joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401ea5
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x5c]
cmp edx, 0x77
je 0x401eaf
mov eax, 0xfffffffe
jmp 0x401fcf
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
mov edx, 0x4000
sub edx, dword [ecx + 0x10]
mov dword [ebp - 8], edx
je 0x401f12
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x48]
push ecx
call fcn.00474e4d
add esp, 0x10
cmp eax, dword [ebp - 8]
je 0x401efc
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], 0xffffffff
or eax, 0xffffffff
jmp 0x401fcf
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x48]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x4000
cmp dword [ebp - 0xc], 0
je 0x401f1d
jmp 0x401fb1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x68]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x10]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x68], edx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004028e0
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + 0x68]
sub ecx, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x68], ecx
cmp dword [ebp - 8], 0
jne 0x401f70
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0xfffffffb
jne 0x401f70
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x401f8b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 1
je 0x401f8b
mov dword [ebp - 0x10], 0
jmp 0x401f92
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x38], 0
je 0x401fac
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 1
je 0x401fac
jmp 0x401fb1
jmp 0x401eb9
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 1
jne 0x401fc3
mov dword [ebp - 0x14], 0
jmp 0x401fcc
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x40f390
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x404
lea eax, [esp]
push esi
push edi
push 0x3e8
push ecx
push eax
call fcn.0046d4e0
add esp, 0xc
lea ecx, [esp + 8]
call fcn.0040e3d0
test eax, eax
je 0x40f3cf
push 0x49d228
call fcn.0040e1d0
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x404
ret
call fcn.0040e280
mov eax, dword [0x4af158]
test eax, eax
je 0x40f3e6
push eax
call fcn.0046b2fc
add esp, 4
push 0x40
call fcn.0046b317
mov ecx, dword [0x246d5a8]
add esp, 4
mov dword [0x4af158], eax
mov dword [0x246cd48], 0
test ecx, ecx
jne 0x40f41e
push dword [0x246d5b0]
push 0x40
push 1
push eax
call fcn.004748bb
add esp, 0x10
jmp 0x40f462
cmp ecx, 1
jne 0x40f436
push 0x40
push eax
push dword [0x246cd4c]
call fcn.00401850
add esp, 0xc
jmp 0x40f462
mov ecx, dword [0x246d5b4]
sub esp, 0xc
call fcn.00463f30
mov edx, dword [0x4af158]
add esp, 0xc
push 0x40
call fcn.004640c0
mov ecx, dword [0x246d5b4]
add esp, 4
call fcn.00464360
mov eax, dword [0x246d5a8]
test eax, eax
jne 0x40f47b
push dword [0x246d5b0]
call fcn.0046b467
add esp, 4
jmp 0x40f495
cmp eax, 1
jne 0x40f490
push dword [0x246cd4c]
call fcn.004023d0
add esp, 4
jmp 0x40f495
call fcn.00463930
mov edx, dword [0x4af158]
cmp byte [edx], 0x37
jne 0x40f4c4
xor esi, esi
mov cl, byte [edx + esi*2]
movzx eax, cl
mov dword [0x246cd48], eax
mov al, byte [edx + esi*2 + 1]
mov byte [edx + esi*2], al
mov byte [edx + esi*2 + 1], cl
inc esi
cmp esi, 0x20
jl 0x40f4a2
mov dword [0x246d5ac], esi
mov al, byte [edx]
cmp al, 0x40
jne 0x40f50d
mov edi, 0x10
lea esi, [edx + 1]
mov dword [0x246d5ac], edi
nop dword [eax + eax]
movzx eax, byte [esi + 2]
lea esi, [esi + 4]
movzx ecx, byte [esi - 5]
mov byte [esi - 5], al
mov byte [esi - 2], cl
mov cl, byte [esi - 4]
movzx eax, cl
mov dword [0x246cd48], eax
movzx eax, byte [esi - 3]
mov byte [esi - 4], al
mov byte [esi - 3], cl
sub edi, 1
jne 0x40f4e0
jmp 0x40f523
cmp al, 0x80
jne 0x40f583
cmp byte [edx + 1], 0x37
jne 0x40f583
cmp byte [edx + 2], 0x12
jne 0x40f583
cmp byte [edx + 3], 0x40
jne 0x40f583
mov eax, dword [0x4af15c]
test eax, eax
jne 0x40f544
push 0x1000
call fcn.0046b317
mov edx, dword [0x4af158]
add esp, 4
mov dword [0x4af15c], eax
movups xmm0, xmmword [edx]
push edx
movups xmmword [eax], xmm0
movups xmm0, xmmword [edx + 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [edx + 0x20]
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [edx + 0x30]
movups xmmword [eax + 0x30], xmm0
call fcn.0046b2fc
mov eax, dword [0x4af288]
add esp, 4
mov dword [0x4af158], 0
pop edi
pop esi
add esp, 0x404
ret
push edx
call fcn.0046b2fc
add esp, 4
mov dword [0x4af158], 0
xor eax, eax
pop edi
pop esi
add esp, 0x404
ret
Function at 0x411330
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [0x248346c]
test esi, esi
je 0x4113c6
mov eax, dword [0x4af29c]
cmp eax, 3
je 0x411353
cmp eax, 1
je 0x411353
cmp eax, 2
jne 0x4113c6
push 0
push 0
push esi
call fcn.00474451
push esi
push 0x400
push 1
push 0x2498cf8
mov dword [0x2498cfc], 3
call fcn.00474e4d
push 2
push 0
push esi
call fcn.00474451
push 0
push 0x400
push dword [0x248346c]
call fcn.00474451
mov eax, dword [0x2498d10]
push dword [0x248346c]
lea eax, [eax*4 + 4]
push eax
push 1
push dword [0x24990f8]
call fcn.00474e4d
add esp, 0x44
push dword [0x248346c]
call fcn.00474140
add esp, 4
pop esi
ret
Function at 0x411f60
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4af29c]
sub esp, 0x214
push esi
or esi, 0xffffffff
push edi
cmp eax, 1
jne 0x41207b
mov eax, dword [0x248346c]
mov dword [0x4af29c], 0
test eax, eax
je 0x411f9f
push eax
call fcn.0046b467
add esp, 4
mov dword [0x248346c], 0
push str._VCR_:_Removing_files__nothing_recorded__n
call fcn.0040e1d0
add esp, 4
xor ecx, ecx
nop
mov al, byte [ecx + 0x2483260]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0xb], al
test al, al
jne 0x411fb0
push 0x104
push 0x49d770
push 0x2483260
call fcn.004745a0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call fcn.00475705
add esp, 4
test eax, eax
jns 0x412011
call fcn.00474f29
push dword [eax]
call fcn.004751a8
add esp, 4
push eax
push str._VCR_:_Couldnt_remove_save_state:__s_n
push 2
call fcn.00473dc9
add esp, 4
push eax
call fcn.0040d6c0
add esp, 0xc
xor ecx, ecx
mov al, byte [ecx + 0x2483260]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0xb], al
test al, al
jne 0x412013
push 0x104
push 0x49d79c
push 0x2483260
call fcn.004745a0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call fcn.00475705
add esp, 4
test eax, eax
jns 0x412074
call fcn.00474f29
push dword [eax]
call fcn.004751a8
add esp, 4
push eax
push str._VCR_:_Couldnt_remove_recorded_file:__s_n
push 2
call fcn.00473dc9
add esp, 4
push eax
call fcn.0040d6c0
add esp, 0xc
mov eax, dword [0x4af29c]
xor esi, esi
cmp eax, 3
jne 0x412148
mov ecx, 0x2498cf8
call fcn.00410da0
call fcn.00411330
push dword [0x248346c]
mov dword [0x4af29c], 0
call fcn.0046b467
mov eax, dword [0x2498d10]
add esp, 4
mov dword [0x248346c], 0
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push 0x2483260
lea edi, [eax*4 + 0x404]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x4120fb
push 0
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x2498d10]
push str._VCR_:_Record_stopped._Recorded__ld_input_samples_n
call fcn.0040e1d0
add esp, 8
mov ecx, 1
call fcn.0041f040
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x49b3e7
push 1
push 0x401
push dword [0x4b09c0]
call esi
push str.Stopped_recording.
push 0
push 0x401
push dword [0x4b09c0]
call esi
xor esi, esi
mov eax, dword [0x24990f8]
test eax, eax
je 0x412178
push eax
call fcn.0046b2fc
add esp, 4
mov dword [0x24990f8], 0
mov dword [0x2483258], 0
mov dword [0x2483364], 0
push 0x104
lea eax, [esp + 0x118]
push eax
push dword [0x4b09c4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x4af298]
lea eax, [esp + 0x114]
push eax
push dword [0x4b09c4]
mov byte [esp + ecx + 0x11c], 0
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
mov eax, esi
pop esi
add esp, 0x214
ret
Function at 0x412d60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x10c
cmp dword [0x4af298], 0
je 0x412da0
push 0x104
lea eax, [esp + 8]
push eax
push dword [0x4b09c4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [0x4af298]
mov byte [esp + eax + 4], 0
lea eax, [esp + 4]
push eax
push dword [0x4b09c4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [0x248346c]
mov eax, dword [0x4af29c]
test ecx, ecx
je 0x412dd1
cmp eax, 1
je 0x412dd1
cmp eax, 3
je 0x412dd1
push ecx
call fcn.0046b467
mov eax, dword [0x4af29c]
add esp, 4
mov dword [0x248346c], 0
cmp eax, 4
jne 0x412de9
mov dword [0x4af29c], 0
xor eax, eax
add esp, 0x10c
ret
cmp eax, 6
jne 0x412e4e
push dword [0x4aba54]
mov dword [0x4af29c], 0
push str._VCR_:_Playback_stopped___ld_samples_played__n
call fcn.0040e1d0
add esp, 8
mov ecx, 1
call fcn.0041f040
push 0x49b3eb
push 1
push 0x401
push dword [0x4b09c0]
call dword [sym.imp.USER32.dll_SendMessageA]
push str.Stopped_playback.
push 0
push 0x401
push dword [0x4b09c0]
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
add esp, 0x10c
ret
or eax, 0xffffffff
add esp, 0x10c
ret
Function at 0x413470
Capabilities:
Resume thread

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [0x4b0dc8]
push ebp
mov ebp, edx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
test ebx, ebx
jne 0x4134e6
cmp dword [0x4b0ee8], 0
je 0x4134d2
call fcn.00413730
push 1
push 0x426
push 0x402
push dword [0x4b1654]
mov dword [0x4b0dc8], 1
call esi
push 0
push 0x428
push 0x402
push dword [0x4b1654]
call esi
push 0
push 0x429
jmp 0x4134d9
push 0
push 0x426
push 0x402
push dword [0x4b1654]
call esi
cmp dword [0x4af114], 0
mov ecx, str.ReadScreen_not_implemented_by_this_graphics_plugin___substituting...
mov eax, str.ReadScreen_is_implemented_by_this_graphics_plugin.
cmove eax, ecx
push eax
call fcn.00419590
mov edi, dword [0x4af114]
add esp, 4
mov eax, fcn.004643e0
test edi, edi
cmove edi, eax
push 0x15888
push 0
push 0x2483470
mov dword [0x4af114], edi
call fcn.004682f0
add esp, 0xc
push 0x15888
push 0
push 0x246d9c0
call fcn.004682f0
add esp, 0xc
mov dword [0x4af2a0], 0
mov dword [0x248324c], 0
lea eax, [esp + 0x14]
mov dword [0x2483250], 0
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
cmp edi, fcn.004643e0
jne 0x41357d
call fcn.004643e0
jmp 0x41357f
call edi
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x413593
push eax
call fcn.0046b2fc
add esp, 4
push 1
call fcn.00410d00
mov edx, dword [esp + 0x1c]
mov ecx, ebp
push eax
push dword [esp + 0x1c]
call fcn.00464620
add esp, 0xc
mov dword [0x24990fc], 1
push 0x104
push ebp
push 0x2483368
call fcn.0046d4e0
add esp, 0xc
call fcn.0041f700
test ebx, ebx
je 0x4135e7
mov eax, dword [0x4af29c]
cmp eax, 6
je 0x4135e7
cmp eax, 4
je 0x4135e7
cmp eax, 5
jne 0x413632
cmp dword [0x4b0ee8], 0
je 0x41361e
push dword [0x24b17c0]
mov dword [0x4b0dc8], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
push 0x426
push 0x402
push dword [0x4b1654]
call esi
push 1
jmp 0x413620
push 0
push 0x428
push 0x402
push dword [0x4b1654]
call esi
push str._VCR_:_Starting_capture..._n
mov dword [0x4af294], 0
call fcn.0040e1d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x414410
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x84
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, edx
lea ebp, [ecx + ecx*4]
push edi
push 0x49eed4
push eax
call fcn.0040e260
add esp, 0xc
call fcn.00414390
mov ebx, dword [esp + 0x9c]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
movzx eax, bl
push eax
lea eax, [esp + 0x18]
push eax
push 0x49eedc
call esi
push edi
mov dword [ebp*4 + 0x4b01e4], eax
lea eax, [esp + 0x14]
push 0x49eee4
push eax
call fcn.0040e260
add esp, 0xc
call fcn.00414390
push eax
mov eax, ebx
shr eax, 8
and eax, 1
push eax
lea eax, [esp + 0x18]
push eax
push 0x49eef0
call esi
push edi
mov dword [ebp*4 + 0x4b01e8], eax
lea eax, [esp + 0x14]
push 0x49eef8
push eax
call fcn.0040e260
add esp, 0xc
call fcn.00414390
push eax
mov eax, ebx
shr eax, 9
and eax, 1
push eax
lea eax, [esp + 0x18]
push eax
push 0x49ef00
call esi
push edi
mov dword [ebp*4 + 0x4b01ec], eax
lea eax, [esp + 0x14]
push 0x49ef08
push eax
call fcn.0040e260
add esp, 0xc
call fcn.00414390
push eax
shr ebx, 0xa
lea eax, [esp + 0x14]
and ebx, 1
push ebx
push eax
push 0x49ef10
call esi
pop edi
mov dword [ebp*4 + 0x4b01f0], eax
mov eax, dword [esp + 0x94]
pop esi
mov dword [ebp*4 + 0x4b01f4], eax
pop ebp
pop ebx
add esp, 0x84
ret
Function at 0x418290
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetMessageA]
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
push 1
push 0xa
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov esi, 8
cmp esi, 0xa2
je 0x4183d8
cmp esi, 0xa3
je 0x4183d8
cmp esi, 0xa4
je 0x4183d8
cmp esi, 0xa5
je 0x4183d8
cmp esi, 0xa0
je 0x4183d8
cmp esi, 0xa1
je 0x4183d8
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x418378
cmp esi, 0x1b
je 0x418320
cmp esi, 0x20
jne 0x41834b
xor edi, edi
lea eax, [esp + 0x20]
push edi
push edi
push edi
push eax
call ebx
test eax, eax
jle 0x418347
cmp edi, 0x14
jge 0x418347
push 0
push 0
push 0
lea eax, [esp + 0x2c]
inc edi
push eax
call ebx
test eax, eax
jg 0x418330
mov edi, dword [esp + 0x14]
cmp esi, 0x11
jne 0x41835b
mov edi, 1
mov dword [esp + 0x14], edi
jmp 0x4183d8
cmp esi, 0x10
jne 0x41836a
mov dword [esp + 0x18], 1
jmp 0x4183d8
cmp esi, 0x12
jne 0x418401
lea ebp, [esi - 0x11]
jmp 0x4183d8
cmp esi, 0x11
jne 0x418398
test edi, edi
je 0x4183d8
mov eax, dword [esp + 0x10]
mov dword [eax + 8], 1
mov dword [eax + 0xc], 0
jmp 0x418472
cmp esi, 0x10
jne 0x4183cb
cmp dword [esp + 0x18], 0
je 0x4183d8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
pop ebx
add esp, 0x2c
ret
cmp esi, 0x12
jne 0x4183d8
test ebp, ebp
jne 0x418460
inc esi
cmp esi, 0xfe
jl 0x4182c0
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, 0x1f4
jl 0x4182b1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
cmp esi, 0x1b
je 0x418447
mov ebx, dword [esp + 0x10]
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
mov dword [ebx], esi
call ebp
xor ecx, ecx
test ax, ax
push 0x11
setne cl
mov dword [ebx + 4], ecx
call ebp
xor ecx, ecx
test ax, ax
push 0x12
setne cl
mov dword [ebx + 8], ecx
call ebp
xor ecx, ecx
test ax, ax
pop edi
pop esi
setne cl
pop ebp
mov dword [ebx + 0xc], ecx
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
pop edi
pop esi
pop ebp
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
pop ebx
add esp, 0x2c
ret
mov eax, dword [esp + 0x10]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 1
pop edi
pop esi
pop ebp
mov dword [eax + 4], 0
mov dword [eax], 0
pop ebx
add esp, 0x2c
ret
Function at 0x41a510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a70a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.004662fe
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x41a59b
push eax
push esi
call fcn.00466734
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.004664a8
int3

Function at 0x41ac20
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x24b180c], 0
push esi
je 0x41ac61
push 0
push dword [0x4b1654]
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x4b1654]
call esi
push 0
push dword [0x4b09c0]
call esi
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
pop esi
jmp dword [0x4aba14]
call dword [0x4aba14]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [0x4b1654]
call esi
push 1
push dword [0x4b1654]
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [0x4b09c0]
call esi
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
pop esi
ret
Function at 0x41c6f0
Capabilities:
Resume thread

Disassembly:
cmp dword [0x4b0ee8], 0
push ebx
mov ebx, dword [0x4b0dc8]
push edi
mov edi, ecx
je 0x41c767
test edi, edi
jne 0x41c735
push str.Resume_emulation
call fcn.00419590
add esp, 4
mov dword [0x4b0dc8], edi
push dword [0x24b17c0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x4a0f70
call fcn.00428fc0
add esp, 4
jmp 0x41c74b
push dword [0x24b17c0]
mov dword [0x4b0dc8], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
push 0x426
push 0x402
push dword [0x4b1654]
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
jmp 0x41c769
push 0
push 0x428
push 0x402
push dword [0x4b1654]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x4b0dc8]
cmp eax, ebx
je 0x41c7ac
test edi, edi
jne 0x41c7ac
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x426
push dword [0x4b09c4]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop ebx
ret

Function at 0x41c7b0
Capabilities:
Suspend thread

Disassembly:
cmp dword [0x4b0ee8], 0
push ebx
mov ebx, dword [0x4b0dc8]
push esi
push edi
mov edi, ecx
je 0x41c851
call fcn.00413730
test edi, edi
jne 0x41c803
push str.Pause_emulation
call fcn.00419590
add esp, 4
mov dword [0x4b0dc8], 1
push dword [0x24b17c0]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push str.Emulation_paused
call fcn.00428fc0
add esp, 4
jmp 0x41c80d
mov dword [0x4b0dc8], 1
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0x426
push 0x402
push dword [0x4b1654]
call esi
push 0
push 0x428
push 0x402
push dword [0x4b1654]
call esi
push 0
push 0x429
push 0x402
push dword [0x4b1654]
call esi
jmp 0x41c869
push 0
push 0x426
push 0x402
push dword [0x4b1654]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x4b0dc8]
cmp eax, ebx
je 0x41c89e
test edi, edi
jne 0x41c89e
cmp dword [0x24b1a00], edi
jne 0x41c89e
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x426
push dword [0x4b09c4]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebx
ret
Function at 0x41cfe0
Capabilities:
Create thread

Disassembly:
cmp dword [0x4b0ee8], 0
je 0x41d022
push str.Restart_Rom
call fcn.00419590
add esp, 4
mov dword [0x24b1810], 0
mov dword [0x4b1658], 1
push 0x24b19fc
push 0
push 0
push 0x41cc80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x41f5f0
Capabilities:
Create thread

Disassembly:
push esi
test ecx, ecx
je 0x41f68d
cmp dword [0x4af2ac], 0
je 0x41f60b
cmp dword [0x4af3ac], 0
je 0x41f629
mov ecx, dword [0x4af430]
call fcn.0040dd80
call fcn.00414e40
cmp dword [0x4af2a8], 0
jne 0x41f629
call fcn.00426420
call fcn.0040dd30
call fcn.00426330
cmp dword [0x4b1664], 0
je 0x41f668
push dword [0x4b1668]
call fcn.0046b2fc
add esp, 4
mov dword [0x4b1664], 0
mov dword [0x4b1660], 0
mov dword [0x4b1668], 0
mov eax, dword [0x24b1aa8]
test eax, eax
je 0x41f683
mov esi, dword [eax + 8]
push eax
call fcn.0046b2fc
add esp, 4
mov eax, esi
test esi, esi
jne 0x41f671
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop esi
ret
push 0x24b19fc
push 0
push 0
push 0x41cc80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret
Function at 0x426730
Capabilities:
Read .ini file

Disassembly:
movzx ecx, cl
push esi
mov esi, edx
cmp ecx, 0x70
ja case.0x426746.1
movzx eax, byte [ecx + 0x4268a0]
jmp dword [eax*4 + 0x426870]
mov eax, dword [str.Demo]
mov dword [esi], eax
mov al, byte [0x4a2004]
mov byte [esi + 4], al
jmp 0x426844
mov eax, dword [str.Beta]
mov dword [esi], eax
mov al, byte [0x4a200c]
mov byte [esi + 4], al
jmp 0x426844
movq xmm0, qword [str.USA_Japan]
movq qword [esi], xmm0
mov ax, word [0x4a2018]
mov word [esi + 8], ax
jmp 0x426844
mov eax, dword [str.German]
mov dword [esi], eax
mov ax, word [0x4a2020]
mov word [esi + 4], ax
mov al, byte [0x4a2022]
mov byte [esi + 6], al
jmp 0x426844
mov dword [esi], 0x415355
jmp 0x426844
mov eax, dword [str.France]
mov dword [esi], eax
mov ax, word [0x4a202c]
mov word [esi + 4], ax
mov al, byte [0x4a202e]
mov byte [esi + 6], al
jmp 0x426844
mov eax, dword [str.Italy]
mov dword [esi], eax
mov ax, word [0x4a2034]
mov word [esi + 4], ax
jmp 0x426844
mov eax, dword [str.Japan]
mov dword [esi], eax
mov ax, word [0x4a203c]
mov word [esi + 4], ax
jmp 0x426844
mov eax, dword [str.Spain]
mov dword [esi], eax
mov ax, word [0x4a2044]
mov word [esi + 4], ax
jmp 0x426844
movq xmm0, qword [str.Australia]
movq qword [esi], xmm0
mov ax, word [0x4a2050]
mov word [esi + 8], ax
jmp 0x426844
push str.Europe
push esi
call fcn.0040e260
add esp, 8
jmp 0x426844
push ecx
push str.Unknown___d_
push esi
call fcn.0040e260
add esp, 0xc
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x426862
push dword [eax]
push 0xc8
push esi
push esi
push esi
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop esi
ret
push esi
push esi
call fcn.0040e260
add esp, 8
pop esi
ret
Function at 0x427750
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x158
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, 0x4abb00
push esi
push edi
mov edi, 0x4abac0
nop word [eax + eax]
mov esi, dword [edi]
call fcn.00414390
push eax
push esi
push ebx
push str.Rom_Browser
call ebp
add ebx, 0x1e
mov dword [edi], eax
lea edi, [edi + 4]
cmp ebx, 0x4abbd2
jl 0x427770
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
movlpd qword [esp + 0x30], xmm0
mov dword [esp + 0x38], 0
nop dword [eax]
push 0
push 0
push 0x101c
push dword [0x4b0dd0]
call edi
cmp eax, 1
je 0x4277c0
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], 0xf
xor ebx, ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], eax
xor esi, esi
cmp esi, 6
ja case.default.0x4277fb
jmp dword [esi*4 + 0x4278c4]
mov eax, dword [0x4af45c]
jmp 0x427831
mov eax, dword [0x4af460]
jmp 0x427831
mov eax, dword [0x4af464]
jmp 0x427831
mov eax, dword [0x4af468]
jmp 0x427831
mov eax, dword [0x4af46c]
jmp 0x427831
mov eax, dword [0x4af470]
jmp 0x427831
mov eax, dword [0x4af474]
test eax, eax
je case.default.0x4277fb
mov eax, dword [esi*4 + 0x4abac0]
mov ecx, dword [0x24b1aa4]
mov dword [esp + 0x18], eax
mov eax, esi
shl eax, 4
sub eax, esi
mov dword [esp + 0x24], esi
lea eax, [eax*2 + 0x4abb00]
test ecx, ecx
je 0x427875
push dword [ecx]
push 0xc8
push 0x4b0ef0
push eax
push eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x427883
push eax
push 0x4b0ef0
call fcn.0040e260
add esp, 8
push 0x12c
lea eax, [esp + 0x40]
push 0x4b0ef0
push eax
call fcn.0046d4e0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
push 0x101b
push dword [0x4b0dd0]
call edi
inc ebx
inc esi
cmp esi, 7
jl 0x4277f2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x158
ret

Function at 0x427b60
Capabilities:
Read .ini file

Disassembly:
cmp dword [0x4b0ee8], 0
jne 0x427bda
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x427b93
push dword [eax]
push 0xc8
push 0x4b0ef0
push str.Total_ROMs
push str.Total_ROMs
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x427ba5
push str.Total_ROMs
push 0x4b0ef0
call fcn.0040e260
add esp, 8
push dword [0x24b1a94]
push 0x4b0ef0
push str._s:__d
push 0x4b0ef0
call fcn.0040e260
add esp, 0x10
push 0x4b0ef0
push 1
push 0x401
push dword [0x4b09c0]
call dword [sym.imp.USER32.dll_SendMessageA]
ret