x18]
call fcn.0053aa10
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp ebx, edx
jge 0x53fb45
lea ecx, [esp + 0x18]
call fcn.0053aa10
push ebx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [eax]
call fcn.0053b0e0
mov ecx, eax
call fcn.0053aa10
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], eax
call fcn.0053f520
lea ecx, [esp + 0x18]
call fcn.0053a480
lea eax, [esp + 0x20]
push eax
mov ecx, 0x26211ec
call fcn.0053a9f0
push eax
lea ecx, [esp + 0x1c]
call fcn.0053a460
test al, al
jne 0x53fae0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8