joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e90f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x401c
call fcn.00483980
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
mov dword [esi + 0x4c], 0x104
je 0x47e93a
push edi
push 1
push dword [ebp + 0x14]
push esi
call ebx
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x47e948
mov eax, 0x1002
jmp 0x47e95d
mov ecx, dword [ebp + 8]
push eax
call fcn.0047a88a
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x47e97d
mov eax, 0x1003
cmp ebx, edi
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], 0x105
je 0x47ead1
push eax
push 4
push dword [ebp + 0x14]
push esi
call ebx
jmp 0x47ead1
push 1
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
fldz
mov ecx, eax
fstp qword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cdq
mov dword [ebp - 4], eax
mov eax, ecx
cdq
xor ebx, ebx
or ebx, eax
mov eax, dword [ebp - 4]
or eax, edx
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], 2
mov ecx, dword [ebp - 8]
push 0x4000
lea eax, [ebp - 0x401c]
push eax
push edi
push 0xa
call fcn.004700a7
mov ebx, eax
cmp ebx, edi
jbe 0x47ea56
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x401c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47ea5e
add dword [esi + 0x10], ebx
mov dword [ebp - 0x1c], ebx
fild dword [ebp - 0x1c]
adc dword [esi + 0x14], edi
test ebx, ebx
jge 0x47ea1a
fadd qword [0x48e498]
fild dword [esi + 0xc]
fmul qword [0x494b90]
fdivp st(1)
fmul qword [0x4881e8]
fadd qword [ebp - 0x14]
fst qword [ebp - 0x14]
call fcn.004839c0
cmp dword [ebp - 4], eax
mov dword [esi + 0x48], eax
je 0x47ea54
cmp dword [ebp + 0x10], edi
mov dword [ebp - 4], eax
je 0x47ea54
push eax
push 2
push dword [ebp + 0x14]
push esi
call dword [ebp + 0x10]
test eax, eax
jne 0x47ea67
cmp ebx, edi
jne 0x47e9cd
jmp 0x47ea6e
mov dword [esi + 0x50], 0x1004
jmp 0x47ea6e
mov dword [esi + 0x50], 3
push dword [ebp - 8]
mov ecx, dword [ebp + 8]
call fcn.0047a8fb
mov eax, dword [esi + 0x50]
dec eax
dec eax
mov dword [esi + 0x4c], 0x105
je 0x47ea97
dec eax
jne 0x47eac0
mov eax, 0x1009
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
jmp 0x47eac0
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push edi
push 0x930
push ecx
push eax
call fcn.00483eb0
or ecx, ebx
mov dword [ebp - 0x10], edx
je 0x47eab6
xor ecx, ecx
inc ecx
jmp 0x47eab8
xor ecx, ecx
add ecx, eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x50], edi
cmp dword [ebp + 0x10], edi
je 0x47ead1
push dword [esi + 0x50]
push 4
push dword [ebp + 0x14]
push esi
call dword [ebp + 0x10]
mov eax, dword [esi + 0x50]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x481426
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push 0x6b
mov dword [esi], eax
push dword [0x4aefc8]
call dword [sym.imp.USER32.dll_LoadBitmapW]
push eax
push 0
push 0x172
push 0x3ee
push dword [esi]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0x40
lea eax, [ebp - 0x80]
push eax
push 0x250
push dword [0x4aefc8]
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [esi + 0xc]
movsx eax, byte [eax]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x104]
push 0x40
push eax
call fcn.00402fc5
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
push 0x3ec
push dword [esi]
call edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call ebx
push dword [esi + 0x28]
push 0x3f2
push dword [esi]
call edi
push eax
call ebx
push 0x3f6
push dword [esi]
call edi
push dword [esi + 0x20]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [esi + 0x20]
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00480fe6
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4815ae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
cmp edx, edi
mov esi, ecx
jne 0x4815cb
mov eax, 0x106
jmp 0x4816ba
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
jne 0x4815dc
mov eax, 0x104
jmp 0x4816ba
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x4815ed
mov eax, 0x105
jmp 0x4816ba
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
push ebx
mov ebx, dword [ebp + 0x20]
and eax, 4
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x1c]
push edi
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x14]
push 0x66
push 5
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x28], eax
mov dword [esi + 4], ebx
mov dword [esi], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 1
mov dword [esi + 0x24], edi
push dword [0x4aefc8]
mov dword [ebp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
cmp eax, edi
je 0x48164d
push eax
push dword [0x4aefc8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0x10], eax
push esi
push 0x481526
push ebx
push dword [ebp + 0x10]
push dword [0x4aefc4]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
test eax, eax
jne 0x48166e
mov eax, 0x102
jmp 0x4816b9
mov ebx, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x48169f
cmp eax, 0xffffffff
je 0x4816af
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x48169f
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
push edi
push dword [esi]
lea eax, [ebp - 0x1c]
push eax
call ebx
cmp eax, edi
jne 0x481676
jmp 0x4816b6
mov dword [esi + 0x18], 0x103
mov eax, dword [esi + 0x18]
pop ebx
pop edi
pop esi
leave
ret 0x1c
Function at 0x481ae2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
push dword [ebp + 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 4], eax
push 0x80
lea eax, [esi + 0x18]
push eax
call fcn.0047aaff
mov eax, dword [ebp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
xor edi, edi
push edi
push edi
push edi
push edi
mov dword [esi + 0x118], eax
mov dword [esi + 0x11c], edi
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0xc], eax
call ebx
mov dword [esi + 0x10], eax
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x481a3e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 0x10]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x481c10
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi], 0
and dword [esi + 4], 0
and dword [esi + 8], 0
pop esi
ret
Function at 0x481f81
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
cmp ecx, ebx
jne 0x481fa1
mov eax, 0x104
jmp 0x482104
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x481fb2
mov eax, 0x105
jmp 0x482104
or dword [esi + 0x18], 0xffffffff
or dword [esi + 0x1c], 0xffffffff
or dword [esi + 0x20], 0xffffffff
push edi
mov edi, dword [esi + 0x14]
cmp edi, ebx
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov dword [esi], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 1
je 0x481fe6
mov ecx, edi
call fcn.00481a39
push edi
call sub.NSCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, esi
mov dword [esi + 0x14], ebx
call fcn.00481c57
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x482103
cmp eax, 2
je 0x482103
cmp eax, 0x101
je 0x482103
push ebx
push 9
push 5
push dword [0x4aefc8]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
cmp eax, ebx
je 0x482035
push eax
push dword [0x4aefc8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push esi
push 0x481f0a
push dword [ebp + 0x14]
push edi
push dword [0x4aefc4]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
test eax, eax
jne 0x482059
mov eax, 0x102
jmp 0x482103
push 0x30
lea eax, [ebp - 0x7c]
push eax
push 0x245
push dword [0x4aefc8]
call dword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xfc]
push 0x40
push eax
call fcn.00402fc5
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0x10
lea eax, [ebp - 0xfc]
push eax
push 0x3ec
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp + 0x10]
push 1
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x4820ea
cmp eax, 0xffffffff
je 0x4820f9
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x4820ea
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call edi
cmp eax, ebx
jne 0x4820c1
jmp 0x482100
mov dword [esi + 0x10], 0x103
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4822a2
Capabilities:
Hide graphical window

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x184
mov eax, dword [ebp + 0x7c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov esi, ecx
mov dword [esi + 4], eax
push 0x60
lea eax, [ebp - 0x110]
push eax
push 0x251
push dword [0x4aefc8]
call edi
push dword [esi]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x50]
push 0x62
push eax
call fcn.00402fc5
add esp, 0x10
lea eax, [ebp - 0x50]
push eax
push 0x3ec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x3eb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x62
mov dword [ebp + 0x7c], eax
lea eax, [ebp - 0x50]
push eax
push 0x252
push dword [0x4aefc8]
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x50]
push eax
push 0
push 0x143
push dword [ebp + 0x7c]
call ebx
push 0x62
lea eax, [ebp - 0x50]
push eax
push 0x253
push dword [0x4aefc8]
call edi
lea eax, [ebp - 0x50]
push eax
xor edi, edi
push edi
push 0x143
push dword [ebp + 0x7c]
call ebx
push edi
push edi
push 0x14e
push dword [ebp + 0x7c]
call ebx
push edi
push 0x103eb
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4

Function at 0x48279b
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push 1
mov edi, 0x3e9
push edi
mov esi, ecx
push eax
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push edi
push dword [esi + 8]
call ebx
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebp
push 0x30
call sub.NSCRT.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x4827e3
mov ecx, eax
call fcn.00482b3e
jmp 0x4827e5
xor eax, eax
test eax, eax
mov dword [esi + 0xc], eax
jne 0x4827fa
push 0x106
push dword [esi + 8]
call dword [sym.imp.USER32.dll_EndDialog]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
mov dword [esi + 0x14], eax
call fcn.00482111
push 1
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0x3e8
push 0x7bc
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetTimer]
push 0x640000
push 0
push 0x401
push 0x3ea
push dword [esi + 8]
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0xc]
push 0
push esi
push 0x482617
push dword [esi + 0x10]
push dword [esi]
call fcn.00482d4f
push 1
push edi
push dword [esi + 8]
call ebx
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4829cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceExW]
push ebp
push esi
push edi
push 0
mov esi, ecx
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
push 0x68
push 5
mov dword [esi + 0x28], eax
push dword [0x4aefc8]
call ebx
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_LoadResource]
je 0x482a08
push eax
push dword [0x4aefc8]
call ebp
jmp 0x482a0a
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push esi
push 0x4824d7
push dword [esp + 0x24]
push eax
push dword [0x4aefc4]
call edi
test eax, eax
jne 0x482a6d
push eax
push 0x67
push 5
push dword [0x4aefc8]
call ebx
test eax, eax
je 0x482a43
push eax
push dword [0x4aefc8]
call ebp
jmp 0x482a45
xor eax, eax
push esi
push 0x482889
push dword [esp + 0x24]
push eax
push dword [0x4aefc4]
call edi
cmp eax, 7
jne 0x482a62
push 2
pop eax
jmp 0x482a6d
mov ecx, 0x1000
cmp ecx, eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x482d4f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x14]
push edi
push 1
mov dword [esi + 0x28], eax
call fcn.00482b22
cmp dword [esi + 0x18], edi
mov ecx, esi
push edi
je 0x482d85
push 0x1001
call fcn.00482b22
xor eax, eax
jmp 0x482e81
push 2
call fcn.00482b22
mov ecx, dword [esi + 0x10]
cmp ecx, edi
jne 0x482da2
push 0x1003
push 0x1002
jmp 0x482e77
lea eax, [ebp + 8]
push eax
push 3
push 0x17
call fcn.00475aa3
cmp eax, edi
mov dword [esi + 0x24], eax
je 0x482dc1
push eax
push 0x1003
jmp 0x482e77
mov ecx, dword [esi + 0x10]
push edi
push edi
push edi
lea eax, [ebp + 0x10]
push eax
push edi
push edi
push edi
lea eax, [ebp + 8]
push eax
push 3
push 0xd
call fcn.0047f021
cmp eax, edi
mov dword [esi + 0x24], eax
je 0x482ded
push eax
push 0x1004
jmp 0x482e77
cmp dword [ebp + 0x10], edi
jne 0x482dfa
push edi
push 0x1005
jmp 0x482e77
push esi
push dword [ebp + 8]
push dword [esi + 0x10]
call fcn.0047f0bf
add esp, 0xc
cmp eax, edi
mov dword [esi + 0x24], eax
je 0x482e18
push eax
push 0x1006
jmp 0x482e77
push dword [ebp + 0xc]
mov ecx, dword [esi + 0x10]
lea eax, [esi + 4]
push eax
push 3
push 0x18
call fcn.004700a7
cmp eax, edi
mov dword [esi + 0x24], eax
jne 0x482e71
push edi
push 3
mov ecx, esi
call fcn.00482b22
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp dword [ebp + 0x18], edi
mov dword [esi + 0x1c], eax
je 0x482e59
push esi
call fcn.00482bca
mov dword [esi + 0x24], eax
jmp 0x482e7e
lea eax, [ebp + 0x14]
push eax
push edi
push esi
push fcn.00482bca
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
jmp 0x482e7e
push eax
push 0x1008
mov ecx, esi
call fcn.00482b22
mov eax, dword [esi + 0x24]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x483c80
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x494d78
call fcn.00483f54
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x483cc0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x483cc0
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x483cd8
cmp eax, 0x20b
je 0x483cc5
mov dword [ebp - 0x1c], ebx
jmp 0x483cec
cmp dword [ecx + 0x84], 0xe
jbe 0x483cc0
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x483ce6
cmp dword [ecx + 0x74], 0xe
jbe 0x483cc0
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.NSCRT.dll___set_app_type]
pop ecx
or dword [0x4b1594], 0xffffffff
or dword [0x4b1598], 0xffffffff
call dword [sym.imp.NSCRT.dll___p__fmode]
mov ecx, dword [0x4b0024]
mov dword [eax], ecx
call dword [sym.imp.NSCRT.dll___p__commode]
mov ecx, dword [0x4b0020]
mov dword [eax], ecx
mov eax, dword [sym.imp.NSCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4b1590], eax
call fcn.00483fac
call fcn.0045b3b5
cmp dword [0x49cc40], ebx
jne 0x483d4c
push fcn.0045b3b5
call dword [sym.imp.NSCRT.dll___setusermatherr]
pop ecx
call fcn.0048403a
push 0x49b114
push 0x49b110
call sub.NSCRT.dll__initterm
push 0x483ff0
call fcn.00483aa8
mov eax, dword [0x4b001c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4b0018]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.NSCRT.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x483da0
push 8
call sub.NSCRT.dll__amsg_exit
pop ecx
push 0x49b10c
push section..data
call sub.NSCRT.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.NSCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x483e1e
cmp al, bl
je 0x483dca
cmp dword [ebp - 0x20], ebx
jne 0x483e1e
mov al, byte [esi]
cmp al, bl
je 0x483dda
cmp al, 0x20
ja 0x483dda
inc esi
mov dword [ebp - 0x24], esi
jmp 0x483dca
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x483df6
movzx eax, word [ebp - 0x54]
jmp 0x483df9
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.0045624b
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x483e16
push esi
call dword [sym.imp.NSCRT.dll_exit]
call dword [sym.imp.NSCRT.dll__cexit]
jmp 0x483e73
cmp al, 0x22
jne 0x483e2d
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.NSCRT.dll__ismbblead]
pop ecx
test eax, eax
je 0x483e40
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x483db8
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00483f8f
ret
Function at 0x403f60
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, eax
lea eax, [ebp - 8]
push eax
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x4040ad
mov ecx, dword [ebp - 8]
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x403fb9
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call edi
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403fd0
sub eax, edx
sar eax, 1
je 0x403ffa
lea eax, [esi + eax*2]
cmp esi, eax
jae 0x403ffa
add eax, 0xfffffffe
je 0x403ffa
movzx eax, word [eax]
cmp eax, 0x5c
je 0x404015
cmp eax, 0x2f
je 0x404015
push 0x424570
push 0x104
push esi
call fcn.004189a2
add esp, 0xc
test eax, eax
jne 0x4040a7
cmp word [esi], 0
mov eax, esi
je 0x40403e
lea ecx, [ecx]
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x40402d
cmp ecx, 0x2f
jne 0x404035
mov ecx, 0x5c
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x404020
push 0x424574
push 0x104
push esi
call fcn.004189a2
add esp, 0xc
test eax, eax
jne 0x4040a7
push eax
push esi
call edi
call fcn.00403ee0
test eax, eax
jne 0x4040a7
mov eax, esi
call fcn.00403f30
push str.Nobunaga1
push 0x104
push esi
call fcn.004189a2
add esp, 0xc
test eax, eax
jne 0x4040a7
push eax
push esi
call edi
call fcn.00403ee0
test eax, eax
jne 0x4040a7
mov eax, esi
call fcn.00403f30
push str.SAVEDATA.NB1
push 0x104
push esi
call fcn.004189a2
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4040c0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x210], ebx
test esi, esi
je 0x40411d
cmp dword [ebp + 8], 0
je 0x40411d
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0041d160
add esp, 0xc
lea eax, [ebp - 0x20c]
call fcn.00403f60
test eax, eax
je 0x40412f
push 0x4243ec
mov ecx, 0x10
call fcn.004039f0
add esp, 4
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004186ce
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404184
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4041c0
push 0x424418
lea ecx, [eax + 0xe]
call fcn.004039f0
add esp, 4
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004186ce
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push 0
lea edx, [ebp - 0x214]
push edx
push eax
push esi
push edi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4041a4
xor ebx, ebx
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x214], ecx
je 0x4041b1
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4041c0
test ebx, ebx
jne 0x4041d2
mov ebx, dword [ebp - 0x210]
push 0x424434
mov ecx, 0x10
jmp 0x404169
mov ebx, dword [ebp - 0x210]
push 0x42445c
mov ecx, 0x40
call fcn.004039f0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004186ce
mov esp, ebp
pop ebp
ret
Function at 0x404200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0x210], edi
test esi, esi
je 0x404314
cmp dword [ebp + 8], 0
je 0x404314
push ebx
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0041d160
add esp, 0xc
lea eax, [ebp - 0x20c]
call fcn.00403f60
test eax, eax
je 0x40425b
push 0x424474
jmp 0x4042c8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4042c3
mov eax, dword [ebp + 8]
push 0
lea edx, [ebp - 0x214]
push edx
push eax
push esi
push ebx
mov edi, 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4042a1
xor edi, edi
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x214], ecx
je 0x4042ae
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4042bd
test edi, edi
jne 0x4042ea
mov edi, dword [ebp - 0x210]
push 0x4244a0
mov ecx, 0x10
mov ebx, edi
call fcn.004039f0
add esp, 4
pop ebx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004186ce
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x210]
push 0x4244c8
mov ecx, 0x40
call fcn.004039f0
add esp, 4
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004186ce
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
or eax, 0xffffffff
pop edi
call fcn.004186ce
mov esp, ebp
pop ebp
ret