joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41212c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestSegmentedVector.exe_gMozillaPoisonSize], eax
call fcn.0040e476
pop ecx
mov ecx, dword [sym.TestSegmentedVector.exe_gMozillaPoisonSize]
mov dword [sym.TestSegmentedVector.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x412164
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestSegmentedVector.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x41f9d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab223
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6398ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], esi
xorps xmm0, xmm0
mov dword [esi], vtable.Lunaris::__common_event.0
movq qword [esi + 4], xmm0
lea eax, [esi + 0xc]
mov dword [ebp - 4], 0
push 0x102
push eax
call fcn.0057d0ce
add esp, 8
mov byte [ebp - 4], 1
mov word [esi + 0x3c], 0
mov dword [esi + 0x40], 0
call fcn.0042c450
test al, al
jne 0x41fa57
push fcn.0058021a
push 0x5020701
call fcn.0042c280
add esp, 8
test al, al
je 0x41fad6
mov byte [esi + 0x3c], 1
call fcn.0042e730
mov dword [esi + 0x40], eax
test eax, eax
je 0x41faf1
push 4
call fcn.0057fe99
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [eax], esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x427830
push 0
push 0
call fcn.0058560b
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x41fac8
cmp dword [esi + 8], 0
jne 0x41fb07
mov ecx, dword [ebp - 0x18]
mov dword [esi + 4], eax
mov eax, esi
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x18], 0
call fcn.0057e01b
push str.Cant_start_Allegro_
lea ecx, [ebp - 0x20]
call fcn.0041ace0
push 0x63465c
lea eax, [ebp - 0x20]
push eax
call fcn.005827fb
lea ecx, [ebp - 0x20]
call fcn.0041aa80
push 0x634830
lea eax, [ebp - 0x20]
push eax
call fcn.005827fb
call fcn.00588990
int3
Function at 0x4243a0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab6ad
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6398ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0057fe99
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0057efd3
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 1
mov ebx, dword [ebp - 0x10]
mov dword [ebx], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
cmp dword [eax + 0x14], 0x10
mov esi, dword [eax + 0x10]
jb 0x42446f
mov eax, dword [eax]
mov dword [ebp + 8], eax
xor eax, eax
cmp esi, 0x7fffffff
ja 0x424510
test esi, esi
je 0x4244f4
cmp esi, 0x1000
jb 0x4244ac
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x424515
push eax
call fcn.0057fe99
add esp, 4
test eax, eax
je 0x42451a
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x4244b7
push esi
call fcn.0057fe99
add esp, 4
mov edi, eax
push esi
push dword [ebp + 8]
push edi
call fcn.00581a40
mov eax, dword [ebx + 0xc]
lea ecx, [esi + edi]
mov dword [ebx + 0x38], ecx
add esp, 0xc
mov dword [eax], edi
mov eax, dword [ebx + 0x1c]
mov dword [eax], edi
mov eax, dword [ebx + 0x2c]
mov dword [eax], esi
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x38]
sub ecx, edi
mov dword [eax], edi
mov eax, dword [ebx + 0x20]
mov dword [eax], edi
mov eax, dword [ebx + 0x30]
mov dword [eax], ecx
mov eax, 1
jmp 0x4244f7
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0057e11d
call fcn.0041ab40
call fcn.00589a51
int3
Function at 0x424900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ab700
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6398ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0057fe99
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0057efd3
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4322d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
call fcn.00588a45
mov ecx, 0x63d008
mov edi, dword [eax]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4322e3
lea eax, [ebp + 0xc]
sub ecx, edx
push eax
push 0
push dword [ebp + 8]
mov eax, 0x800
sub eax, ecx
push eax
lea eax, [ecx + 0x63d008]
push eax
call fcn.0041a960
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00588627
mov eax, dword [0x66c318]
add esp, 0x1c
test eax, eax
je 0x432337
push 0x63d008
call eax
add esp, 4
mov byte [0x63d008], 0
pop edi
pop ebp
ret
push esi
push 0x63d008
call fcn.00454aa0
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._al_trace_suffix
push str.C:dev_allegro_winpkguniversal_allegro_srcdebug.c
push 0x13e
push esi
call fcn.00432e10
mov eax, dword [0x637d94]
add esp, 0x10
pop esi
test eax, eax
je 0x43238e
push 0x63d008
push 0x5ad738
push eax
call fcn.00432440
push dword [0x637d94]
call fcn.0058ad70
add esp, 0x10
mov eax, dword [0x637d98]
mov byte [0x63d008], 0
test eax, eax
je 0x4323a5
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00588a45
mov dword [eax], edi
pop edi
pop ebp
ret
Function at 0x445220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x6398ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
cmp eax, 6
ja case.default.0x445241
jmp dword [eax*4 + 0x445470]
lea eax, [ebp - 0x310]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
ja case.default.0x445241
lea eax, [ebp - 0x310]
push eax
call fcn.00430da0
mov esi, eax
lea eax, [ebp - 0x108]
push 0x104
push eax
push esi
call fcn.00431060
push esi
call fcn.00430a70
lea eax, [ebp - 0x108]
push eax
call fcn.0042ef80
add esp, 0x18
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x104
lea ecx, [ebp - 0x310]
push ecx
push 0
push eax
call sub.KERNEL32.dll_K32GetModuleFileNameExW
lea eax, [ebp - 0x310]
push eax
call fcn.00430da0
mov esi, eax
lea eax, [ebp - 0x108]
push 0x104
push eax
push esi
call fcn.00431060
push esi
call fcn.00430a70
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.00582120
add esp, 0x1c
test eax, eax
je case.default.0x445241
mov byte [eax], 0
lea eax, [ebp - 0x108]
push eax
call fcn.0042ef80
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
mov edi, 0x1a
jmp 0x445338
mov edi, 0x28
jmp 0x445338
mov edi, 5
lea eax, [ebp - 0x310]
push eax
push 0
push 0
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne case.default.0x445241
lea eax, [ebp - 0x310]
push eax
call fcn.00430da0
mov esi, eax
lea eax, [ebp - 0x108]
push 0x104
push eax
push esi
call fcn.00431060
push esi
call fcn.00430a70
lea eax, [ebp - 0x108]
push eax
call fcn.0042ef80
mov esi, eax
add esp, 0x18
test esi, esi
je case.default.0x445241
push ebx
cmp edi, 0x1a
jne 0x4453cd
call fcn.0042c180
mov edi, eax
call fcn.0042c170
mov ebx, eax
test ebx, ebx
je 0x4453e0
cmp byte [ebx], 0
je 0x4453e0
test edi, edi
je 0x4453c3
cmp byte [edi], 0
je 0x4453c3
push edi
push esi
call fcn.0042ee20
add esp, 8
push ebx
push esi
call fcn.0042ee20
add esp, 8
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
push esi
call fcn.0042efd0
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x104
lea ecx, [ebp - 0x310]
push ecx
push 0
push eax
call sub.KERNEL32.dll_K32GetModuleFileNameExW
lea eax, [ebp - 0x310]
push eax
call fcn.00430da0
mov esi, eax
lea eax, [ebp - 0x108]
push 0x104
push eax
push esi
call fcn.00431060
push esi
call fcn.00430a70
lea eax, [ebp - 0x108]
push eax
call fcn.0042eed0
add esp, 0x18
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
Function at 0x448eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [eax]
mov ebx, dword [eax + 4]
movzx eax, word [eax + 8]
mov dword [ebp + 0x10], edi
mov ecx, eax
lea esi, [edi + 3]
and esi, 0xfffffffc
cmp eax, 8
jae 0x448ee2
mov eax, 8
xor edx, edx
div ecx
mov ecx, eax
jmp 0x448ee5
shr ecx, 3
push str.read_RGB_paletted_image
imul esi, ecx
push str.C:dev_allegro_winpkguniversal_allegro_addonsimage_bmp.c
push 0x2e0
push esi
call fcn.00432e30
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
jne 0x448f40
push str.read_RGB_paletted_image
push 0x2e3
push str.C:dev_allegro_winpkguniversal_allegro_addonsimage_bmp.c
push 2
push dword [0x638d50]
call fcn.004320f0
add esp, 0x14
test al, al
je 0x448f37
push str.Failed_to_allocate_pixel_row_buffer_n
call fcn.004322d0
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
sar eax, 0x1f
and eax, 2
dec eax
mov dword [ebp - 0x10], eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x448fdc
xor eax, eax
lea ecx, [ebx - 1]
test ebx, ebx
mov ebx, dword [ebp + 0x14]
cmovns eax, ecx
mov dword [ebp - 8], eax
nop
mov ecx, dword [ebp + 0x18]
push 0
push edi
mov esi, dword [ecx + 8]
imul esi, eax
add esi, dword [ecx]
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp + 0x1c]
xor edi, edi
add esp, 0x14
cmp dword [ebp + 0x10], edi
jle 0x448fca
lea eax, [esi + 2]
mov ecx, dword [ebp - 4]
lea eax, [eax + 4]
movzx edx, byte [edi + ecx]
inc edi
mov esi, edx
add edx, edx
add esi, esi
movzx ecx, byte [ebx + esi*8]
mov byte [eax - 6], cl
movzx ecx, byte [ebx + edx*8 + 4]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + esi*8 + 8]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + esi*8 + 0xc]
mov byte [eax - 3], cl
cmp edi, dword [ebp + 0x10]
jl 0x448f95
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
sub dword [ebp - 0xc], 1
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
jne 0x448f70
push str.read_RGB_paletted_image
push str.C:dev_allegro_winpkguniversal_allegro_addonsimage_bmp.c
push 0x2f8
push dword [ebp - 4]
call fcn.00432e10
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44db90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6398ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.00588a45
mov dword [eax], 0
test esi, esi
jne 0x44dbd2
call fcn.00588a45
pop esi
mov dword [eax], 0xe
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
cmp word [esi], 0
jne 0x44dbf4
call fcn.00588a45
pop esi
mov dword [eax], 0x14
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44dc1c
call fcn.00588a45
pop esi
mov dword [eax], 2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
test al, 0x10
je 0x44dbd8
push 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0058faf5
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44dc40
push ebx
sub ecx, edx
sar ecx, 1
push str._wopendir
push str.C:dev_allegro_winpkguniversal_allegro_src_fshook_win.inc
push 0x7c
lea eax, [ecx*2 + 0x456]
push eax
call fcn.00432e30
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x44dc8f
call fcn.00588a45
pop ebx
pop esi
mov dword [eax], 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20c]
lea esi, [ebx + 0x448]
mov eax, ecx
mov edx, esi
sub edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x44dca1
push edi
cmp word [esi], ax
je 0x44dd33
mov edi, esi
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x44dcc0
sub edi, ecx
push 0x2f
push esi
sar edi, 1
call fcn.00582305
lea ecx, [edi + 0x223]
add esp, 8
lea ecx, [ebx + ecx*2]
cmp eax, ecx
je 0x44dd33
mov edi, esi
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x44dcf0
sub edi, ecx
push 0x5c
push esi
sar edi, 1
call fcn.00582305
lea ecx, [edi + 0x223]
add esp, 8
lea ecx, [ebx + ecx*2]
cmp eax, ecx
je 0x44dd33
lea edi, [esi - 2]
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x44dd20
mov eax, dword [0x5b0f7c]
mov dword [edi], eax
add esi, 0xfffffffe
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x44dd36
mov eax, dword [0x5b0f80]
mov edi, esi
push 0x104
mov dword [edi], eax
xor eax, eax
push eax
mov dword [ebx + 0x234], eax
lea eax, [ebx + 0x238]
push eax
mov dword [ebx + 0x440], 0xffffffff
mov dword [ebx + 0x444], 0
mov dword [ebx + 0x230], 0
call fcn.00581fc0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, ebx
xor ecx, ebp
pop edi
pop ebx
pop esi
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
Function at 0x44e080
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x20
push edi
mov edi, 0x10
movzx edx, word [esi + 0x16]
mov eax, edx
and eax, 0xf000
cmp eax, 0x4000
cmovne ecx, edi
mov dword [esi + 0xc], ecx
test edx, 0x100
je 0x44e0b6
or ecx, 1
mov dword [esi + 0xc], ecx
test dl, dl
jns 0x44e0c0
or ecx, 2
mov dword [esi + 0xc], ecx
test dl, 0x40
je 0x44e0cb
or ecx, 4
mov dword [esi + 0xc], ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 2
je 0x44e0dc
or dword [esi + 0xc], 8
pop edi
pop esi
pop ebp
ret

Function at 0x44e190
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6398ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.0059099a
add esp, 8
test eax, eax
jne 0x44e1d4
mov eax, dword [ebp - 0x2e]
and eax, 0xf000
cmp eax, 0x4000
pop esi
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret
push esi
call fcn.00590222
mov ecx, dword [ebp - 4]
add esp, 4
test eax, eax
sete al
xor ecx, ebp
pop esi
call fcn.0057fc8e
mov esp, ebp
pop ebp
ret

Function at 0x44e7e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 0xc]
push 0
push 0
push esi
push 0x44ea20
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x10]
push 0
push 0
mov byte [esi + 0x1c], 0
mov dword [esi + 0x24], eax
call fcn.0058560b
add esp, 0x18
mov dword [esi], eax
pop esi
pop ebp
ret
Function at 0x46dc60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x40c], 0
jne 0x46ddb0
mov eax, dword [esi + 0x25c]
push 0
mov dword [esi + 0x424], 0xffffffff
mov dword [esi + 0x428], 0xffffffff
mov dword [esi + 0x42c], 0xffffffff
mov dword [esi + 0x430], 0xffffffff
mov dword [esi + 0x434], 0xffffffff
mov dword [esi + 0x438], 0xffffffff
mov dword [esi + 0x448], 0xffffffff
mov dword [esi + 0x440], 0xffffffff
mov dword [esi + 0x43c], 0xffffffff
mov dword [esi + 0x444], 0xffffffff
mov ecx, dword [eax]
push 0x89
push eax
call dword [ecx + 0xe4]
mov eax, dword [esi + 0x25c]
push 1
push 0x16
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [esi + 0x25c]
push 1
push 0x1b
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
push esi
call fcn.0049bb40
mov eax, dword [esi + 0x25c]
add esp, 4
mov ecx, dword [eax]
push 3
push 1
push 0
push eax
call dword [ecx + 0x114]
test eax, eax
je 0x46dd66
push str.d3d_reset_state
push 0x175
push str.C:dev_allegro_winpkguniversal_allegro_srcwind3d_disp.cpp
push 3
push dword [0x639024]
call fcn.004320f0
add esp, 0x14
test al, al
je 0x46dd66
push str.SetSamplerState_failed_n
call fcn.004322d0
add esp, 4
mov eax, dword [esi + 0x25c]
push 3
push 2
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x114]
test eax, eax
je 0x46ddb0
push str.d3d_reset_state
push 0x177
push str.C:dev_allegro_winpkguniversal_allegro_srcwind3d_disp.cpp
push 3
push dword [0x639024]
call fcn.004320f0
add esp, 0x14
test al, al
je 0x46ddb0
pop esi
mov dword [ebp + 8], str.SetSamplerState_failed_n
pop ebp
jmp fcn.004322d0
pop esi
pop ebp
ret
Function at 0x478050
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp byte [0x6693d0], 0
je 0x478176
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
test bl, bl
je 0x478082
push ecx
call fcn.00478180
mov esi, eax
add esp, 4
test esi, esi
jne 0x478099
cmp ecx, 0x10
jne 0x478092
push 3
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
movzx esi, byte [ecx + 0x5c3210]
push 0
push esi
call fcn.00478320
mov eax, esi
add esp, 8
cdq
and edx, 0x1f
add eax, edx
mov edx, esi
sar eax, 5
and edx, 0x8000001f
jns 0x4780be
dec edx
or edx, 0xffffffe0
inc edx
mov ecx, dword [eax*4 + 0x66945c]
btr ecx, edx
mov dword [eax*4 + 0x66945c], ecx
cmp esi, 0xd7
jne 0x4780eb
test byte [0x669477], 1
je 0x478111
push dword [ebp + 0x14]
push ebx
push 0xa1
jmp 0x478108
cmp esi, 0xd8
jne 0x478111
test dword [0x669474], 0x800000
je 0x478111
push dword [ebp + 0x14]
push ebx
push 0xa0
push edi
call fcn.00478050
add esp, 0x10
push 0x6693d8
call fcn.0044d4e0
add esp, 4
test al, al
je 0x478173
mov dword [ebp - 0x40], 0xc
call fcn.0042c220
mov eax, dword [ebp + 0x14]
fstp qword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0
call fcn.00478430
mov eax, dword [0x66947c]
push 0x6693d8
mov dword [ebp - 0x24], eax
call fcn.0044d4c0
lea eax, [ebp - 0x40]
push eax
push 0x6693d8
call fcn.0044d400
push 0x6693d8
call fcn.0044d550
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49f4b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x49f4e7
push esi
call fcn.004a3440
add esp, 4
cmp byte [esi + 0x40], 0
je 0x49f4de
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
jmp 0x49f4f2
cmp eax, 0xcb
jne 0x49f56e
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x49f558
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x49f50f
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x49f552
cmp eax, 2
je 0x49f558
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x49f500
cmp eax, 3
je 0x49f537
cmp eax, 1
jne 0x49f500
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x49f500
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x49f500
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0049f5a0
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x49f590
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.0049f5a0
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x49f5a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x49f5ce
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x49f653
mov ecx, dword [esi + 0x78]
lea ebx, [esi + 0x78]
cmp ecx, dword [esi + 0x60]
jae 0x49f626
mov eax, dword [esi + 8]
mov edi, ecx
test eax, eax
je 0x49f607
mov dword [eax + 4], ecx
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
mov edi, dword [ebx]
add esp, 4
mov eax, dword [esi + 0x184]
push 0
push ebx
push 0
mov eax, dword [eax + 4]
push esi
call eax
mov ecx, dword [ebx]
add esp, 0x10
cmp ecx, edi
je 0x49f66a
cmp ecx, dword [esi + 0x60]
jb 0x49f5e5
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
xor ecx, ecx
mov eax, dword [esi + 0x180]
add esp, 8
cmp byte [eax + 8], cl
jne 0x49f5e0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret