joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
push ebx
mov esi, 1
sub esp, 0x100
xor ebx, ebx
mov edi, esp
jmp 0x4116b5
mov dword [esp], 0x61746164
mov dword [esp + 4], 0x7270732f
mov dword [esp + 8], 0x73657469
mov dword [esp + 0xc], 0x6e6f662f
mov word [esp + 0x10], 0x74
mov eax, dword [ebx*4 + 0x5b4080]
mov edx, dword [ebx*4 + 0x5b40a0]
or eax, edx
push eax
push str.bor.pak
push edi
push ebx
call fcn.004a6340
add esp, 0x10
test eax, eax
jne 0x4116d0
inc ebx
inc esi
cmp ebx, 8
je 0x4116e7
test ebx, ebx
je 0x411664
push esi
push str.data_sprites_font
push str._s_d
push edi
call sub.msvcrt.dll_sprintf
add esp, 0x10
jmp 0x41168a
inc ebx
push eax
push eax
push esi
push 0x54c67f
inc esi
call fcn.004bc700
add esp, 0x10
cmp ebx, 8
jne 0x4116b5
add esp, 0x100
pop ebx
pop esi
pop edi
ret

Function at 0x4123b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x22c
mov al, byte [0x54c322]
mov byte [esp + 0x114], al
lea eax, [esp + 0x115]
push esi
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
mov al, byte [0x54c322]
mov byte [esp + 0x24], al
lea eax, [esp + 0x25]
add esp, 0xc
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea ebp, [esp + 0x120]
push ebp
call fcn.004bca30
pop ecx
pop ebx
push 2
lea ebx, [esp + 0x20]
push ebx
call fcn.004bc3f0
pop eax
pop edx
push ebx
push ebp
call sub.msvcrt.dll_strcat
mov ebx, ebp
mov eax, dword [ebx]
add ebx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x412428
test edx, 0x8080
je 0x412532
mov esi, dword [0x5b40d8]
add dl, dl
mov eax, esi
mov edx, 0x66666667
sbb ebx, 3
mov ecx, esi
imul edx
sar ecx, 0x1f
sub ebx, ebp
sar edx, 2
sub edx, ecx
lea ecx, [edx + 0x30]
lea edx, [edx + edx*4]
add edx, edx
mov byte [esp + ebx + 0x122], cl
sub esi, edx
lea eax, [esi + 0x30]
mov byte [esp + ebx + 0x123], al
pop edi
pop eax
push 0x54c721
push ebp
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x412540
push esi
push 2
push 0
push eax
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
add esp, 0xc
mov esi, eax
push 0
push 0
push ebx
call sub.msvcrt.dll_fseek
lea eax, [esi + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov edi, eax
test eax, eax
je 0x412540
push ebx
push esi
push 1
push eax
call sub.msvcrt.dll_fread
mov byte [esi + edi - 1], 0
push 1
push 0
push str.loadScriptFile
lea esi, [esp + 0x230]
push esi
call fcn.00461060
add esp, 0x1c
push ebp
push edi
push esi
call fcn.00460bf0
add esp, 0x10
test eax, eax
jne 0x412550
xor ebx, ebx
push ecx
push ecx
push 2
push esi
call fcn.00460c30
mov dword [esp], edi
call sub.msvcrt.dll_free
add esp, 0x10
add esp, 0x22c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
shr edx, 0x10
add ebx, 2
jmp 0x41244c
xor ebx, ebx
add esp, 0x22c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push esi
call fcn.00460e10
add esp, 0x10
test eax, eax
je 0x41250e
sub esp, 0xc
mov ebx, 1
push esi
call fcn.004600e0
add esp, 0x10
test eax, eax
jne 0x412510
jmp 0x41250e
Function at 0x412580
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x204
mov al, byte [0x54c322]
mov byte [esp + 0x104], al
lea eax, [esp + 0x105]
push ecx
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
mov al, byte [0x54c322]
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
add esp, 0xc
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea esi, [esp + 0x110]
push esi
call fcn.004bca30
pop eax
pop edx
push 1
lea ebx, [esp + 0x10]
push ebx
call fcn.004bc3f0
pop ecx
pop eax
push ebx
push esi
call sub.msvcrt.dll_strcat
call fcn.00410c10
pop eax
pop edx
push 0x54c721
push esi
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x412646
push ebx
push 0x1c8
push 1
push 0x5ecd98
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x10
mov eax, 1
cmp dword [0x5ecd98], 0x20048
je 0x412646
call fcn.00410c10
xor eax, eax
add esp, 0x204
pop ebx
pop esi
ret

Function at 0x412650
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x204
mov al, byte [0x54c322]
mov byte [esp + 0x104], al
lea eax, [esp + 0x105]
push esi
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
mov al, byte [0x54c322]
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
add esp, 0xc
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea esi, [esp + 0x110]
push esi
call fcn.004bca30
pop ecx
pop ebx
push 1
lea ebx, [esp + 0x10]
push ebx
call fcn.004bc3f0
pop eax
pop edx
push ebx
push esi
call sub.msvcrt.dll_strcat
pop ebx
pop eax
push 0x54c733
push esi
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4126fe
push ebx
push 0x1c8
push 1
push 0x5ecd98
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov eax, 1
add esp, 0x10
add esp, 0x204
pop ebx
pop esi
ret

Function at 0x412710
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x204
mov al, byte [0x54c322]
mov byte [esp + 0x104], al
lea eax, [esp + 0x105]
push ecx
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
mov al, byte [0x54c322]
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
add esp, 0xc
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea esi, [esp + 0x110]
push esi
call fcn.004bca30
pop eax
pop edx
push 0
lea ebx, [esp + 0x10]
push ebx
call fcn.004bc3f0
pop ecx
pop eax
push ebx
push esi
call sub.msvcrt.dll_strcat
pop eax
pop edx
push 0x54c721
push esi
call sub.msvcrt.dll_fopen
xor esi, esi
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4127ce
push eax
mov eax, dword [0x5ec5d8]
push eax
mov eax, dword [0x5eca98]
push 0x120
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 0x11f
ja 0x4127e0
mov esi, 1
sub esp, 0xc
push ebx
call sub.msvcrt.dll_fclose
add esp, 0x10
mov eax, esi
add esp, 0x204
pop ebx
pop esi
ret
mov eax, dword [0x5eca98]
cmp dword [eax], 0x21276
je 0x4127bd
call fcn.00406d70
jmp 0x4127c2
Function at 0x412800
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x204
mov al, byte [0x54c322]
mov byte [esp + 0x104], al
lea eax, [esp + 0x105]
push ecx
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
mov al, byte [0x54c322]
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
add esp, 0xc
push 0xff
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea esi, [esp + 0x110]
push esi
call fcn.004bca30
pop eax
pop edx
push 0
lea ebx, [esp + 0x10]
push ebx
call fcn.004bc3f0
pop ecx
pop eax
push ebx
push esi
call sub.msvcrt.dll_strcat
pop eax
pop edx
push 0x54c733
push esi
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4128b4
mov eax, dword [0x5ec5d8]
mov esi, dword [0x5eca98]
push ebx
push eax
push 0x120
push esi
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov eax, 1
add esp, 0x10
add esp, 0x204
pop ebx
pop esi
ret

Function at 0x4128c0
Capabilities:
Read file on windows

Disassembly:
push ebx
sub esp, 0x88
mov al, byte [0x54c322]
mov byte [esp + 8], al
lea eax, [esp + 9]
push ecx
push 0x7f
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea ebx, [esp + 0x14]
push ebx
call fcn.004bca30
mov ecx, ebx
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4128f5
test edx, 0x8080
je 0x412981
add dl, dl
mov eax, ecx
sbb eax, 3
mov dword [eax], 0x61666564
mov dword [eax + 4], 0x2e746c75
mov dword [eax + 8], 0x676663
call fcn.004013c0
pop eax
pop edx
push 0x54c721
push ebx
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x412979
push eax
push 0xf8
push 1
push 0x5ec998
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x10
cmp dword [0x5ec998], 0x30000
je 0x412979
call fcn.004013c0
add esp, 0x88
pop ebx
ret
shr edx, 0x10
add ecx, 2
jmp 0x412915

Function at 0x412990
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x88
mov al, byte [0x54c322]
mov byte [esp + 8], al
lea eax, [esp + 9]
push ecx
push 0x7f
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea ebx, [esp + 0x14]
push ebx
call fcn.004bca30
mov ecx, ebx
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4129c5
test edx, 0x8080
je 0x412a40
add dl, dl
mov eax, ecx
sbb eax, 3
mov dword [eax], 0x61666564
mov dword [eax + 4], 0x2e746c75
mov dword [eax + 8], 0x676663
pop eax
pop edx
push 0x54c733
push ebx
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x412a33
push eax
push 0xf8
push 1
push 0x5ec998
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x10
add esp, 0x88
pop ebx
ret
shr edx, 0x10
add ecx, 2
jmp 0x4129e5
Function at 0x412a50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x104
mov al, byte [0x54c322]
mov byte [esp + 0x84], al
lea eax, [esp + 0x85]
push esi
push 0x7f
push 0
push eax
call sub.msvcrt.dll_memset
mov al, byte [0x54c322]
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
add esp, 0xc
push 0x7f
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea esi, [esp + 0x90]
push esi
call fcn.004bca30
pop ecx
pop ebx
push 4
lea ebx, [esp + 0x10]
push ebx
call fcn.004bc3f0
pop eax
pop edx
push ebx
push esi
call sub.msvcrt.dll_strcat
pop ebx
pop eax
push 0x54c733
push esi
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x412af1
push eax
push 0xf8
push 1
push 0x5ec998
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x10
add esp, 0x104
pop ebx
pop esi
ret
Function at 0x413df0
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x104
mov al, byte [0x54c322]
mov byte [esp + 0x84], al
lea eax, [esp + 0x85]
push esi
push 0x7f
push 0
push eax
call sub.msvcrt.dll_memset
mov al, byte [0x54c322]
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
add esp, 0xc
push 0x7f
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0x54c71b
lea esi, [esp + 0x90]
push esi
call fcn.004bca30
pop ecx
pop ebx
push 4
lea ebx, [esp + 0x10]
push ebx
call fcn.004bc3f0
pop eax
pop edx
push ebx
push esi
call sub.msvcrt.dll_strcat
mov dword [esp], esi
call fcn.004bc890
add esp, 0x10
test eax, eax
jne 0x413e80
call fcn.004128c0
add esp, 0x104
pop ebx
pop esi
ret
call fcn.004013c0
push eax
push eax
push 0x54c721
push esi
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x413e72
push eax
push 0xf8
push 1
push 0x5ec998
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
add esp, 0x10
cmp dword [0x5ec998], 0x30000
je 0x413e72
call fcn.004013c0
add esp, 0x104
pop ebx
pop esi
ret
Function at 0x4abe80
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [esp + 0x104]
mov ebp, dword [esp + 0x100]
add eax, ebp
mov edi, dword [esp + 0xf4]
mov esi, dword [esp + 0xf8]
push 1
lea edx, [eax + eax*4]
lea edx, [eax + edx*8]
mov ecx, edx
shl ecx, 5
add edx, ecx
shl edx, 2
sub edx, eax
lea ebx, [edx*4]
add ebx, edi
push ebx
push str.bor.pak
call fcn.004bca30
add esp, 0x10
test esi, esi
je 0x4abee3
sub esp, 0xc
push esi
call sub.msvcrt.dll_fclose
add esp, 0x10
push esi
push esi
push 0x5924e0
push str.bor.pak
call sub.msvcrt.dll_fopen
add esp, 0x10
mov esi, eax
test eax, eax
je 0x4abfb0
push ecx
push ecx
push str..pak
push str.bor.pak
call fcn.004bcb50
add esp, 0x10
test eax, eax
je 0x4abf61
push edx
push 0
mov eax, dword [ebx + 0x5084]
mov eax, dword [ebx + eax*4 + 0x5088]
push eax
push esi
call sub.msvcrt.dll_fseek
add esp, 0x10
test eax, eax
js 0x4abfb0
push esi
push 0x5c
push 1
lea eax, [esp + 0x80]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 0xc
jg 0x4abfc0
mov eax, 1
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
push str..spk
push str.bor.pak
call fcn.004bcb50
add esp, 0x10
test eax, eax
je 0x4abf51
push esi
push 1
push 4
lea eax, [esp + 0xe4]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
je 0x4abfb0
push esi
push 1
push 4
lea eax, [esp + 0xe0]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
jne 0x4abffa
nop
lea esi, [esi]
add esp, 0xdc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push 0
mov eax, dword [esp + 0x108]
push eax
movsx eax, word [0x5ec9a6]
push eax
push str.bor.pak
lea eax, [esp + 0x9c]
push eax
call fcn.004b1b00
add esp, 0x20
mov eax, 1
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
push esi
push 1
push 4
lea eax, [esp + 0xdc]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
je 0x4abfb0
push eax
push 0
mov eax, dword [ebx + 0x5084]
mov eax, dword [ebx + eax*4 + 0x5088]
push eax
push esi
call sub.msvcrt.dll_fseek
add esp, 0x10
test eax, eax
js 0x4abfb0
push esi
push 0x60
push 1
lea esi, [esp + 0x20]
push esi
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, 0x10
jle 0x4abf51
mov eax, dword [esp + 0xd0]
mov ebp, dword [esp + 0x14]
mov edi, eax
mov dword [esp], eax
mov eax, dword [esp + 0x18]
add edi, eax
mov eax, dword [esp + 0x1c]
sub edi, ebp
mov dword [esp + 4], eax
mov ebx, edi
mov eax, dword [esp + 0x20]
sub ebx, 0xc
mov dword [esp + 8], eax
je 0x4ac098
mov cl, 0xc
mov eax, edi
sub cl, al
xor edx, edx
mov al, cl
add al, byte [edx + esi + 0x10]
sub al, dl
mov byte [edx + esi + 0x10], al
inc edx
cmp edx, ebx
jne 0x4ac087
mov eax, dword [esp + 8]
mov esi, dword [esp]
add eax, esi
mov ebx, dword [esp]
sub eax, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 4]
add eax, ebp
mov dword [esp + 0x14], ebp
sub eax, ebx
mov dword [esp + 0x1c], eax
sub esp, 0xc
movsx edx, word [0x5ec9a6]
push 0
mov ecx, dword [esp + 0x108]
push ecx
push edx
push str.bor.pak
lea eax, [esp + 0x40]
push eax
call fcn.004b1b00
mov eax, 1
add esp, 0x20
jmp 0x4abf56
Function at 0x4ac770
Capabilities:
Read file on windows

Disassembly:
shl edx, 0xb
push esi
push ebx
mov esi, eax
sub esp, 8
mov ebx, ecx
mov eax, dword [0x5cf410]
push 0
push edx
push eax
call sub.msvcrt.dll__lseek
add esp, 0xc
mov eax, ebx
shl eax, 0xb
mov ecx, dword [0x5cf410]
push eax
push esi
push ecx
call sub.msvcrt.dll__read
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x4bc690
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 8
mov eax, dword [0x5e3354]
mov ebx, dword [esp + 0x10]
test eax, eax
je 0x4bc6d0
mov eax, dword [0x5e3354]
push eax
push eax
push eax
push ebx
call sub.msvcrt.dll_strlen
add esp, 0xc
push eax
push 1
push ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [0x5e3354]
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp fcn.00544470
push eax
push eax
push 0x5947d4
push str.._Logs_ScriptLog.txt
call sub.msvcrt.dll_fopen
add esp, 0x10
mov dword [0x5e3354], eax
test eax, eax
jne 0x4bc6a1
pop ecx
pop ebx
pop ebx
ret

Function at 0x4bc7f0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4bc850
push edx
push edx
push 0x594809
push str.._Logs_OpenBorLog.txt
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
xor edi, edi
test ebx, ebx
je 0x4bc847
push eax
push 2
push 0
push ebx
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_rewind
add esp, 0x10
test esi, esi
jne 0x4bc868
sub esp, 0xc
push ebx
call sub.msvcrt.dll_fclose
add esp, 0x10
mov eax, edi
pop ebx
pop esi
pop edi
ret
push eax
push eax
push 0x594809
push str.._Logs_ScriptLog.txt
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
jmp 0x4bc811
sub esp, 0xc
push esi
call fcn.004bbf40
add esp, 0x10
mov edi, eax
test eax, eax
je 0x4bc83b
push ebx
push esi
push 1
mov eax, dword [eax]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
jmp 0x4bc83b

Function at 0x4bc9a0
Capabilities:
Create directory

Disassembly:
push ebx
sub esp, 0x88
mov al, byte [0x5946be]
mov byte [esp + 8], al
lea eax, [esp + 9]
push ebx
push 0x7f
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push pe_nt_image_headers32
mov ecx, dword [esp + 0x98]
push ecx
lea ebx, [esp + 0x14]
push ebx
call sub.msvcrt.dll_strncpy
mov dword [esp], ebx
call fcn.0053ca70
add esp, 0x10
test eax, eax
je 0x4bca01
sub esp, 0xc
push eax
call fcn.0053c850
mov eax, 1
add esp, 0x10
add esp, 0x88
pop ebx
ret
mov edx, dword [esp + 0x94]
xor eax, eax
test edx, edx
je 0x4bc9f9
sub esp, 0xc
push ebx
call sub.msvcrt.dll__mkdir
shr eax, 0x1f
add esp, 0x10
xor eax, 1
add esp, 0x88
pop ebx
ret
Function at 0x4c9470
Capabilities:
Get memory capacity

Disassembly:
push edi
xor eax, eax
sub esp, 0x28
mov ecx, 8
cld
lea edx, [esp + 8]
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x20
sub esp, 0xc
push edx
call sub.KERNEL32.dll_GlobalMemoryStatus
xor edx, edx
mov eax, dword [esp + 0x20]
div dword [esp + 0x3c]
xor edx, edx
add esp, 0x34
pop edi
ret

Function at 0x4c9500
Capabilities:
Get memory capacity

Disassembly:
push edi
xor eax, eax
sub esp, 0x28
mov ecx, 8
cld
lea edx, [esp + 8]
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x20
sub esp, 0xc
push edx
call sub.KERNEL32.dll_GlobalMemoryStatus
mov dword [0x5e34cc], 0
mov eax, dword [esp + 0x1c]
push 1
mov dword [0x5e34c8], eax
call fcn.004c94b0
add esp, 0x38
pop edi
ret
Function at 0x4cfd48
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x2c]
test edx, edx
je 0x4cfd72
dec edx
mov dword [eax + 0x2c], edx
test edx, edx
jne 0x4cfd72
mov edx, dword [eax + 0x18]
sub dword [eax + 0x14], edx
mov edx, dword [eax]
test dl, 5
jne 0x4cfd84
test dh, 0x40
jne 0x4cfd74
leave
ret
and dh, 0xbf
mov dword [eax], edx
mov dword [ebp + 8], eax
leave
jmp fcn.004e2f90
mov edx, dword [0x5e5078]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [edx + 0x58]
leave
ret

Function at 0x4d21e4
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], 0x3d
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
mov esi, eax
test eax, eax
je 0x4d2283
xor eax, eax
mov ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
cmp ecx, dword [0x5e54b8]
ja 0x4d2268
mov eax, dword [0x5e54c8]
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym.OpenBOR.elf_SDL_strlcpy
mov eax, dword [0x5e54c8]
sub esi, ebx
lea esi, [eax + esi]
mov byte [esi], 0
lea edx, [esi + 1]
cmp byte [esi + 1], 0
jne 0x4d2248
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_SetEnvironmentVariableA
sub esp, 8
test eax, eax
je 0x4d2283
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 4], ecx
mov eax, dword [0x5e54c8]
mov dword [esp], eax
mov dword [ebp - 0x1c], ecx
call sub.msvcrt.dll_realloc
test eax, eax
mov ecx, dword [ebp - 0x1c]
jne 0x4d2290
mov eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [0x5e54c8], eax
mov dword [0x5e54b8], ecx
jmp 0x4d2220

Function at 0x4d274c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateThread
sub esp, 8
leave
ret

Function at 0x4d27b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 8
call sub.msvcrt.dll_malloc
test eax, eax
je 0x4d280f
mov dword [eax + 4], 0x5444a8
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea edx, [ebp - 0xc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4d2838
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
test eax, eax
je 0x4d2822
xor eax, eax
leave
ret
mov dword [esp], 0
call sym.OpenBOR.elf_SDL_Error
mov eax, 0xffffffff
leave
ret
mov dword [esp], str.Not_enough_resources_to_create_thread
call sym.OpenBOR.elf_SDL_SetError
mov eax, 0xffffffff
leave
ret
Function at 0x4e4a70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [0x5e7b00], 0x4e4a18
mov dword [0x5e7b04], 0x4e5088
mov dword [0x5e7b08], 0x4e4ed4
mov dword [0x5e7b0c], 0x4e4dd8
mov dword [0x5e7b10], 0x4e4cf8
mov dword [0x5e7b14], 0x4e4cc8
mov dword [0x5e7b18], 0x4e4c48
mov dword [0x5e7b1c], 0x4e4c24
mov dword [0x5e7b20], 0x4e4c00
mov dword [0x5e7b24], 0x4e4bdc
mov ebx, 0x41
lea esi, [ebp - 0x1c]
jmp 0x4e4aee
inc ebx
cmp ebx, 0x5b
je 0x4e4b44
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._c:_
mov dword [esp + 4], 4
mov dword [esp], esi
call fcn.0053cc40
mov dword [esp], esi
call sub.KERNEL32.dll_GetDriveTypeA
push edx
cmp eax, 5
jne 0x4e4ae8
mov edi, dword [0x71fd38]
cmp edi, 0x19
jg 0x4e4ae8
mov dword [esp], esi
call sub.msvcrt.dll__strdup
mov dword [edi*4 + 0x5e7fc0], eax
test eax, eax
je 0x4e4b5e
inc dword [0x71fd38]
inc ebx
cmp ebx, 0x5b
jne 0x4e4aee
nop
mov edx, 0x5e8030
mov ecx, 0x68
xor eax, eax
mov edi, edx
rep stosb byte es:[edi], al
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], 0
call sym.OpenBOR.elf_SDL_Error
jmp 0x4e4ae8

Function at 0x4e5264
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp], 0
call sub.USER32.dll_GetKeyboardLayout
push ebx
mov esi, eax
call sub.KERNEL32.dll_GetACP
mov edi, eax
mov dword [esp + 0xc], 8
lea ebx, [ebp - 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1004
movzx esi, si
mov dword [esp], esi
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
test eax, eax
jne 0x4e52b8
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], ebx
call sub.msvcrt.dll_atoi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x4e7c60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sym.OpenBOR.elf_SDL_RegisterApp
mov dword [esp], 0x59873c
call sym.OpenBOR.elf_SDL_getenv
xor edx, edx
test eax, eax
setne dl
mov dword [0x5e815c], edx
test edx, edx
je 0x4e7d08
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0053cca0
mov dword [0x5e812c], eax
test eax, eax
je 0x4e7da6
mov dword [esp + 4], 0xfffffffc
mov dword [esp], eax
call sub.USER32.dll_GetWindowLongA
sub esp, 8
mov dword [0x5e81b8], eax
mov dword [esp + 8], 0x4e55f8
mov dword [esp + 4], 0xfffffffc
mov eax, dword [0x5e812c]
mov dword [esp], eax
call sub.USER32.dll_SetWindowLongA
sub esp, 0xc
call fcn.004e6158
xor eax, eax
leave
ret
mov eax, dword [0x5e8120]
mov dword [esp + 0x2c], 0
mov edx, dword [0x5e8128]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xca0000
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [0x5e812c], eax
test eax, eax
je 0x4e7d93
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
call fcn.004e6158
xor eax, eax
leave
ret
mov dword [esp], 0x59876f
call sym.OpenBOR.elf_SDL_SetError
mov eax, 0xffffffff
leave
ret
mov dword [esp], 0x59874c
call sym.OpenBOR.elf_SDL_SetError
mov eax, 0xffffffff
leave
ret