joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d510
Capabilities:
Get number of processors

Disassembly:
mov ecx, dword [ecx + 0x228]
jmp 0x45d510
push 0xffffffffffffffff
push 0x58722b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x45d6ca
cmp dword [ebx + 0x40], 0
lea ecx, [ebp + 0x2e4]
jne 0x45d644
call fcn.0056b010
mov dword [esp + 0x30], eax
test eax, eax
je 0x45d595
jmp 0x45d570
lea eax, [esp + 0x30]
push eax
lea ecx, [ebp + 0x2e4]
call fcn.0056b070
mov esi, dword [eax]
test esi, esi
je 0x45d595
mov eax, dword [ebx + 0x3c]
cmp dword [esi + 8], eax
je 0x45d5a2
cmp dword [esp + 0x30], 0
jne 0x45d570
push ebx
mov ecx, ebp
call fcn.0045c2b0
jmp 0x45d6c3
lea ecx, [esi + 0x10]
call fcn.0056b010
mov dword [esp + 0x18], eax
test eax, eax
je 0x45d5d2
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 0x10]
call fcn.0056b070
mov eax, dword [eax]
cmp dword [eax + 0x40], 0
je 0x45d6ca
cmp dword [esp + 0x18], 0
jne 0x45d5b2
mov ebp, 1
push ebx
lea ecx, [esi + 0x10]
mov dword [esi], ebp
call fcn.0056aa30
add dword [esi + 4], ebp
push 0x48
call fcn.0056dadb
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0
test eax, eax
je 0x45d608
mov ecx, eax
call fcn.004e1100
jmp 0x45d60a
xor eax, eax
mov edx, dword [ebx + 0x3c]
mov ecx, edx
imul ecx, ecx, 0x64
add ecx, 0x63
mov dword [eax + 0x44], ecx
push eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [eax + 0x3c], edx
mov dword [eax + 0x40], 0x63
call fcn.0056aac0
mov eax, dword [esp + 0x14]
add dword [esi + 4], ebp
add dword [eax + 0x2e0], ebp
mov ebp, eax
jmp 0x45d6c3
call fcn.0056b010
mov dword [esp + 0x1c], eax
test eax, eax
je 0x45d6bb
lea edx, [esp + 0x1c]
push edx
lea ecx, [ebp + 0x2e4]
call fcn.0056b070
mov esi, dword [eax]
test esi, esi
je 0x45d6bb
mov eax, dword [esi + 8]
cmp eax, dword [ebx + 0x3c]
je 0x45d678
cmp dword [esp + 0x1c], 0
jne 0x45d651
jmp 0x45d6bb
lea ecx, [esi + 0x10]
call fcn.0056b040
mov ebp, eax
test ebp, ebp
je 0x45d6b7
lea ecx, [esi + 0x10]
call fcn.0056afc0
mov eax, dword [eax]
cmp dword [eax + 0x40], 0x63
push ebx
lea ecx, [esi + 0x10]
jne 0x45d6a9
push ebp
call fcn.0056ac90
inc dword [esi + 4]
mov ebp, dword [esp + 0x14]
jmp 0x45d6c3
call fcn.0056aac0
inc dword [esi + 4]
mov ebp, dword [esp + 0x14]
jmp 0x45d6c3
mov ebp, dword [esp + 0x14]
push ebx
mov ecx, ebp
call fcn.0045c3b0
mov ecx, ebp
call fcn.0045d0b0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
mov ecx, dword [0x6b64fc]
jmp 0x45be20
Function at 0x463dc0
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
push edi
mov edi, ecx
test eax, eax
jne 0x463de0
push str.Item_DB_idx__0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop ebx
ret 4
push esi
push eax
mov ecx, 0x6c4d50
call fcn.00499c20
mov esi, eax
test esi, esi
je 0x463dff
mov ax, word [ebx + 6]
mov word [esi + 0x28e], ax
jmp 0x463e2d
push str.CItemShopGridDialog::AddItem
push ebx
mov ecx, 0x6c4d50
call fcn.0049cd00
mov esi, eax
test esi, esi
jne 0x463e1b
pop esi
pop edi
pop ebx
ret 4
push esi
mov ecx, 0x6c4d50
mov dword [esi + 0x24], 1
call fcn.004a57e0
mov edx, dword [esi]
mov eax, dword [edx + 0x7c]
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.00463cd0
movzx eax, ax
push esi
push eax
mov ecx, edi
call fcn.00421f80
pop esi
pop edi
pop ebx
ret 4

Function at 0x466360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5875ee
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [esp + 0x80]
push 0x3e
mov ebx, ecx
lea ecx, [esp + 0x32]
mov eax, 0x20
push 0
push ecx
mov word [esp + 0x38], ax
call fcn.0056d540
add esp, 0xc
push edi
lea ecx, [ebx + 0x234]
call fcn.004662b0
push 0x11
lea esi, [edi + 4]
lea edx, [esp + 0x1c]
push esi
push edx
call fcn.0051eee0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4663e0
sub eax, edx
cmp eax, 0x10
jge 0x466405
mov edx, 0x10
sub edx, eax
push edx
lea ecx, [esp + eax + 0x1c]
push 0x20
push ecx
call fcn.0056d540
add esp, 0xc
test byte [0x6b5e58], 1
jne 0x46643c
or dword [0x6b5e58], 1
mov ecx, 0x6b5cd0
mov dword [esp + 0x78], 0
call fcn.004e8d00
push 0x58f9a0
call fcn.0056dac4
add esp, 4
mov dword [esp + 0x78], 0xffffffff
movzx eax, byte [edi + 0x17]
push 7
push eax
mov ecx, 0x6b5cd0
call fcn.004ea6c0
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0051eee0
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x466462
sub eax, edx
cmp eax, 6
jge 0x466487
mov edx, 6
sub edx, eax
push edx
lea ecx, [esp + eax + 0x14]
push 0x20
push ecx
call fcn.0056d540
add esp, 0xc
movzx eax, word [edi + 0x15]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push str._s__10s__4d
push eax
call fcn.0056d39f
mov ecx, dword [ebx + 0x230]
add esp, 0x14
cmp dword [edi + 0x18], 1
push 0
push 0
push 0xffffffffffffffff
jne 0x4664ca
mov edx, dword [ecx]
mov edx, dword [edx + 0x6c]
push 0xffffffffffffffff
lea eax, [esp + 0x3c]
push eax
call edx
jmp 0x4664db
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
push 0xffacb6c7
lea edx, [esp + 0x3c]
push edx
call eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0056ca39
add esp, 0x6c
ret 4
Function at 0x47ea10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 1
jne 0x47ea53
mov eax, dword [0x6c506c]
add eax, 0x1d4c0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x238], eax
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043b480
push str.ANRaster.tga
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043b4b0
jmp 0x47ea6c
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043b480
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041d800
mov esp, ebp
pop ebp
ret 4

Function at 0x47ea80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 1
jne 0x47eac8
mov eax, dword [ebp + 0xc]
imul eax, eax, 0x3e8
add eax, dword [0x6c506c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x238], eax
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043b480
push str.ANRaster.tga
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043b4b0
jmp 0x47eae1
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043b480
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041d800
mov esp, ebp
pop ebp
ret 8

Function at 0x480a40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x587e68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
push 0xa
lea ecx, [esp + 0x18]
call fcn.0056a6e0
sub edi, 0xffffff80
mov ecx, edi
mov dword [esp + 0x38], 0
call fcn.0056b010
mov dword [esp + 0xc], eax
test eax, eax
je 0x480af9
lea esp, [esp]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.0056b070
mov esi, dword [eax]
test esi, esi
je 0x480af2
fld dword [esi + 0x28c]
push ecx
fstp dword [esp + 0x14]
lea ecx, [esi + 0x284]
fld dword [esp + 0x14]
fcom qword [0x59a7d8]
fnstsw ax
test ah, 1
jne 0x480adc
fstp st(0)
fld1
fstp dword [esp]
call fcn.0053cbb0
push esi
lea ecx, [esp + 0x18]
call fcn.0056aac0
jmp 0x480af2
fadd qword [0x59a7d0]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.0053cbb0
cmp dword [esp + 0xc], 0
jne 0x480a90
lea ecx, [esp + 0x14]
call fcn.0056b010
mov dword [esp + 0xc], eax
test eax, eax
je 0x480b33
lea ebx, [ebx]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x18]
call fcn.0056b070
mov eax, dword [eax]
test eax, eax
je 0x480b2c
push eax
mov ecx, edi
call fcn.0056b170
cmp dword [esp + 0xc], 0
jne 0x480b10
lea ecx, [esp + 0x14]
call fcn.0056a7c0
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.0056a840
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x485a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58cd6e
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x38], eax
lea ebx, [ebx]
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x485aff
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
mov dword [ebx + 0x38], edx
test ecx, ecx
je 0x485aff
mov ecx, dword [ecx + 0x538]
test ecx, ecx
je 0x485aeb
test byte [0x6b6148], 1
movzx esi, word [ecx + 0x3b]
jne 0x485adb
or dword [0x6b6148], 1
mov ecx, 0x6b5fd8
mov dword [esp + 0x14], 0
call fcn.00530250
push 0x58f9d0
call fcn.0056dac4
add esp, 4
mov dword [esp + 0x14], 0xffffffff
push esi
mov ecx, 0x6b5fd8
call fcn.0052ef30
cmp eax, 1
jne 0x485a80
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x48ed70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5888f8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
cmp dword [ecx + 0x120], 1
je 0x48edc6
push 0
push 0x23e
push str.Object.cpp
call fcn.0051eca0
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
mov ebx, dword [esp + 0x38]
lea esi, [ecx + 0x18]
xor edx, edx
mov eax, ebx
div dword [esi + 4]
mov eax, dword [esi + 8]
push 0xa
mov ecx, dword [eax + edx*4]
mov dword [esi + 0x18], ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], ebx
call fcn.0056a6e0
mov dword [esp + 0x30], 0
lea ebx, [ebx]
cmp dword [esi + 0x18], 0
je 0x48ee21
mov ecx, dword [esi + 0x20]
lea esp, [esp]
mov eax, dword [esi + 0x18]
cmp dword [eax], ecx
je 0x48ee7f
mov edx, dword [eax + 0xc]
mov dword [esi + 0x18], edx
test edx, edx
jne 0x48ee10
lea ecx, [esp + 0xc]
call fcn.0056b010
mov dword [esp + 0x38], eax
test eax, eax
je 0x48ee51
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x10]
call fcn.0056b070
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.004ee790
cmp dword [esp + 0x38], 0
jne 0x48ee32
lea ecx, [esp + 0xc]
call fcn.0056a7c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0056a840
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
mov dword [esi + 0x1c], eax
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x48ee21
push eax
mov ecx, 0x6f2c58
call fcn.00549a80
cmp eax, 1
jne 0x48ee00
push ebx
lea ecx, [esp + 0x10]
call fcn.0056aac0
jmp 0x48ee00
Function at 0x49cd00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x588d89
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x18c]
movzx esi, word [ebx + 4]
mov ebp, dword [esp + 0x190]
push esi
mov edi, ecx
call fcn.0049a120
test eax, eax
jne 0x49cd95
mov ecx, dword [0x6c4140]
push ebp
push esi
push ecx
lea edx, [esp + 0x84]
push str.NoItemInfo__d____d____s
push edx
call fcn.0056d39f
lea eax, [esp + 0x8c]
push eax
push 0x166
push str.ItemManager.cpp
call fcn.0051eca0
add esp, 0x20
xor eax, eax
jmp 0x49ceaa
mov ebp, dword [ebx]
test ebp, ebp
je 0x49cd8e
push ebp
call fcn.00499c20
mov esi, eax
test esi, esi
jne 0x49ce81
push 0x3b8
call fcn.0056dadb
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x184], esi
cmp eax, esi
je 0x49cdd1
push ebx
mov ecx, eax
call fcn.00496f20
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 0x74]
mov ecx, esi
mov dword [esp + 0x184], 0xffffffff
call eax
push eax
push esi
lea ecx, [edi + 0x18]
call fcn.00558f80
lea ecx, [esp + 0x18]
call fcn.004222f0
mov ebx, dword [esi]
lea ecx, [edi + 0x260]
mov dword [esp + 0x184], 1
call fcn.0056b300
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x78]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.0049ccd0
mov edx, dword [ebx + 0x10]
push eax
push 0x28
push 0x28
push 0
push 0
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x78]
mov ecx, esi
mov dword [esi + 0x21c], 1
call edx
movzx eax, ax
mov dword [esi + 0x220], eax
xor eax, eax
mov word [esi + 0x2a8], ax
mov ecx, dword [0x6c3860]
push esi
call fcn.0056aac0
lea ecx, [esp + 0x18]
mov dword [esp + 0x184], 0xffffffff
call fcn.00422300
jmp 0x49cea8
push ebp
lea ecx, [esp + 0x3c]
push str.__DBIndex:__d
push ecx
call fcn.0056d39f
lea edx, [esp + 0x44]
push edx
push 0x18e
push str.ItemManager.cpp
call fcn.0051eca0
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.0056ca39
add esp, 0x174
ret 8
Function at 0x4a15e0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push esi
mov esi, ecx
call ebx
cmp dword [esi + 0xf4], 0
jne 0x4a160f
mov dword [esi + 0xf4], eax
sub eax, dword [esi + 0xf4]
cmp eax, 0x1388
jbe 0x4a16eb
mov ecx, dword [esi + 0xd0]
mov eax, dword [esi + 0xdc]
mov dword [esi + 0xe4], eax
test ecx, ecx
jle 0x4a1645
test eax, eax
je 0x4a1642
mov eax, dword [eax]
mov dword [esi + 0xe4], eax
dec ecx
jne 0x4a1636
push edi
push 0
push 2
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4a16ea
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4a16db
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x138]
push 0x59161c
push eax
call fcn.0056d39f
add esp, 0xc
lea ecx, [esp + 0x134]
push ecx
mov ecx, esi
call fcn.0049ca10
test eax, eax
je 0x4a16cc
mov ecx, 0x6d5778
call fcn.0051df40
push 0x230
mov ecx, 0x6c6100
call fcn.004c00d0
push eax
push 1
push 0x179e
push 0x6c3848
call fcn.00437bf0
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4a1671
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [esi + 0xf4], eax
pop edi
mov ecx, dword [esp + 0x1b0]
pop esi
pop ebx
xor ecx, esp
call fcn.0056ca39
add esp, 0x1ac
ret
Function at 0x4b2970
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x6af82d], 0
push esi
mov esi, ecx
je 0x4b2993
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
mov dword [0x6c5080], eax
mov byte [0x6af82d], 0
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xc]
mov edx, eax
sub edx, ecx
mov dword [0x6c5080], eax
cmp eax, ecx
jae 0x4b29aa
dec edx
mov dword [0x6c5068], edx
mov dword [esi + 0xc], eax
mov eax, dword [0x6c5068]
add dword [0x6c506c], eax
add dword [esi + 8], eax
cmp dword [esi + 8], 0x5265c00
jb 0x4b29d4
inc dword [esi + 4]
add dword [esi + 8], 0xfad9a400
pop esi
ret
Function at 0x4ba540
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ba56f
pop edi
xor eax, eax
pop esi
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x500
lea edx, [edi + 0x504]
push edx
push esi
call ebx
test eax, eax
jne 0x4ba59f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
ret 4
push 0
lea eax, [esp + 0x14]
push eax
push 0xc0
add edi, 0xac4
push edi
push esi
call ebx
push esi
test eax, eax
je 0x4ba591
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x4bd250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58a708
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 2
mov esi, ecx
call fcn.00432280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x60]
push 0x35e
call eax
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.004222f0
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x3f
mov ecx, 0x6c36d8
mov dword [esp + 0x44], 0
call fcn.00426e50
push 0x33517d
lea edx, [esp + 0x10]
push edx
push 0xffffffffffffffff
push 0x44a
mov ecx, 0x6c6100
call fcn.004c00d0
push eax
mov ecx, edi
call fcn.00433690
push 8
mov ecx, esi
call fcn.00432280
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x60]
push 0x376
call eax
mov ecx, 0x6c4d50
mov esi, eax
call fcn.004988b0
mov edi, eax
test esi, esi
je 0x4bd360
test edi, edi
je 0x4bd360
push 1
mov ecx, esi
call fcn.00424100
mov ecx, dword [edi + 0xc]
mov dword [edi + 0x14], ecx
lea esp, [esp]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4bd360
mov edx, dword [eax + 8]
mov ecx, dword [edx + 4]
mov eax, dword [eax]
mov dword [edi + 0x14], eax
test ecx, ecx
je 0x4bd360
movzx ecx, word [ecx + 4]
push ecx
mov ecx, 0x6c4d50
call fcn.0049a120
test eax, eax
je 0x4bd320
mov edx, dword [esi]
push 0
push 0
push 0xffffffffffffffff
add eax, 2
push 0xffffffffffffffff
push eax
mov eax, dword [edx + 0x6c]
mov ecx, esi
call eax
jmp 0x4bd320
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.00422300
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0056ca39
add esp, 0x30
ret

Function at 0x4be490
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4be4c3
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x20], 0
call edi
test eax, eax
je 0x4be508
cmp dword [esp + 0x10], 0x61208
jne 0x4be508
push 0
lea edx, [esp + 0x10]
push edx
push 0xa8
add ebx, 4
push ebx
push esi
call edi
test eax, eax
jne 0x4be518
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [esp + 0xc], 0xa8
push esi
ja 0x4be509
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x4be540
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4be5a6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0x61208
call edi
push 0
lea edx, [esp + 0x14]
push edx
push 0xa8
add ebx, 4
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4c9930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58a708
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6b3854]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x64]
mov esi, ecx
mov cx, word [esp + 0x60]
mov word [esi + 0x28a], cx
mov ecx, dword [esp + 0x56]
push eax
mov word [esi + 0x288], ax
mov dword [esi + 0x28c], edx
mov dword [esi + 0x290], ecx
call fcn.0051e810
movzx eax, ax
add eax, 0xfffff7ff
mov edx, 0x7fe
add esp, 4
cmp ax, dx
ja 0x4c99be
movzx eax, word [esi + 0x288]
push eax
mov ecx, 0x6c4d50
call fcn.0049a2b0
test eax, eax
je 0x4c99c3
mov eax, 1
lea ecx, [esp + 0xc]
mov dword [esi + 0x294], eax
call fcn.004222f0
mov edx, dword [esp + 0x44]
mov edi, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push edx
mov ecx, 0x6c4d50
mov dword [esp + 0x44], 0
call fcn.0049ccd0
push eax
mov eax, dword [edi + 0x10]
push 0x28
push 0x28
push 0
push 0
mov ecx, esi
call eax
movzx ecx, word [esp + 0x44]
mov edx, dword [esi]
mov eax, dword [esp + 0x5c]
mov edx, dword [edx + 0x78]
mov dword [esi + 0x220], ecx
push eax
mov ecx, esi
mov dword [esi + 0x21c], 3
call edx
push 0
push 0
push 0
push 0
push 0
push esi
mov ecx, 0x6c4d50
call fcn.004a4840
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.00422300
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0056ca39
add esp, 0x30
ret 0x28
Function at 0x4da510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x58a11b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6b3854]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push 0x3d
lea eax, [esi + 0x4c]
push ebx
push eax
mov dword [esi], vtable.COBalloonName.0
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x148], ebx
mov byte [esi + 0x14c], bl
mov dword [esi + 0x90], 0xffffff
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.0056d540
xor eax, eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov byte [esi + 0xa4], al
mov dword [esi + 0xa5], eax
mov dword [esi + 0xa9], eax
mov dword [esi + 0xad], eax
mov dword [esi + 0xb1], eax
mov dword [esi + 0xb5], eax
mov dword [esi + 0xb9], eax
mov dword [esi + 0xbd], eax
mov dword [esi + 0xc1], eax
mov byte [esi + 0xc5], al
mov dword [esi + 0xc6], eax
mov dword [esi + 0xca], eax
mov dword [esi + 0xce], eax
mov dword [esi + 0xd2], eax
mov dword [esi + 0xd6], eax
mov dword [esi + 0xda], eax
mov dword [esi + 0xde], eax
mov dword [esi + 0xe2], eax
mov byte [esi + 0xe6], al
mov dword [esi + 0xe7], eax
mov dword [esi + 0xeb], eax
mov dword [esi + 0xef], eax
mov dword [esi + 0xf3], eax
mov dword [esi + 0xf7], eax
mov dword [esi + 0xfb], eax
mov dword [esi + 0xff], eax
mov dword [esi + 0x103], eax
mov byte [esi + 0x107], al
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], eax
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], eax
mov dword [esi + 0x118], eax
mov dword [esi + 0x11c], eax
mov dword [esi + 0x120], eax
mov dword [esi + 0x124], eax
mov byte [esi + 0x128], al
mov dword [esi + 0x129], eax
mov dword [esi + 0x12d], eax
mov dword [esi + 0x131], eax
mov dword [esi + 0x135], eax
push 0x144
mov byte [esi + 0x139], al
call fcn.0056dadb
add esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ebx
cmp eax, ebx
je 0x4da6d9
mov ecx, eax
call fcn.00425410
jmp 0x4da6db
xor eax, eax
mov dword [esi + 0x154], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x168], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x13c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret