joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405af0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov word [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
push 0xa
lea ecx, [ebp - 0x18]
push ecx
push 0x424784
push str.NotUseDefaultDllPath
push 0x424708
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00405c30
mov eax, dword [ebp - 0x18]
and eax, 0xffff
cmp eax, 0x31
jne 0x405b62
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00406060
jmp 0x405c1e
mov word [ebp - 0x220], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push str.DllPath
push str.DefaultValue
call dword [0x424038]
mov word [ebp - 0x428], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x426]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 4]
call fcn.00405eb0
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00405e50
test eax, eax
je 0x405c07
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00406060
jmp 0x405c1e
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.00405d70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406c00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
mov word [ebp - 0x800], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x804], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x804]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x3ff
push 0x400
lea eax, [ebp - 0x800]
push eax
call dword [0x428060]
add esp, 0x14
mov dword [ebp - 0x804], 0
lea ecx, [ebp - 0x800]
push ecx
call dword [0x424034]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406e30
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov word [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
push 0xa
lea ecx, [ebp - 0x18]
push ecx
push 0x424784
push str.NotUseDefaultDllPath
push 0x424708
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00406f70
mov eax, dword [ebp - 0x18]
and eax, 0xffff
cmp eax, 0x31
jne 0x406ea2
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004073a0
jmp 0x406f5e
mov word [ebp - 0x220], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push str.DllPath
push str.DefaultValue
call dword [0x424038]
mov word [ebp - 0x428], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x426]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 4]
call fcn.004071f0
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00407190
test eax, eax
je 0x406f47
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.004073a0
jmp 0x406f5e
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.004070b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40bbd0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x40bc98
mov eax, dword [ebp + 8]
push eax
call fcn.00413d17
add esp, 4
test eax, eax
jbe 0x40bc98
mov dword [ebp - 8], 1
mov word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040be50
cmp dword [ebp + 0xc], 0
jne 0x40bc5e
lea eax, [ebp - 0x210]
push eax
call dword [0x424060]
and eax, 0x10
test eax, eax
je 0x40bc5e
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
je 0x40bc85
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.004154ac
add esp, 8
test eax, eax
jne 0x40bc85
mov dword [ebp - 0x214], 1
jmp 0x40bc8f
mov dword [ebp - 0x214], 0
mov edx, dword [ebp - 0x214]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40d390
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
mov word [ebp - 0x800], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x804], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x804]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x3ff
push 0x400
lea eax, [ebp - 0x800]
push eax
call dword [0x428060]
add esp, 0x14
mov dword [ebp - 0x804], 0
lea ecx, [ebp - 0x800]
push ecx
call dword [0x424034]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d7e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
mov word [ebp - 0x800], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x804], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x804]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x3ff
push 0x400
lea eax, [ebp - 0x800]
push eax
call dword [0x428060]
add esp, 0x14
mov dword [ebp - 0x804], 0
lea ecx, [ebp - 0x800]
push ecx
call dword [0x424034]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d990
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
mov word [ebp - 0x800], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x804], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x804]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x3ff
push 0x400
lea eax, [ebp - 0x800]
push eax
call dword [0x428060]
add esp, 0x14
mov dword [ebp - 0x804], 0
lea ecx, [ebp - 0x800]
push ecx
call dword [0x424034]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40db40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
mov word [ebp - 0x800], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x804], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x804]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x3ff
push 0x400
lea eax, [ebp - 0x800]
push eax
call dword [0x428060]
add esp, 0x14
mov dword [ebp - 0x804], 0
lea ecx, [ebp - 0x800]
push ecx
call dword [0x424034]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e600
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov word [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
push 0xa
lea ecx, [ebp - 0x18]
push ecx
push 0x424784
push str.NotUseDefaultDllPath
push 0x424708
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040e740
mov eax, dword [ebp - 0x18]
and eax, 0xffff
cmp eax, 0x31
jne 0x40e672
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040f8a0
jmp 0x40e72e
mov word [ebp - 0x220], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push str.DllPath
push str.DefaultValue
call dword [0x424038]
mov word [ebp - 0x428], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x426]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040f6f0
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040e960
test eax, eax
je 0x40e717
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040f8a0
jmp 0x40e72e
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040e880
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ebb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov word [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
push 0xa
lea ecx, [ebp - 0x18]
push ecx
push 0x424784
push str.NotUseDefaultDllPath
push 0x424708
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040ecf0
mov eax, dword [ebp - 0x18]
and eax, 0xffff
cmp eax, 0x31
jne 0x40ec22
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040fc50
jmp 0x40ecde
mov word [ebp - 0x220], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push str.DllPath
push str.DefaultValue
call dword [0x424038]
mov word [ebp - 0x428], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x426]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040faa0
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040ef10
test eax, eax
je 0x40ecc7
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040fc50
jmp 0x40ecde
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040ee30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ef70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov word [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
push 0xa
lea ecx, [ebp - 0x18]
push ecx
push 0x424784
push str.NotUseDefaultDllPath
push 0x424708
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040f0b0
mov eax, dword [ebp - 0x18]
and eax, 0xffff
cmp eax, 0x31
jne 0x40efe2
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040ff90
jmp 0x40f09e
mov word [ebp - 0x220], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push str.DllPath
push str.DefaultValue
call dword [0x424038]
mov word [ebp - 0x428], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x426]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040fde0
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040f2d0
test eax, eax
je 0x40f087
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040ff90
jmp 0x40f09e
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040f1f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f330
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov word [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
push 0xa
lea ecx, [ebp - 0x18]
push ecx
push 0x424784
push str.NotUseDefaultDllPath
push 0x424708
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040f470
mov eax, dword [ebp - 0x18]
and eax, 0xffff
cmp eax, 0x31
jne 0x40f3a2
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004102d0
jmp 0x40f45e
mov word [ebp - 0x220], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push str.DllPath
push str.DefaultValue
call dword [0x424038]
mov word [ebp - 0x428], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x426]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 4]
call fcn.00410120
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040f690
test eax, eax
je 0x40f447
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.004102d0
jmp 0x40f45e
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.0040f5b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x410f40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423779
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x105c
call fcn.004140a0
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18]
call fcn.00411570
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00411690
test eax, eax
je 0x41110f
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
and eax, 0xff
test eax, eax
je 0x41110f
push 0x425694
call dword [0x424034]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x424034]
push 0x425690
call dword [0x424034]
mov word [ebp - 0x818], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x400
lea edx, [ebp - 0x818]
push edx
push str._br_
push 0x425690
mov eax, dword [ebp + 0xc]
push eax
call fcn.00411320
add esp, 0x14
push str._font_
lea ecx, [ebp - 0x818]
push ecx
call fcn.0040a3f0
add esp, 8
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jne 0x41103a
push str.__a_
lea edx, [ebp - 0x818]
push edx
call fcn.0040a3f0
add esp, 8
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jne 0x4110c9
mov word [ebp - 0x101c], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x101a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x818]
push eax
push str._font__s__font_
push 0x400
lea ecx, [ebp - 0x101c]
push ecx
call fcn.0041527e
add esp, 0x10
mov edx, dword [ebp + 0x28]
push edx
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x18]
call fcn.004116b0
mov dword [ebp - 0x1024], eax
mov edx, dword [ebp - 0x1024]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1024]
call dword [eax + 0x28]
mov dword [ebp - 0x10], eax
jmp 0x41110f
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.004116b0
mov dword [ebp - 0x1028], eax
mov ecx, dword [ebp - 0x1028]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x1028]
call dword [edx + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1020], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00411620
mov eax, dword [ebp - 0x1020]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411140
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423799
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x105c
call fcn.004140a0
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18]
call fcn.00411570
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00411690
test eax, eax
je 0x4112f1
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
and eax, 0xff
test eax, eax
je 0x4112f1
push 0x425694
call dword [0x424034]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x424034]
push 0x425690
call dword [0x424034]
mov word [ebp - 0x818], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x400
lea edx, [ebp - 0x818]
push edx
push str._br_
push 0x425690
mov eax, dword [ebp + 0xc]
push eax
call fcn.00411320
add esp, 0x14
push str._font_
lea ecx, [ebp - 0x818]
push ecx
call fcn.0040a3f0
add esp, 8
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jne 0x41123a
push str.__a_
lea edx, [ebp - 0x818]
push edx
call fcn.0040a3f0
add esp, 8
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jne 0x4112b8
mov word [ebp - 0x101c], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x101a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x818]
push eax
push str._font__s__font_
push 0x400
lea ecx, [ebp - 0x101c]
push ecx
call fcn.0041527e
add esp, 0x10
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x101c]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.004116b0
mov dword [ebp - 0x1024], eax
mov ecx, dword [ebp - 0x1024]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x1024]
call dword [edx + 0x20]
mov dword [ebp - 0x10], eax
jmp 0x4112f1
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x18]
call fcn.004116b0
mov dword [ebp - 0x1028], eax
mov edx, dword [ebp - 0x1028]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1028]
call dword [eax + 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1020], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00411620
mov eax, dword [ebp - 0x1020]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411a60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
mov word [ebp - 0x800], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x804], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x804], eax
mov ecx, dword [ebp - 0x804]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x3ff
push 0x400
lea eax, [ebp - 0x800]
push eax
call dword [0x428060]
add esp, 0x14
mov dword [ebp - 0x804], 0
lea ecx, [ebp - 0x800]
push ecx
call dword [0x424034]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411c90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov word [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
push 0xa
lea ecx, [ebp - 0x18]
push ecx
push 0x424784
push str.NotUseDefaultDllPath
push 0x424708
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00411dd0
mov eax, dword [ebp - 0x18]
and eax, 0xffff
cmp eax, 0x31
jne 0x411d02
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00412200
jmp 0x411dbe
mov word [ebp - 0x220], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push str.DllPath
push str.DefaultValue
call dword [0x424038]
mov word [ebp - 0x428], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x426]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 4]
call fcn.00412050
lea ecx, [ebp - 0x428]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00411ff0
test eax, eax
je 0x411da7
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00412200
jmp 0x411dbe
lea eax, [ebp - 0x428]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 4]
call fcn.00411f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x414e20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [0x42414c]
cmp eax, 0xffffffff
jne 0x414e40
call dword [0x4240bc]
push eax
call fcn.00417ba9
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x414e63
test byte [esp + 8], 2
je 0x414e63
call fcn.00417c1c
mov dword [eax], 0xd
call fcn.00417c25
mov dword [eax], 5
jmp 0x414e3c
xor eax, eax
ret

Function at 0x4154ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [0x424060]
cmp eax, 0xffffffff
jne 0x4154cc
call dword [0x4240bc]
push eax
call fcn.00417ba9
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4154ef
test byte [esp + 8], 2
je 0x4154ef
call fcn.00417c1c
mov dword [eax], 0xd
call fcn.00417c25
mov dword [eax], 5
jmp 0x4154c8
xor eax, eax
ret