joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dad0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x53c0fc]
test eax, eax
je 0x42dadb
call eax
push 1
push 0
push 0
mov ecx, str.debugout.log
call fcn.0045e940
push eax
push str.open
push dword [0x53bb48]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x430810
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.http:__]
mov dword [ebp - 0x808], eax
mov eax, dword [0x4c3d20]
mov dword [ebp - 0x804], eax
mov eax, dword [0x58c460]
push esi
push edi
mov ecx, dword [eax + 8]
mov eax, dword [0x58c464]
add ecx, ecx
mov eax, dword [eax + 0x24]
mov eax, dword [eax + ecx*8 - 4]
add eax, 0xc
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x430856
lea edi, [ebp - 0x808]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x430866
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x53c0fc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
je 0x430887
call eax
push 1
push 0
push 0
lea eax, [ebp - 0x808]
push eax
push str.open
push dword [0x53bb48]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.0044fd30
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00493955
mov esp, ebp
pop ebp
ret

Function at 0x4308c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov esi, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x308]
push eax
push 0
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00494895
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x108]
test esi, esi
je 0x43093b
cmp byte [esi], 0
je 0x43093b
push esi
push str.a:_s_bin_s_s
push eax
call fcn.00493964
add esp, 0x14
jmp 0x430949
push str.a:_bin_s_s
push eax
call fcn.00493964
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ebx, ebx
lea eax, [ebx + 0x61]
mov dword [ebp - 0x40c], 0x5c3a61
mov byte [ebp - 0x40d], al
mov byte [ebp - 0x40c], al
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jmp 0x4309da
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493955
mov esp, ebp
pop ebp
ret
Function at 0x4309f0
Capabilities:
Get graphical window text
Terminate process

Disassembly:
push ebx
push esi
push edi
cmp ecx, 1
jl 0x430a13
mov eax, dword [0x58c460]
mov ecx, dword [eax + 8]
mov eax, dword [0x58c464]
add ecx, ecx
mov eax, dword [eax + 0x24]
mov esi, dword [eax + ecx*8 - 4]
add esi, 0xc
jmp 0x430a15
xor esi, esi
mov ecx, esi
call fcn.004308c0
test eax, eax
jne 0x430a82
mov edi, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [esp]
call fcn.0047b900
mov eax, dword [0x53c0fc]
test eax, eax
je 0x430a40
call eax
push dword [0x53bb48]
call edi
push 0x104
push 0x573048
push dword [0x53bb48]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 5
push 0x573048
push 0x4c3d44
push dword [0x53bb48]
call ebx
cmp eax, 2
je 0x430a8c
mov ecx, esi
call fcn.004308c0
test eax, eax
je 0x430a30
xor ecx, ecx
pop edi
pop esi
pop ebx
jmp fcn.0044fd30
xor ecx, ecx
call fcn.0044fd30
call fcn.00458b50
call fcn.00459460
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.0049501f
int3

Function at 0x430de0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x430e17
mov byte [ebp - 0x804], al
jmp 0x430e3e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x430e37
push 0x7f0
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.00495450
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x804]
call fcn.0044fe30
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00493955
mov esp, ebp
pop ebp
ret
Function at 0x431d30
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x108]
mov ebx, ecx
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [0x53bb48]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x431dce
lea eax, [ebp - 0x110]
push eax
push 0x10
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x431dc0
push 0x53c660
push dword [ebp - 0x110]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 0x110]
test eax, eax
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x14]
je 0x431dbe
call eax
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
jmp 0x431de4
call eax
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
xor ecx, ecx
mov al, byte [ebp + ecx - 0x108]
lea ecx, [ecx + 1]
mov byte [ecx + 0x53c65f], al
test al, al
jne 0x431dd0
mov edi, 0x53c660
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x431df0
mov ax, word [0x4c3b10]
mov esi, ebx
mov word [edi], ax
mov al, byte [ebx]
inc ebx
test al, al
jne 0x431e05
mov edi, 0x53c660
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x431e14
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00431340
mov eax, dword [0x53bb48]
mov dword [0x53c60c], eax
mov dword [0x53c624], 0x53c660
mov dword [0x53c62c], 0
mov dword [0x53c638], 0x4c3e84
mov dword [0x53c63c], 6
call fcn.0047ed50
mov eax, dword [0x53c100]
pop edi
pop esi
pop ebx
test eax, eax
je 0x431e74
call eax
push 0x53c608
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
mov byte [0x53c763], 0
test eax, eax
jne 0x431e9b
call dword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
test eax, eax
je 0x431ec1
push 0x4c3e60
jmp 0x431eb9
mov ecx, 0x53c660
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x431ea3
sub ecx, edx
cmp ecx, 0xc0
jb 0x431ec1
push 0x4c3e6c
call fcn.00485990
add esp, 4
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call fcn.0047ecd0
call fcn.0044f000
mov ecx, dword [ebp - 4]
mov eax, 0x53c660
xor ecx, ebp
call fcn.00493955
mov esp, ebp
pop ebp
ret

Function at 0x438520
Capabilities:
Get graphical window text
Terminate process

Disassembly:
push 0
push 0
push 0xa005
push dword [0x53bb48]
mov dword [0x4e67f4], 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x4e66e8]
test eax, eax
je 0x438558
push 0
push 0
push 0xa002
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp fcn.004380c0
Function at 0x439800
Capabilities:
Read file on windows

Disassembly:
cmp dword [0x4e6820], 0
jne 0x439927
push ebx
push 0x4c3d40
mov ecx, str.save_cnmajiro_readmark.mss
mov dword [0x4e6820], 1
call fcn.0045e940
push eax
call fcn.00494396
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x439926
push esi
push edi
lea esp, [esp]
push 0xd4
call fcn.00497cab
mov esi, eax
add esp, 4
test esi, esi
jne 0x439866
push 0x10
push str.malloc
push 0x4c9a90
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x94
push 0
push esi
call fcn.0049cbc0
push ebx
push 1
push 0x94
push esi
call fcn.00495739
add esp, 0x1c
cmp eax, 1
jne 0x4398fb
mov eax, dword [esi + 0x80]
add eax, 0x40
push eax
call fcn.00497cab
mov edi, eax
add esp, 4
test edi, edi
jne 0x4398b4
push 0x10
push str.malloc
push 0x4c9a90
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
push 1
push dword [esi + 0x80]
mov dword [esi + 0x88], edi
push edi
call fcn.00495739
add esp, 0x10
cmp eax, 1
jne 0x4398fb
mov eax, dword [0x4e6818]
mov dword [esi + 0x90], 0
mov dword [esi + 0x8c], eax
test eax, eax
je 0x4398f0
mov dword [eax + 0x90], esi
mov dword [0x4e6818], esi
jmp 0x439840
test esi, esi
je 0x43991b
mov eax, dword [esi + 0x88]
test eax, eax
je 0x439912
push eax
call fcn.00494034
add esp, 4
push esi
call fcn.00494034
add esp, 4
push ebx
call fcn.00494b54
add esp, 4
pop edi
pop esi
pop ebx
ret

Function at 0x439930
Capabilities:
Write file on windows

Disassembly:
cmp dword [0x4e6818], 0
je 0x4399dc
call fcn.004573d0
test eax, eax
jne 0x4399dc
push ebx
push 0x4c3dd8
mov ecx, str.save_cnmajiro_readmark.mss
call fcn.0045e940
push eax
call fcn.00494396
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4399d1
push esi
mov esi, dword [0x4e6818]
test esi, esi
je 0x4399c7
push edi
mov edi, dword [esi + 0x8c]
push ebx
push 1
push 0x94
push esi
call fcn.0049528d
add esp, 0x10
cmp eax, 1
jne 0x4399c6
push ebx
push eax
push dword [esi + 0x80]
push dword [esi + 0x88]
call fcn.0049528d
add esp, 0x10
cmp eax, 1
jne 0x4399c6
push dword [esi + 0x88]
call fcn.00494034
push esi
call fcn.00494034
add esp, 8
mov esi, edi
test edi, edi
jne 0x439975
pop edi
push ebx
call fcn.00494b54
add esp, 4
pop esi
mov dword [0x4e6818], 0
pop ebx
ret
Function at 0x43eed0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x4e6834], 0
jne 0x43efb3
cmp dword [0x4e6814], 0
jne 0x43ef22
cmp dword [0x4e6828], 0
jne 0x43ef22
call fcn.0044f1e0
test eax, eax
jne 0x43ef28
cmp dword [0x4e6808], eax
jne 0x43ef28
call fcn.0044f230
test eax, eax
jne 0x43ef15
cmp dword [0x4e6810], eax
je 0x43efb3
cmp dword [0x4e682c], 0
je 0x43efb3
mov eax, 1
ret
cmp dword [0x4e6830], 0
je 0x43efa9
call fcn.0044f1e0
test eax, eax
je 0x43ef22
mov ecx, 0x83
call fcn.0044f190
test eax, eax
je 0x43ef22
mov ecx, 0x83
call fcn.0044f140
mov ecx, 0x82
call fcn.0044f140
mov ecx, 0x88
call fcn.0044f140
cmp dword [0x4e4e68], 0xffffffff
mov dword [0x4e6808], 0
jne 0x43efa1
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x43efa1
push 0
push 0
push 0
push 0x14
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x14
call dword [sym.imp.USER32.dll_keybd_event]
call fcn.0047ec40
xor eax, eax
ret
mov dword [0x4e6808], 0
xor eax, eax
ret

Function at 0x43f5b0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x43f5c4
xor ecx, ecx
jmp fcn.0044fd30
mov ecx, dword [0x4e6810]
mov eax, dword [0x4e6808]
neg ecx
sbb ecx, ecx
and ecx, 4
neg eax
sbb eax, eax
and eax, 2
add ecx, eax
xor eax, eax
cmp dword [0x4e6814], eax
setne al
add ecx, eax
jmp fcn.0044fd30
Function at 0x444850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4e7870], 0
push esi
je 0x4449d2
call fcn.004573d0
test eax, eax
jne 0x4449b3
mov eax, dword [0x4e5164]
cmp eax, 0xffffffff
jne 0x4448a6
mov ecx, str.FONTCACHESMART
call fcn.00487da0
test eax, eax
je 0x4448a1
push dword [eax + 4]
call fcn.00494176
add esp, 4
mov dword [0x4e5164], eax
push dword [0x4e7978]
test eax, eax
lea eax, [ebp - 0x110]
push dword [0x4e7974]
push 0x4e7870
je 0x4448c8
push str.fca__s__03dx_03d.fcd
jmp 0x4448cd
push str.fc__s__03dx_03d.fcd
push eax
call fcn.00493964
add esp, 0x14
cmp dword [0x53bf90], 0
jne 0x444901
push 0x575f18
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4801a0
call fcn.0049543a
add esp, 4
mov dword [0x53bf90], 1
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x110]
call fcn.00482070
test eax, eax
jne 0x4449b3
cmp dword [0x53799c], eax
je 0x4449b3
call fcn.004575b0
push dword [0x4e7978]
test eax, eax
lea eax, [ebp - 0x110]
push dword [0x4e7974]
push 0x4e7870
je 0x44494d
push str.save_cn_fca__s__03dx_03d.fcd
jmp 0x444952
push str.save_cn_fc__s__03dx_03d.fcd
push eax
call fcn.00493964
add esp, 0x14
lea ecx, [ebp - 0x110]
push 0x4c3dd8
call fcn.0045e940
push eax
call fcn.00494396
mov esi, eax
add esp, 8
test esi, esi
je 0x4449b3
push esi
push 1
push 0x50118
push 0x4e7870
call fcn.0049528d
add esp, 0x10
cmp eax, 1
jne 0x4449aa
push esi
push eax
push dword [0x537980]
push dword [0x537984]
call fcn.0049528d
add esp, 0x10
push esi
call fcn.00494b54
add esp, 4
push dword [0x537984]
call fcn.00494034
add esp, 4
mov byte [0x4e7870], 0
mov dword [0x53799c], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00493955
mov esp, ebp
pop ebp
ret
Function at 0x44f090
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x5619c0], 0
jne 0x44f0d2
cmp dword [0x5379c8], 0
je 0x44f0d2
push 0x100
push 0
push 0x5431a0
call fcn.0049cbc0
push 0x400
push 0
push 0x5433b8
call fcn.0049cbc0
add esp, 0x18
mov dword [0x5379bc], 0
ret
mov eax, dword [0x543098]
mov ecx, 0x40
push esi
push edi
mov esi, 0x5432a8
mov dword [0x5433a8], eax
mov eax, dword [0x5432a0]
mov edi, 0x5431a0
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x100
mov dword [0x5433b4], eax
mov esi, 0x5437c0
mov edi, 0x5433b8
rep movsd dword es:[edi], dword [esi]
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [0x5379c8]
xor edx, edx
and eax, 1
cmp dword [0x5619c0], edx
pop edi
cmovne ecx, edx
test ecx, ecx
pop esi
cmovne eax, edx
mov dword [0x5379bc], eax
ret

Function at 0x44f560
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x58c460]
mov ecx, dword [eax + 8]
mov eax, dword [0x58c464]
add ecx, ecx
mov eax, dword [eax + 0x24]
mov eax, dword [eax + ecx*8 - 4]
xor ecx, ecx
test eax, eax
cmovg ecx, eax
mov eax, 0xff
cmp ecx, eax
cmovl eax, ecx
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
jmp fcn.0044fd30

Function at 0x44f5a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x58c460]
push esi
mov ecx, dword [eax + 8]
mov eax, dword [0x58c464]
add ecx, ecx
cmp dword [0x4e4e68], 0xffffffff
mov eax, dword [eax + 0x24]
mov esi, dword [eax + ecx*8 - 4]
jne 0x44f5f9
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
test esi, esi
je 0x44f5db
test eax, eax
je 0x44f5df
xor ecx, ecx
pop esi
jmp fcn.0044fd30
test eax, eax
je 0x44f5f9
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x14
call esi
push 0
push 2
push 0
push 0x14
call esi
xor ecx, ecx
pop esi
jmp fcn.0044fd30

Function at 0x4506d0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x100
jge 0x45074e
lea eax, [eax + eax*4]
shl eax, 4
push 0x50
add eax, 0x28
add eax, esi
push 0
push eax
call fcn.0049cbc0
mov eax, dword [esi]
add esp, 0xc
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, dword [esi + ecx*8 - 0x20]
mov dword [esi + ecx*8 + 0x30], eax
mov eax, dword [esi]
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, dword [esi + ecx*8 + 0x30]
mov dword [esi + ecx*8 + 0x2c], eax
mov eax, dword [esi]
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, dword [esi + ecx*8 - 0x28]
mov dword [esi + ecx*8 + 0x28], eax
mov eax, dword [esi]
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, dword [esi + ecx*8 - 0x18]
mov dword [esi + ecx*8 + 0x38], eax
cmp esi, dword [0x58c464]
jne 0x45074c
mov eax, dword [esi]
lea eax, [eax + eax*4]
shl eax, 4
add eax, 0x28
add eax, esi
mov dword [0x58c460], eax
pop esi
ret
push 0x4c6714
call fcn.004857d0
add esp, 4
push 0xffffffffffffffff
call fcn.0049501f
int3
Function at 0x451a30
Capabilities:
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x5379f8], 0
jne 0x451c1d
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc], 2
push 0x4c3d40
mov ecx, str.save_cnmajiro_system.mss
mov dword [ebp - 4], esi
xor edi, edi
call fcn.0045e940
push eax
call fcn.00494396
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x451bc6
push eax
push 1
push 0x9c58
push 0x543bc0
call fcn.00495739
add esp, 0x10
cmp eax, 1
jne 0x451b98
mov dword [ebp - 0xc], eax
mov ecx, str.MajiroSysV1.100
mov eax, 0x543bc0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x451ac1
test dl, dl
je 0x451abd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x451ac1
add eax, 2
add ecx, 2
test dl, dl
jne 0x451aa1
xor eax, eax
jmp 0x451ac6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x451b98
mov eax, dword [0x543bd0]
mov dword [0x56c5e0], eax
lea ecx, [eax + 0x400]
mov dword [0x5619c8], ecx
add ecx, 0x20
shl ecx, 4
call fcn.00484ed0
mov ecx, dword [0x543bd0]
mov dword [0x5379f8], eax
lea ecx, [ecx + 0x20]
shl ecx, 4
call fcn.00484ed0
push dword [ebp - 8]
mov ecx, dword [0x543bd0]
mov edi, eax
push 1
shl ecx, 4
push ecx
push edi
mov dword [ebp - 0x10], edi
call fcn.00495739
add esp, 0x10
cmp eax, 1
jne 0x451b98
mov ecx, dword [0x543bd4]
test ecx, ecx
je 0x451b57
add ecx, 0x20
call fcn.00484ed0
push dword [ebp - 8]
mov esi, eax
push 1
push dword [0x543bd4]
mov dword [ebp - 4], esi
push esi
call fcn.00495739
add esp, 0x10
cmp eax, 1
jne 0x451b98
xor edi, edi
cmp dword [0x543bd0], edi
jle 0x451b8b
xor esi, esi
mov ecx, dword [0x5379f8]
mov edx, dword [ebp - 0x10]
push 0
push dword [ebp - 4]
lea ecx, [esi + ecx]
lea edx, [esi + edx]
call fcn.004511a0
inc edi
lea esi, [esi + 0x10]
add esp, 8
cmp edi, dword [0x543bd0]
jl 0x451b63
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0xc], 0
push dword [ebp - 8]
call fcn.00494b54
add esp, 4
test esi, esi
je 0x451bb0
push esi
call fcn.00494034
add esp, 4
test edi, edi
je 0x451bbd
push edi
call fcn.00494034
add esp, 4
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x451c1b
jmp 0x451bcb
mov esi, 2
push 0x4020
mov dword [0x56c5e0], 0
mov dword [0x5619c8], 0x400
call fcn.00497cab
mov edi, eax
add esp, 4
test edi, edi
jne 0x451c05
push 0x10
push str.malloc
push 0x4c9a90
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x5379f8], edi
cmp esi, 2
je 0x451c1b
push 0x4c67b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4525a0
Capabilities:
Read file on windows
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x58c460]
push ebx
push esi
push edi
mov ecx, dword [eax + 8]
mov eax, dword [0x58c464]
add ecx, ecx
mov eax, dword [eax + 0x24]
mov esi, dword [eax + ecx*8 - 0x14]
push dword [eax + ecx*8 - 4]
mov ecx, str.save_cnmajiro__04d.sav
call fcn.0045e940
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00493964
add esp, 0xc
mov ecx, str.save_cnmajiro__04d.sav
push esi
call fcn.0045e940
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00493964
add esp, 0xc
mov dword [ebp - 0x61c], 1
lea eax, [ebp - 0x218]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x45265a
lea eax, [ebp - 0x624]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call edi
mov dword [ebp - 0x61c], 0
lea eax, [ebp - 0x110]
push eax
call fcn.00495c9d
lea eax, [ebp - 0x218]
push 0x4c3d40
push eax
call fcn.00494396
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4526ed
lea eax, [ebp - 0x110]
push 0x4c3dd8
push eax
call fcn.00494396
mov edi, eax
add esp, 8
test edi, edi
je 0x4526d1
lea ebx, [ebx]
push ebx
push 0x400
lea eax, [ebp - 0x618]
push 1
push eax
call fcn.00495739
mov esi, eax
lea eax, [ebp - 0x618]
push edi
push esi
push 1
push eax
call fcn.0049528d
add esp, 0x20
cmp esi, 0x400
je 0x4526a0
push ebx
call fcn.00494b54
add esp, 4
test edi, edi
je 0x4526e7
push edi
call fcn.00494b54
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x61c], 0
jne 0x452731
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x452731
lea eax, [ebp - 0x624]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call edi
or ecx, 0xffffffff
call fcn.0044fd30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493955
mov esp, ebp
pop ebp
ret
Function at 0x452750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x4d3100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
test ebx, ebx
js 0x452828
cmp ebx, 0x2711
je 0x452828
cmp ebx, 0x2710
jge 0x4527a3
push ebx
mov ecx, str.save_cnmajiro__04d.sav
call fcn.0045e940
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00493964
add esp, 0xc
jmp 0x45284d
push edi
call fcn.00456860
mov edi, eax
call fcn.00456810
push 0
mov esi, eax
lea eax, [ebp - 0x318]
push 0x4c3c38
push eax
call fcn.00493964
push 0x200
lea eax, [ebp - 0x518]
mov edx, edi
push eax
lea eax, [ebp - 0x318]
mov ecx, esi
push eax
push str.QuickNum
call fcn.0047e280
lea eax, [ebp - 0x518]
push eax
call fcn.00494176
mov ecx, 0x271b
add esp, 0x20
sub ecx, ebx
add eax, ecx
and eax, 0x80000007
jns 0x45280a
dec eax
or eax, 0xfffffff8
inc eax
push eax
mov ecx, str.save_cnmajiro_quick_d.sav
call fcn.0045e940
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00493964
add esp, 0xc
pop edi
jmp 0x45284d
mov ecx, str.save_cnmajiro_last.sav
call fcn.0045e940
lea edx, [ebp - 0x118]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x452840
push 0x200
push 0
push 0x561be0
call fcn.0049cbc0
lea eax, [ebp - 0x118]
push 0x4c3d40
push eax
call fcn.00494396
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4528d8
push esi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.00495739
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, str.MajiroSavV1.105
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4528b1
test dl, dl
je 0x4528ad
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4528b1
add eax, 2
add ecx, 2
test dl, dl
jne 0x452891
xor eax, eax
jmp 0x4528b6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4528cf
push esi
push 1
push 0x200
push 0x561be0
call fcn.00495739
add esp, 0x10
push esi
call fcn.00494b54
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, 0x561be0
pop esi
xor ecx, ebp
pop ebx
call fcn.00493955
mov esp, ebp
pop ebp
ret