joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fbb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x46fbb8
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4a0a14
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4a0a62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004a04dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0a7b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b8998
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4b89a0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b8b05
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.0040a288
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004277d0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004278dc
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
call fcn.00427ccc
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0042757c
lea eax, [ebp - 0x2c]
mov edx, 0x4b8b20
call fcn.0040a41c
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004278dc
mov eax, dword [ebp - 0x28]
mov ecx, 1
pop edx
call fcn.0040a740
dec eax
je 0x4b8a3f
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
jne 0x4b8adb
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
jmp 0x4b8adb
lea eax, [ebp - 4]
call fcn.00427fe8
cmp dword [ebp - 4], 0
jne 0x4b8a5a
lea eax, [ebp - 4]
mov edx, 0x4b8b38
call fcn.00409c04
push 0x4b8b4c
push dword [ebp - 4]
push 0x4b8b8c
push 0x4b8b9c
push 0x4b8bdc
lea eax, [ebp - 8]
mov edx, 5
call fcn.0040a4fc
push 0
lea eax, [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 8]
call fcn.0040a224
push eax
call sub.advapi32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x4b8aa3
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
xor ebx, ebx
jmp 0x4b8adb
mov dword [ebp - 0x18], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
jne 0x4b8ad2
call sub.kernel32.dll_GetLastError
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8b0c
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.0040983c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040983c
pop eax
jmp eax
Function at 0x4b8ed4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
call fcn.00424ad8
cmp eax, 2
jne 0x4b8f3d
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4b8efd
xor eax, eax
jmp 0x4b8f4c
lea eax, [ebp - 0x10]
push eax
push 0x4b8f50
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4b8f3d
xor eax, eax
jmp 0x4b8f4c
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret

Function at 0x4b8f78
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4b8fd2
inc esi
xor edi, edi
cmp edi, 1
jne 0x4b8f9e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4b8fac
cmp edi, 1
jle 0x4b8fac
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042c2b8
test eax, eax
jne 0x4b8fd2
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4b8fd2
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4b8fd2
inc edi
dec esi
jne 0x4b8f8e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4b8fdc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4b9000
mov eax, dword [ebp - 4]
jmp 0x4b9003
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b9008
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x4b9055
xor ebx, ebx
jmp 0x4b904a
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.0041e3fc
test eax, eax
jne 0x4b9049
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x4b9100
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4b902b
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4b9061
je 0x4b906a
jmp 0x4b9073
call fcn.004280d4
mov esi, eax
jmp 0x4b9075
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x4b9075
xor esi, esi
test si, si
je 0x4b9100
xor ebx, ebx
jmp 0x4b909b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x4b909a
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4b9100
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4b9082
xor ebx, ebx
jmp 0x4b90f5
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x4b90f4
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x4b90e9
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.004b8fdc
push eax
mov eax, esi
call fcn.004b8fdc
pop edx
cmp edx, eax
jne 0x4b90f4
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4b9100
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4b90aa
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4b94fc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b95d5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4b95f0
push ebx
push 0x4b9600
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a4fc
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040754c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a224
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4b957e
mov ax, 0x83
call fcn.004b9110
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004b94cc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4b9587
call fcn.004b94cc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b95dc
lea eax, [ebp - 4]
call fcn.004097dc
pop eax
jmp eax
Function at 0x4b96f4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea esi, [ebp - 0x4c]
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [ebp - 4]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4b97b7
jmp 0x4b97ab
cmp dword [esi + 0x10], 0x1000
jne 0x4b9799
test byte [esi + 0x15], 1
jne 0x4b9799
mov byte [ebp - 5], 0
cmp dword [esi + 0x14], 1
je 0x4b9750
cmp dword [esi + 0x14], 2
je 0x4b9750
cmp dword [esi + 0x14], 0x10
je 0x4b9750
cmp dword [esi + 0x14], 0x20
jne 0x4b976a
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4b976a
mov byte [ebp - 5], 1
xor ebx, ebx
jmp 0x4b977a
mov eax, dword [esi]
add eax, ebx
call fcn.004b96ec
add ebx, dword [ebp - 0x2c]
cmp ebx, dword [esi + 0xc]
jb 0x4b976e
cmp byte [ebp - 5], 0
je 0x4b9799
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4b97b7
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 4]
je 0x4b9725
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
mov ecx, 0x7e6e4d29
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x7eac3e16
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x449e10
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
push str.UxTheme.dll
mov ebx, eax
mov dword [esi], edi
call ebp
mov dword [esi + 4], eax
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov eax, dword [0x64cc24]
cmp eax, edi
jne 0x449ecb
cmp dword [0x64cc28], edi
jne 0x449ecb
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp ebx, edi
mov dword [0x64cd10], eax
je 0x449e7a
mov ecx, dword [0x64cddc]
push 0x64cae8
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
cmp ebx, edi
jne 0x449e9c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x449ebe
push str.GetLogicalProcessorInformation
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetLogicalProcessorInformationEx
push ebx
mov dword [0x64cc24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x64cc28], eax
mov edx, dword [0x64cd10]
push edx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.dwmapi.dll
call ebp
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
cmp eax, edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
je 0x449ef3
push str.OpenThemeData
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x14], eax
jmp 0x449f26
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov eax, dword [esi + 8]
cmp eax, edi
je 0x449f44
push str.DwmIsCompositionEnabled
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x58], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x654324], 1
mov dword [0x654320], 1
mov dword [0x65431c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x65300c], eax
mov eax, dword [0x654330]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x654344]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x65432c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x5fc4fc], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x4230e0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
call method.util.init_crc32_table__
test esi, esi
je 0x423280
lea ecx, [ebx + esi]
mov eax, 0xffffffff
and esi, 7
je 0x4231ba
cmp esi, 1
je 0x42319c
cmp esi, 2
je 0x423186
cmp esi, 3
je 0x423170
cmp esi, 4
je 0x42315a
cmp esi, 5
je 0x423144
cmp esi, 6
jne 0x423260
mov edx, eax
xor al, byte [ebx]
add ebx, 1
movzx esi, al
shr edx, 8
xor edx, dword [esi*4 + 0x653da0]
mov eax, edx
mov edx, eax
xor al, byte [ebx]
add ebx, 1
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x653da0]
mov eax, edx
mov esi, eax
xor al, byte [ebx]
add ebx, 1
movzx edx, al
shr esi, 8
xor esi, dword [edx*4 + 0x653da0]
mov eax, esi
mov esi, eax
xor al, byte [ebx]
add ebx, 1
movzx eax, al
shr esi, 8
xor esi, dword [eax*4 + 0x653da0]
mov eax, esi
mov edx, eax
xor al, byte [ebx]
add ebx, 1
movzx esi, al
shr edx, 8
xor edx, dword [esi*4 + 0x653da0]
mov eax, edx
mov edx, eax
xor al, byte [ebx]
add ebx, 1
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x653da0]
mov eax, edx
cmp ebx, ecx
je 0x423254
mov edx, eax
xor al, byte [ebx]
add ebx, 8
movzx esi, al
shr edx, 8
xor edx, dword [esi*4 + 0x653da0]
mov eax, edx
xor dl, byte [ebx - 7]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x653da0]
mov edx, eax
xor al, byte [ebx - 6]
movzx esi, al
shr edx, 8
xor edx, dword [esi*4 + 0x653da0]
mov eax, edx
xor dl, byte [ebx - 5]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x653da0]
mov edx, eax
xor al, byte [ebx - 4]
movzx esi, al
shr edx, 8
xor edx, dword [esi*4 + 0x653da0]
mov eax, edx
xor dl, byte [ebx - 3]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x653da0]
mov edx, eax
xor al, byte [ebx - 2]
movzx esi, al
shr edx, 8
xor edx, dword [esi*4 + 0x653da0]
mov eax, edx
xor dl, byte [ebx - 1]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x653da0]
cmp ebx, ecx
jne 0x4231ba
not eax
pop ebx
pop esi
ret
movzx eax, byte [ebx]
add ebx, 1
xor al, 0xff
mov eax, dword [eax*4 + 0x653da0]
xor eax, 0xffffff
jmp 0x42312e
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4646a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14
cmp byte [esp + 0x30], 1
mov ecx, dword [esp + 0x28]
sbb eax, eax
mov esi, dword [esp + 0x2c]
mov edx, eax
mov edi, eax
and edx, 0x8bcf82ec
and edi, 0xe92ce14a
lea ebx, [edx + 0x352027e9]
mov edx, eax
and eax, 0x4e9246b0
sub eax, 0xc211a59
and edx, 0x70b468d2
lea ebp, [edi - 0x697e77b6]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
lea ebx, [edx + 0x9f4fbbd]
mov eax, 0xc6ef3720
mov edi, dword [ecx]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebx
mov dword [esp], eax
lea esi, [esi]
mov edx, dword [esp + 4]
mov ebx, dword [esp]
mov ebp, edi
mov eax, dword [esp + 0x10]
shl ebp, 4
add ebp, edx
add ebx, edi
shr edi, 5
xor ebx, ebp
add edi, eax
mov eax, dword [esi]
mov ebp, dword [esp + 0xc]
xor edi, ebx
mov ebx, dword [esp + 8]
sub eax, edi
mov edi, eax
mov edx, eax
mov dword [esi], eax
shl edi, 4
shr edx, 5
add edi, ebp
add edx, ebx
xor edx, edi
mov edi, dword [esp]
add eax, edi
add edi, 0x61c88647
xor edx, eax
mov eax, dword [ecx]
sub eax, edx
mov edx, dword [esp + 4]
mov ebp, eax
lea ebx, [edi + eax]
mov dword [ecx], eax
shr eax, 5
shl ebp, 4
add ebp, edx
xor ebx, ebp
mov ebp, dword [esp + 0x10]
add eax, ebp
mov ebp, dword [esp + 0xc]
xor eax, ebx
mov ebx, dword [esi]
sub ebx, eax
mov eax, ebx
mov dword [esi], ebx
mov edx, ebx
shr ebx, 5
shl eax, 4
add edx, edi
mov edi, dword [esp]
add eax, ebp
mov ebp, ebx
mov ebx, dword [esp + 8]
add ebp, ebx
xor eax, ebp
xor edx, eax
mov eax, dword [ecx]
sub eax, edx
mov edx, dword [esp + 4]
sub edi, 0x3c6ef372
mov ebp, eax
lea ebx, [edi + eax]
mov dword [ecx], eax
shr eax, 5
shl ebp, 4
add ebp, edx
xor ebx, ebp
mov ebp, dword [esp + 0x10]
add eax, ebp
mov ebp, dword [esp + 0xc]
xor eax, ebx
mov ebx, dword [esi]
sub ebx, eax
mov eax, ebx
mov dword [esi], ebx
mov edx, ebx
shr ebx, 5
shl eax, 4
add edx, edi
mov edi, dword [esp]
add eax, ebp
mov ebp, ebx
mov ebx, dword [esp + 8]
add edi, 0x255992d5
add ebp, ebx
xor eax, ebp
xor edx, eax
mov eax, dword [ecx]
sub eax, edx
mov edx, dword [esp + 4]
mov ebp, eax
lea ebx, [edi + eax]
mov dword [ecx], eax
shr eax, 5
shl ebp, 4
add ebp, edx
mov edx, dword [esi]
xor ebx, ebp
mov ebp, dword [esp + 0x10]
add eax, ebp
xor eax, ebx
sub edx, eax
mov dword [esi], edx
mov eax, edx
mov ebx, dword [esp + 0xc]
mov ebp, edx
shl eax, 4
shr ebp, 5
add edx, edi
mov edi, dword [ecx]
add eax, ebx
mov ebx, dword [esp + 8]
add ebp, ebx
xor eax, ebp
xor edx, eax
sub edi, edx
sub dword [esp], 0x78dde6e4
mov dword [ecx], edi
jne 0x464708
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x473b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, ecx
sub esp, 0x28
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x988]
cmp eax, dword [ecx + 0x98c]
je 0x473b9c
mov dword [ecx + 0x98c], eax
lea edx, [esp + 0x1c]
mov dword [esp], eax
add ecx, 0x988
mov dword [esp + 8], edx
mov dword [esp + 4], 0x9600
mov dword [esp + 0x1c], 0xffffffff
call method.std::vector_unsigned_int__std::allocator_unsigned_int___._M_fill_insert___gnu_cxx::__normal_iterator_unsigned_int__std::vector_unsigned_int__std::allocator_unsigned_int_______unsigned_int__unsigned_int_const_
mov ecx, dword [ebx]
movzx eax, byte [ebx + 0x1fc]
sub esp, 0xc
mov edx, dword [ecx + 0x99c]
test byte [edx + 0xb], 2
je 0x473c00
test al, al
js 0x473bec
movzx ecx, word [0x604d46]
mov word [ebx + 0x1fc], cx
add esp, 0x28
mov ecx, ebx
pop ebx
jmp method.AGB_SIO.vrs_draw_menu__
test al, al
js 0x473bec
add esp, 0x28
mov ecx, ebx
pop ebx
jmp method.AGB_SIO.vrs_draw_track__

Function at 0x47c710
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
cmp edi, ecx
je 0x47c75b
mov edx, dword [edi + 4]
mov eax, dword [ecx]
mov ebx, ecx
mov ebp, dword [edi]
mov ecx, dword [ecx + 8]
mov esi, edx
sub esi, ebp
sub ecx, eax
cmp ecx, esi
jb 0x47c7a8
mov ecx, dword [ebx + 4]
mov dword [esp + 0x1c], ecx
sub ecx, eax
cmp ecx, esi
jb 0x47c768
cmp edx, ebp
je 0x47c792
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], eax
call sym._memmove
add esi, dword [ebx]
mov dword [ebx + 4], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4
test ecx, ecx
je 0x47c78c
mov dword [esp + 8], ecx
mov dword [esp + 4], ebp
mov dword [esp], eax
call sym._memmove
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov edx, dword [edi + 4]
mov ebp, dword [edi]
mov dword [esp + 0x1c], ecx
sub ecx, eax
add ebp, ecx
cmp ebp, edx
jne 0x47c800
add esi, eax
mov dword [ebx + 4], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4
cmp esi, 0x7ffffffe
ja 0x47c820
mov dword [esp], esi
mov dword [esp + 0x1c], edx
call sym.operator_new_unsigned_int_
mov ecx, dword [esp + 0x1c]
mov edi, eax
cmp ecx, ebp
je 0x47c7d6
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], eax
call sym._memcpy
mov ebp, dword [ebx]
test ebp, ebp
je 0x47c7ed
mov edx, dword [ebx + 8]
mov dword [esp], ebp
sub edx, ebp
mov dword [esp + 4], edx
call sym.operator_delete_void__unsigned_int_
add esi, edi
mov dword [ebx], edi
mov dword [ebx + 8], esi
jmp 0x47c794
mov edi, dword [esp + 0x1c]
sub edx, ebp
mov dword [esp + 4], ebp
mov dword [esp + 8], edx
mov dword [esp], edi
call sym._memmove
add esi, dword [ebx]
jmp 0x47c794
call sym.std::__throw_bad_array_new_length__
nop
lea esi, [esi]
lea esi, [esi]
Function at 0x4ba260
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [esp + 0x20]
mov edx, eax
movzx esi, al
shr dx, 8
add esi, esi
and edx, 0xf
test al, al
jns 0x4ba288
mov ecx, eax
neg ecx
movzx esi, cl
neg esi
add esi, esi
movzx edx, dl
jmp dword [edx*4 + 0x607e4c]