joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424380
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
cmp dword [esp + 0x24], 3
je 0x4243a0
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
mov eax, dword [0x49a610]
test eax, eax
je 0x424510
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x42438c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x42438c
test byte [eax + 0x20], 0x30
je 0x424460
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x424500
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x424410
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x424402
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov edx, dword [ebx + 0xac]
mov dword [ebx + 0x34], 0xffffffff
test edx, edx
je 0x424566
mov eax, dword [0x49a610]
test eax, eax
je 0x424540
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [eax + 0x64]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x4244c0
test eax, eax
je 0x42447a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x64], 1
test eax, eax
jne 0x4244f0
test byte [ebx + 0x24], 4
je 0x4244d7
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x424409
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x424409
test eax, eax
je 0x4244d0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym._pthread_mutex_destroy
mov dword [ebx + 0x34], 0xffffffff
jmp 0x42438c
call sym.__pthread_cleanup_dest.part.3
jmp 0x424492
call sym.__pthread_cleanup_dest.part.3
jmp 0x4243de
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49a610], eax
jmp 0x4243ad
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49a610], eax
jmp 0x42443d
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x424430
Function at 0x425700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x42577b
test byte [ebx + 0x20], 0x30
je 0x425782
mov eax, dword [0x49a610]
test eax, eax
je 0x42580b
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x425772
cmp dword [eax + 0x14], 0
je 0x425795
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x425765
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x4257df
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x42571d
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4257ac
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x425802
mov eax, dword [0x49a610]
test eax, eax
je 0x425831
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x425772
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x4257bf
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x4257bf
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49a610], eax
jmp 0x425730
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x49a610], eax
jmp 0x4257c8
Function at 0x4280b0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.004158b0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x42819f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x428243
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x4281d8
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x4281d0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x428240
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x42825a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x428212
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x428212
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x428212
Function at 0x13554d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb36000]
push edi
or ebp, 0xffffffff
jmp 0x13554f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x13554f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13554e8
mov eax, 1
add ebx, ebx
jne 0x135550b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x135551c
jne 0x135553b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x135553b
dec eax
add ebx, ebx
jne 0x1355528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1355500
add ebx, ebx
jne 0x1355537
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x135558d
xor ecx, ecx
sub eax, 3
jb 0x1355553
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x13555c2
sar eax, 1
mov ebp, eax
jmp 0x135555e
add ebx, ebx
jne 0x135555e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x135552c
inc ecx
add ebx, ebx
jne 0x135556c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x135552c
add ebx, ebx
jne 0x1355579
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x135556e
jne 0x135558a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x135556e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x13555ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x135559e
jmp 0x13554ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x13555ac
add edi, ecx
jmp 0x13554ee
pop esi
mov edi, esi
mov ecx, 0x26486
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x13555ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x13555cf
lea edi, [esi + 0xf51000]
mov eax, dword [edi]
or eax, eax
je 0x1355637
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf83bb4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf83d14]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x13555f5
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf83d1c]
or eax, eax
je 0x1355631
mov dword [ebx], eax
add ebx, 4
jmp 0x1355612
call dword [esi + 0xf83d18]
mov ebp, dword [esi + 0xf83d20]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x135566b
sub esp, 0xffffff80
jmp 0xa1ac6c
Function at 0xabe058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xabe1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xabe07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xabe06a
add dl, dl
jne 0xabe089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xabe0dc
xor eax, eax
add dl, dl
jne 0xabe096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xabe17d
add dl, dl
jne 0xabe0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xabe0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xabe0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xabe0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xabe0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xabe075
mov eax, 1
add dl, dl
jne 0xabe0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xabe0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xabe0e1
sub eax, ebx
mov ebx, 1
jne 0xabe128
mov ecx, 1
add dl, dl
jne 0xabe10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xabe119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xabe105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xabe075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xabe13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xabe14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xabe136
cmp eax, 0x7d00
jae 0xabe16d
cmp eax, 0x500
jb 0xabe168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xabe075
cmp eax, 0x7f
ja 0xabe170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xabe075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xabe19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xabe075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x469720
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x56000]
push edi
jmp 0x46973a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x469741
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x469730
mov eax, 1
add ebx, ebx
jne 0x469753
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x469764
jne 0x469783
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x469783
dec eax
add ebx, ebx
jne 0x469770
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x469748
add ebx, ebx
jne 0x46977f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4697d5
xor ecx, ecx
sub eax, 3
jb 0x46979b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46980a
sar eax, 1
mov ebp, eax
jmp 0x4697a6
add ebx, ebx
jne 0x4697a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x469774
inc ecx
add ebx, ebx
jne 0x4697b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x469774
add ebx, ebx
jne 0x4697c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4697b6
jne 0x4697d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4697b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4697f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4697e6
jmp 0x469736
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4697f4
add edi, ecx
jmp 0x469736
pop esi
mov edi, esi
mov ecx, 0x1fff
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x469812
cmp byte [edi], 6
jne 0x469812
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x469817
lea edi, [esi + 0x66000]
mov eax, dword [edi]
or eax, eax
je 0x46988f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x69000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x69118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x469844
mov ecx, edi
jns 0x469873
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6911c]
or eax, eax
je 0x469889
mov dword [ebx], eax
add ebx, 4
jmp 0x469861
call dword [esi + 0x6912c]
mov ebp, dword [esi + 0x69120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4698c3
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x438c83
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
mov ebx, dword [esp]
add esp, 4
sub esi, 0xdfa60b1a
mov edi, 0x5fff30c
add edi, esi
call fcn.00438cc0
add esi, esi
add edi, esi
inc esi
xor dword [ecx], ebx
add edi, 1
sub edi, 0x53292963
inc ecx
add edi, edi
cmp ecx, eax
jne fcn.00438c83
dec edi
inc esi
ret
Function at 0x404400
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, al
shl cl, 3
sub cl, al
xor byte [eax + 0x4f60a0], cl
inc eax
cmp eax, 0x6c8
jl 0x404402
ret

Function at 0x404420
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
xor ebx, ebx
mov edx, 0x118
nop
movzx eax, byte [edi]
lea edi, [edi + 1]
or ax, si
add ax, dx
xor ax, dx
add edx, 0xffff
movzx esi, ax
add ebx, esi
shl esi, 8
test dx, dx
jne 0x404430
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x405110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [0x54e4cc], 0
mov al, cl
push ebx
push esi
push edi
mov byte [esp + 0xf], al
jne 0x40513d
test al, al
je 0x405368
push 0
push str.General_I_O_error_during_saving__Is_the_file_in_use_
jmp 0x405359
mov edi, dword [0x789c40]
mov ebx, dword [0x789c44]
push 0x4ddab0
push dword [0x54e4d0]
call fcn.00489507
mov esi, eax
add esp, 8
test esi, esi
je 0x4051a4
push esi
test ebx, ebx
je 0x40516f
push ebx
call fcn.004895db
jmp 0x405176
push 0x20
call fcn.004890c7
add esp, 8
push esi
push 0xa
call fcn.004890c7
add esp, 8
push esi
test edi, edi
je 0x405191
push edi
call fcn.004895db
jmp 0x405198
push 0x20
call fcn.004890c7
add esp, 8
push esi
call fcn.00489248
add esp, 4
cmp byte [0x552470], 0
je 0x405225
cmp byte [0x552471], 0
je 0x405225
cmp dword [0x50aec0], 0
je 0x405225
cmp byte [0x50add6], 0
je 0x405225
cmp dword [0x50aec0], 0
je 0x405225
call fcn.0047b6c0
test eax, eax
je 0x405225
mov ecx, dword [0x552478]
call fcn.0041f930
mov esi, eax
test esi, esi
je 0x405225
push 0x4ddab0
push dword [0x54e4d4]
call fcn.00489507
mov edi, eax
add esp, 8
test edi, edi
jne 0x40520c
push esi
call fcn.00489083
jmp 0x405222
push edi
push esi
call fcn.004895db
push esi
call fcn.00489083
add esp, 0xc
push edi
call fcn.00489248
add esp, 4
push 0x4ddc2c
push dword [0x54e4cc]
call fcn.00489507
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40534b
mov ecx, 0x55273c
call fcn.00404420
mov ecx, 0x5525a1
mov dword [0x55285b], eax
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405260
sub ecx, edx
mov byte [0x5525a0], cl
mov ecx, 0x5525f2
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405277
sub ecx, edx
mov byte [0x5525f1], cl
mov ecx, 0x552643
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405290
sub ecx, edx
mov byte [0x552642], cl
mov ecx, 0x552694
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4052a7
sub ecx, edx
mov byte [0x552693], cl
mov ecx, 0x5526e5
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4052c0
movups xmm0, xmmword [0x4ec720]
sub ecx, edx
mov esi, 0x5524c0
mov byte [0x5526e4], cl
mov edi, 0x4f60a0
movups xmmword [0x552510], xmm0
mov ecx, 0x1b2
movups xmm0, xmmword [0x4ec730]
movups xmmword [0x552520], xmm0
movups xmm0, xmmword [0x4ec740]
movups xmmword [0x552530], xmm0
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
nop dword [eax]
mov al, cl
shl al, 3
sub al, cl
xor byte [ecx + 0x4f60a0], al
inc ecx
cmp ecx, 0x6c8
jl 0x405310
push ebx
push 0x6c8
push 1
push 0x4f60a0
call fcn.0048a33c
push ebx
mov esi, eax
call fcn.00489248
add esp, 0x14
cmp esi, 0x6c8
je 0x405371
cmp byte [esp + 0xf], 0
je 0x405368
push 0
push str.General_I_O_error_during_config_saving__Is_the_file_in_use_
push str.System_message
push 0
call fcn.00441220
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409bc0
Capabilities:
Check if file exists

Disassembly:
push edi
test ecx, ecx
je 0x409beb
call fcn.00446070
mov edi, eax
test edi, edi
je 0x409beb
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
mov esi, eax
call fcn.00489083
add esp, 4
test esi, esi
setne al
pop esi
pop edi
ret
xor al, al
pop edi
ret

Function at 0x409bf0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x54e3ac]
mov edx, 0x6f
mov ecx, dword [0x54e3c0]
add eax, 0x12078
nop word [eax + eax]
mov dword [eax], ecx
lea eax, [eax + 0x9e0]
mov dword [eax - 0x9dc], ecx
mov dword [eax - 0x9d8], ecx
mov dword [eax - 0x9d4], ecx
mov dword [eax - 0x9d0], ecx
mov dword [eax - 0x9cc], ecx
mov dword [eax - 0x9c8], ecx
mov dword [eax - 0x9c4], ecx
mov dword [eax - 0x9c0], ecx
mov dword [eax - 0x9bc], ecx
mov dword [eax - 0x9b8], ecx
mov dword [eax - 0x9b4], ecx
mov dword [eax - 0x9b0], ecx
mov dword [eax - 0x9ac], ecx
mov dword [eax - 0x9a8], ecx
mov dword [eax - 0x9a4], ecx
mov dword [eax - 0x9a0], ecx
mov dword [eax - 0x99c], ecx
mov dword [eax - 0x998], ecx
mov dword [eax - 0x994], ecx
mov dword [eax - 0x990], ecx
mov dword [eax - 0x98c], ecx
mov dword [eax - 0x988], ecx
mov dword [eax - 0x984], ecx
mov dword [eax - 0x980], ecx
mov dword [eax - 0x97c], ecx
mov dword [eax - 0x978], ecx
mov dword [eax - 0x974], ecx
mov dword [eax - 0x970], ecx
mov dword [eax - 0x96c], ecx
mov dword [eax - 0x968], ecx
sub edx, 1
jne 0x409c10
push esi
push edi
mov dword [0x4f6094], edx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [0x4f6094]
xor edx, edx
mov ecx, 1
test eax, ecx
je 0x409d01
mov dword [esi*4 + 0x4f6790], edx
inc esi
cmp esi, 8
je 0x409d09
inc edx
rol ecx, 1
cmp edx, 0x20
jb 0x409cf0
mov dword [0x4f6094], esi
xor ecx, ecx
lea eax, [ecx + 0xfe]
inc ecx
movzx eax, ax
lea eax, [eax + eax*4]
mov byte [eax*8 + 0x4e8f1c], 0
mov byte [eax*8 + 0x4e8f1e], 0
cmp cx, 8
jb 0x409d11
xor edi, edi
test esi, esi
je 0x409d88
xor edx, edx
nop dword [eax]
mov eax, dword [edx*4 + 0x4f6790]
lea ecx, [eax*2 + 0x4eca98]
add ecx, eax
lea eax, [edx + edx*4]
mov dword [eax*8 + 0x4eb6bc], ecx
lea eax, [edi + 0xfe]
movzx eax, ax
lea eax, [eax + eax*4]
lea ecx, [eax*8 + 0x4e8f00]
mov byte [eax*8 + 0x4e8f1e], 1
cmp byte [ecx + 0x1e], 0
je 0x409d80
call fcn.0042dba0
inc edi
movzx edx, di
cmp edx, esi
jb 0x409d40
pop edi
pop esi
ret
Function at 0x40cbf0
Capabilities:
Get common file path

Disassembly:
push ecx
cmp byte [0x4ecae6], 0
je 0x40cc4e
mov eax, dword [0x4f676c]
cmp word [eax], 0
je 0x40cc17
push eax
call fcn.0048b7b0
add esp, 4
test eax, eax
je 0x40cc34
mov eax, dword [0x4f676c]
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push dword [0x4f676c]
call fcn.0048b7b0
add esp, 4
push 0x104
push dword [0x4f676c]
call fcn.0048b0ae
add esp, 8
mov byte [0x4ecae6], 0
cmp byte [0x54e623], 0
je 0x40cc5c
call fcn.00428dc0
call fcn.00412620
mov word [0x54e629], 0x100
call fcn.00412480
call fcn.0040c8e0
cmp byte [0x54e4ed], 0
je 0x40cc89
mov byte [0x54e4ed], 0
call fcn.0040c210
pop ecx
ret
Function at 0x40ff30
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x4c
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 8], 0x1e02
push eax
push dword [0x54e460]
mov edi, edx
mov byte [esp + 0x12], 2
mov esi, ecx
call dword [sym.imp.SDL2.dll_SDL_GetWindowWMInfo]
add esp, 8
test eax, eax
je 0x410110
mov eax, dword [esp + 0x10]
push str.LocalFT2CloneHwnd
push 0
push 0xf001f
mov dword [0x54e428], eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ecx, eax
mov dword [0x50ade4], ecx
test ecx, ecx
jne 0x40ffe5
push str.LocalFT2CloneHwnd
push 4
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x50ade8], eax
test eax, eax
je 0x410100
push 4
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x50ade0], eax
test eax, eax
je 0x410100
mov ecx, dword [0x54e428]
push eax
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x50ade0], 0
jmp 0x410100
cmp esi, 2
jl 0x410100
mov eax, dword [edi + 4]
cmp byte [eax], 0
je 0x410100
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 4
push 0
push 0
push 0xf001f
push ecx
call esi
mov dword [0x50ade0], eax
test eax, eax
je 0x4100ea
mov ecx, dword [eax]
push eax
mov dword [0x50adec], ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [0x50ade4]
mov dword [0x50ade0], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.LocalFT2CloneFilename
push 0x20a
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [0x50ade4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x50ade4], eax
test eax, eax
je 0x4100e2
push 0x20a
push 0
push 0
push 0xf001f
push eax
call esi
mov esi, eax
mov dword [0x50ade0], esi
test esi, esi
je 0x4100e2
mov ecx, dword [edi + 4]
mov edx, esi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x410090
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
push 0
push 0x401
push dword [0x50adec]
mov dword [0x50ade0], 0
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x50
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x50ade4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x50ade4], 0
mov al, 1
pop edi
pop esi
add esp, 0x4c
ret
push dword [0x50ade4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x50ade4], 0
push 1
push 0x201
call dword [sym.imp.SDL2.dll_SDL_EventState]
add esp, 8
pop edi
xor al, al
pop esi
add esp, 0x4c
ret