joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462ecb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d2db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x29c
push edi
mov dword [ebp - 0x2a4], ecx
lea ecx, [ebp - 0x90]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
mov byte [ebp - 0x8c], 0
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x8b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x294], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x293]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2a0]
push eax
call fcn.00483c27
add esp, 4
mov dword [ebp - 0x2a8], eax
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx]
push edx
push str._s..path.ini
push 0xff
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea ecx, [ebp - 0x2a0]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x294]
push ecx
push 0x80
lea edx, [ebp - 0x8c]
push edx
push str.._face_
push str.face
push str.resource
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x29c]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 1
push 0x5c
lea ecx, [ebp - 0x29c]
call sub.MFC42.DLL_CString::ReverseFind
mov dword [ebp - 0x298], eax
mov ecx, dword [ebp - 0x298]
mov byte [ebp + ecx - 0x293], 0
mov byte [ebp - 0x194], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x193]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0x294]
push eax
push 0x4a3748
push 0x103
lea ecx, [ebp - 0x194]
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea edx, [ebp - 0x194]
push edx
call fcn.00413943
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x29c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x46323f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d316
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0xdc], 0
jne 0x4632b3
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
push str.CNewDDZApp::AvatarCtrlLoad___m_fSubModuleCreateObject__NULL
push 0x4a37cc
lea ecx, [ebp - 0x1c]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString
xor al, al
jmp 0x46341c
push 0x25005
push str.GAEngine.dll
mov edx, dword [ebp - 0x28]
call dword [edx + 0xdc]
add esp, 8
mov dword [0x4f720c], eax
cmp dword [0x4f720c], 0
jne 0x463335
push 0
push 0x4d5880
push str.g_pGameAvatarEngine
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 1
push str.CNewDDZApp::AvatarCtrlLoad___g_pGameAvatarEngine
push 0x4a3850
lea eax, [ebp - 0x20]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x20]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString
xor al, al
jmp 0x46341c
mov dword [ebp - 0x18], 0x5a
mov ecx, 0x4c8d68
call fcn.00404a50
mov dword [ebp - 0x10], eax
cmp dword [0x4a3f98], 0
je 0x463360
mov ecx, dword [0x4a3f98]
add ecx, 0x14
mov dword [ebp - 0x2c], ecx
jmp 0x463367
mov dword [ebp - 0x2c], 0
push 0x4a7740
mov edx, dword [ebp - 0x2c]
push edx
push 0x4a785c
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [0x4f720c]
mov edx, dword [ecx]
mov ecx, dword [0x4f720c]
call dword [edx + 0x10]
test eax, eax
jne 0x4633e9
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 2
push 0x4a3868
push 0x4a3890
lea eax, [ebp - 0x24]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CString::CString
push 0
push 0x4d5884
push str.g_pGameAvatarEngine_Initialize_failure
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x46341c
mov ecx, 0x4c8d30
call fcn.0042aa94
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x46341a
mov ecx, dword [0x4f7214]
push ecx
mov edx, dword [0x4f7210]
push edx
mov eax, dword [0x4f720c]
mov edx, dword [eax]
mov ecx, dword [0x4f720c]
call dword [edx + 0x14]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x463477
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d338
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x228]
cmp dword [eax + 0xd8], 0
jne 0x463665
mov dword [ebp - 0x118], 0
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x46352a
push 0x5c
lea edx, [ebp - 0x21c]
push edx
call fcn.004031a0
add esp, 8
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x463500
mov eax, dword [ebp - 0x118]
mov byte [eax], 0
push 0x5c
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004031a0
add esp, 8
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x46352a
mov edx, dword [ebp - 0x118]
mov byte [edx + 1], 0
push 0x104
push 0
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push str._sLogicGUFact.dll
push 0x103
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x228]
mov dword [ecx + 0xd8], eax
mov edx, dword [ebp - 0x228]
cmp dword [edx + 0xd8], 0
je 0x463614
push str.SubModuleCreateObject
mov eax, dword [ebp - 0x228]
mov ecx, dword [eax + 0xd8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x228]
mov dword [edx + 0xdc], eax
push str.SubModuleReleaseObject
mov eax, dword [ebp - 0x228]
mov ecx, dword [eax + 0xd8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x228]
mov dword [edx + 0xe0], eax
mov eax, dword [ebp - 0x228]
cmp dword [eax + 0xdc], 0
je 0x4635ff
mov ecx, dword [ebp - 0x228]
cmp dword [ecx + 0xe0], 0
je 0x4635ff
mov dword [ebp - 0x22c], 1
jmp 0x463609
mov dword [ebp - 0x22c], 0
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x10], edx
jmp 0x463663
lea ecx, [ebp - 0x220]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
push str.CNewDDZApp::LoadGameUseFactory___m_hGameUseFactoryModuleNULL
push 0x4a3954
lea eax, [ebp - 0x220]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x220]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call sub.MFC42.DLL_CString::CString
jmp 0x4636b4
lea ecx, [ebp - 0x224]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 1
push str.CNewDDZApp::LoadGameUseFactory___m_hGameUseFactoryModule_NULL
push 0x4a39ac
lea ecx, [ebp - 0x224]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.00402e50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x463c08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push edi
mov dword [ebp - 0x138], ecx
xor eax, eax
mov al, byte [0x4a30bc]
test eax, eax
jne 0x463c2d
mov eax, dword [0x4d586c]
jmp 0x463e3e
mov byte [0x4a30bc], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00483c27
add esp, 4
mov dword [ebp - 0x13c], eax
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx]
push eax
push str._s..QQGame.exe
push 0xff
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::CString
push 0
lea edx, [ebp - 0x104]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x463e39
mov eax, dword [ebp - 4]
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x108], ecx
cmp dword [ebp - 0x108], 0
je 0x463e2f
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x110], 0
lea edx, [ebp - 0x110]
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
lea edx, [ebp - 0x104]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x463e14
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
push 0x4a3c1c
mov edx, dword [ebp - 0x108]
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x463e14
mov dword [ebp - 0x128], 0
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x110]
mov edx, dword [ecx + 8]
shr edx, 0x10
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax + 8]
and ecx, 0xffff
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x110]
mov eax, dword [edx + 0xc]
shr eax, 0x10
xor edx, edx
mov ecx, 0x64
div ecx
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x110]
mov eax, dword [edx + 0xc]
shr eax, 0x10
mov ecx, dword [ebp - 0x120]
imul ecx, ecx, 0x64
sub eax, ecx
mov dword [ebp - 0x11c], eax
mov edx, dword [ebp - 0x110]
mov eax, dword [edx + 0xc]
and eax, 0xffff
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x128]
imul ecx, ecx, 0x989680
mov edx, dword [ebp - 0x124]
imul edx, edx, 0x186a0
add ecx, edx
mov eax, dword [ebp - 0x120]
imul eax, eax, 0x2710
add eax, dword [ebp - 0x118]
mov edx, dword [ebp - 0x11c]
imul edx, edx, 0x64
add eax, ecx
add edx, eax
mov dword [0x4d586c], edx
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp - 0x108], 0
mov eax, dword [0x4d586c]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x465240
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d559
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push str.Tenio_Initialize_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp + 8], 0
je 0x4652b4
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jbe 0x4652b4
lea ecx, [ebp - 0x18]
call fcn.00465620
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00465740
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c]
call dword [eax + 0x38]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004656c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4652d0
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d579
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x244
push edi
lea ecx, [ebp - 0x1c]
call fcn.00465620
mov dword [ebp - 4], 0
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 0x10], 0xffffffff
setne al
and eax, 0xff
test eax, eax
je 0x465454
lea ecx, [ebp - 0x1c]
call fcn.00465720
test eax, eax
je 0x465454
mov dword [ebp - 0x240], 0
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x23c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x240], 0x224
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4653ac
mov dword [ebp - 0x244], 0
push str.TenioDllFreeMap
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x465398
call dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x465367
lea ecx, [ebp - 0x1c]
call fcn.00465740
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x24c]
call dword [edx + 0x2c]
push 1
lea ecx, [ebp - 0x1c]
call fcn.00465740
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x250]
call dword [edx + 8]
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x46544a
mov dword [ebp - 0x248], 0
push str.TenioSetDllSafe
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x465436
push 0
call dword [ebp - 0x248]
add esp, 4
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x465400
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Tenio_Uninitialize_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004656c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x465930
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push edi
mov byte [ebp - 0x400], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x404], 0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x404], eax
mov ecx, dword [ebp - 0x404]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x3ff
push 0x400
lea eax, [ebp - 0x400]
push eax
call dword [0x49d97c]
add esp, 0x14
mov dword [ebp - 0x404], 0
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x465b80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
mov dword [ebp - 0x218], ecx
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov byte [ebp - 3], al
push 0xa
lea ecx, [ebp - 0xc]
push ecx
push 0x49db80
push str.NotUseDefaultDllPath
push 0x49db3c
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x218]
call fcn.00465cc0
movsx eax, byte [ebp - 0xc]
cmp eax, 0x31
jne 0x465bec
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x218]
call fcn.004660e0
jmp 0x465cb2
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp + 8]
push edx
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0
push str.DllPath
push str.DefaultValue
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x218]
call fcn.00465f30
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x218]
call fcn.00465ee0
test eax, eax
je 0x465c98
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x218]
call fcn.004660e0
jmp 0x465cb2
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x218]
call fcn.00465e10
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x469583
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x4c8d68
call fcn.0045dea3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4695aa
xor eax, eax
jmp 0x4696e2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
and edx, 0x40
test edx, edx
je 0x4695cf
push 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813ab
jmp 0x4695e5
push 4
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813d9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
and edx, 0x10000000
test edx, edx
je 0x46960d
push 3
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813ab
jmp 0x469623
push 3
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813d9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
and edx, 0x20000000
test edx, edx
je 0x46964b
push 2
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813ab
jmp 0x469661
push 2
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813d9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
and edx, 0x40000000
test edx, edx
je 0x469689
push 8
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813ab
jmp 0x46969f
push 8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813d9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
and edx, 0x80000000
test edx, edx
je 0x4696c7
push 8
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813ab
jmp 0x4696dd
push 8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0xaf34
call fcn.004813d9
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x47d22b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x4a6100
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47d270
push 0
push 0
push 0x4a6104
call sub.MFC42.DLL_AfxMessageBox_1
jmp 0x47d2fd
mov ecx, dword [ebp - 8]
push ecx
push 1
push 4
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jbe 0x47d2e2
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x47d2d2
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 4], 1
jmp 0x47d2e0
push 0
push 0
push str.new_data_failed
call sub.MFC42.DLL_AfxMessageBox_1
jmp 0x47d2f0
push 0
push 0
push 0x4a6128
call sub.MFC42.DLL_AfxMessageBox_1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47d790
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push edi
mov dword [ebp - 0x318], ecx
mov eax, dword [ebp - 0x318]
mov dword [eax], 0
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x47d8e9
mov byte [ebp - 0x210], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x314], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x5c
lea edx, [ebp - 0x104]
push edx
call fcn.004031a0
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x47d83c
mov eax, dword [ebp - 0x10c]
mov byte [eax], 0
push 0x5c
lea ecx, [ebp - 0x104]
push ecx
call fcn.004031a0
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x47d866
mov edx, dword [ebp - 0x10c]
mov byte [edx + 1], 0
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str..path.ini
lea edx, [ebp - 0x210]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x210]
push eax
push 0x104
lea ecx, [ebp - 0x314]
push ecx
push str..python24.dll
push str.PythonDLL
push str.FileName
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x314]
push edx
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 0x318]
mov dword [edx], eax
mov eax, dword [ebp - 0x318]
pop edi
mov esp, ebp
pop ebp
ret