joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x11c]
test eax, eax
jg 0x410f6f
push 0x78a
push str.C:Users_soniaOneDriveDocumentosGitHubEngine_BonesEngine_Bones_v.1Engine_BonesSourceExternalImGuiimgui.h
push str.Size___0
call fcn.004cb34c
mov eax, dword [edi + 0x11c]
add esp, 0xc
mov ebx, dword [edi + 0x124]
lea edx, [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4f06e8]
sub esi, 1
jne 0x410f83
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3f68], ebx
jne 0x410fba
push ecx
push dword [ebp + 8]
lea edx, [esi + 0xc]
mov ecx, ebx
call fcn.004412a0
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x410fd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x11c]
test eax, eax
jg 0x410fff
push 0x78a
push str.C:Users_soniaOneDriveDocumentosGitHubEngine_BonesEngine_Bones_v.1Engine_BonesSourceExternalImGuiimgui.h
push str.Size___0
call fcn.004cb34c
mov eax, dword [edi + 0x11c]
add esp, 0xc
mov ebx, dword [edi + 0x124]
lea edx, [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4f06e8]
sub esi, 1
jne 0x411013
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3f68], ebx
jne 0x41104a
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.004412a0
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x411060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0x11c]
test edx, edx
jg 0x411091
push 0x78a
push str.C:Users_soniaOneDriveDocumentosGitHubEngine_BonesEngine_Bones_v.1Engine_BonesSourceExternalImGuiimgui.h
push str.Size___0
call fcn.004cb34c
mov edx, dword [esi + 0x11c]
add esp, 0xc
mov eax, dword [ebp + 8]
mov edi, 0x10
movss xmm1, dword [esi + 0x138]
movss xmm2, dword [esi + 0x13c]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0x124]
subss xmm0, xmm2
lea esi, [ebp - 0x14]
mov edx, dword [eax + edx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4f06e8]
sub edi, 1
jne 0x4110f0
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4153e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x52a278]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov ebx, dword [esi + 0x3f34]
mov ecx, ebx
mov dword [ebp - 8], edx
mov eax, dword [ebx + 0xc]
and eax, 4
or eax, 0x1200103
or edi, eax
cmp dword [ebx + 0x1c8], 0
mov dword [ebp + 0x10], edi
jne 0x415427
cmp dword [esi + 0x4bbc], 0
mov eax, 0x260
je 0x41542c
mov eax, 0x230
movss xmm4, dword [eax + ebx]
xorps xmm3, xmm3
movss xmm5, dword [eax + ebx + 4]
subss xmm4, dword [ecx + 0x128]
subss xmm5, dword [ecx + 0x12c]
mov ecx, dword [ebp + 8]
movss xmm2, dword [0x51b0e8]
mov dword [ebp + 8], 0
mov dword [ebp - 4], 2
cvttss2si eax, dword [ecx]
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
mov eax, 1
cmovnp ecx, eax
ucomiss xmm0, xmm3
lahf
test ah, 0x44
mov eax, dword [ebp + 8]
cmovnp eax, dword [ebp - 4]
or eax, ecx
comiss xmm3, xmm1
mov dword [ebp + 8], eax
jb 0x4154af
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x4154af
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x4154c0
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x4154c0
movaps xmm0, xmm2
or dword [esi + 0x47f4], 2
mov ecx, dword [ebp - 0xc]
movss dword [esi + 0x4818], xmm1
movss dword [esi + 0x481c], xmm0
mov dword [esi + 0x47fc], 1
mov eax, dword [ebx + 4]
push edx
test ecx, ecx
je 0x415503
push ecx
push eax
push str._s__s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.0040ba80
add esp, 0x18
jmp 0x415517
push eax
push str._s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.0040ba80
add esp, 0x14
cmp byte [ebp + 0xc], 0
movss xmm0, dword [esi + 0x385c]
movss dword [ebp - 0xc], xmm0
jne 0x415534
mov dword [esi + 0x385c], 0
mov ecx, dword [ebp - 4]
xor edx, edx
push edi
call fcn.00418a60
mov edi, dword [esi + 0x3f34]
add esp, 4
movss xmm0, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
movss dword [esi + 0x385c], xmm0
cmp word [edi + 0xec], 1
mov byte [ebp + 0xf], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [edi + 0xa8], edx
mov byte [edi + 0xfe], al
jne 0x415589
mov ecx, dword [edi + 0x44]
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x128], ecx
mov dword [ebx + 0x12c], eax
mov edi, edx
mov al, 0x23
not edi
mov edx, 0x4f840d
mov ebx, edi
cmp al, 0x23
jne 0x4155a4
cmp byte [edx], al
jne 0x4155a4
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x4f06e8]
test al, al
jne 0x415596
mov edi, dword [ebp - 0xc]
not ebx
cmp dword [esi + 0x3f80], ebx
jne 0x4155d3
xor edx, edx
xor ecx, ecx
call fcn.00411200
mov eax, dword [ebp - 8]
cmp dword [esi + 0x494c], eax
jne 0x415621
test dword [ebp + 0x10], 0x800000
jne 0x415621
cmp word [edi + 0x184], 0
jne 0x4155fa
cmp byte [edi + 0x18a], 0
je 0x415621
xor edx, edx
mov ecx, edi
call fcn.0041c2f0
xor dl, dl
mov ecx, edi
call fcn.00424b50
mov edx, edi
mov ecx, ebx
call fcn.00411200
mov eax, dword [esi + 0x4970]
mov dword [esi + 0x3fa0], eax
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5d14], 0
lea esi, [edi + 0x5d18]
je 0x4289a1
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x42895c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.004074c0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.0040c9c0
mov edx, dword [esi]
mov ecx, 0x52a274
push dword [edi + 0x5d14]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5d20]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.004cc9a3
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.0040c9c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x428fa0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x52a278]
test bl, bl
je 0x428fe6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x428fc7
cmp byte [esi], bl
jne 0x428fc7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x4f06e8]
test bl, bl
jne 0x428fb8
mov edi, dword [0x52a278]
mov ecx, dword [edi + 0x5cb0]
not eax
mov edx, dword [edi + 0x5cb8]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x42900d
cmp dword [edx + 4], eax
je 0x429010
add edx, 0x24
cmp edx, ecx
jne 0x429001
xor eax, eax
ret
mov eax, edx
ret
Function at 0x4352b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebp - 4], ebx
push dword [ebx + 0x3c0]
lea ecx, [esi + 0x5c70]
call fcn.0040c4e0
cmp dword [ebx + 0x3b8], 0
mov edi, eax
je 0x4352f1
push 0x47ef
push str.C:Users_soniaOneDriveDocumentosGitHubEngine_BonesEngine_Bones_v.1Engine_BonesSourceExternalImGuiimgui.cpp
push str.window__DockNode__0
call fcn.004cb34c
add esp, 0xc
test edi, edi
je 0x435312
cmp dword [edi + 0x1c], 0
je 0x435343
push 1
mov edx, ebx
mov ecx, esi
call fcn.0042d8c0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x3c0]
mov ecx, esi
call fcn.0042c890
mov edi, eax
mov eax, dword [edi + 0xa0]
and eax, 0xfffffe92
or eax, 0x92
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0x3eb0]
mov dword [edi + 0x84], eax
mov bl, byte [edi + 0xa4]
test bl, 1
jne 0x43540c
mov esi, edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x435366
mov esi, eax
test byte [esi + 0xa4], 1
je 0x435354
movss xmm0, dword [esi + 0x3c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x43537d
movss xmm0, dword [esi + 0x40]
comiss xmm0, xmm1
ja 0x435394
push 0x4809
push str.C:Users_soniaOneDriveDocumentosGitHubEngine_BonesEngine_Bones_v.1Engine_BonesSourceExternalImGuiimgui.cpp
push str.ancestor_node__Size.x___0.0f__ancestor_node__Size.y___0.0f
call fcn.004cb34c
add esp, 0xc
mov eax, dword [esi + 0x18]
mov edx, esi
test eax, eax
je 0x4353a9
nop dword [eax]
mov edx, eax
mov eax, dword [edx + 0x18]
test eax, eax
jne 0x4353a0
and byte [edx + 0xa4], 0xdf
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x4353bc
call fcn.0042e820
mov ecx, dword [edx + 0x20]
test ecx, ecx
je 0x4353c8
call fcn.0042e820
cmp dword [edx + 0x18], 0
jne 0x4353ee
mov eax, dword [edx + 0x78]
test eax, eax
je 0x4353ee
nop word [eax + eax]
or byte [eax + 0xa4], 0x20
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x4353e0
push dword [esi + 0x40]
mov edx, edi
mov ecx, esi
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [esi + 0x34]
call fcn.00432fd0
mov bl, byte [edi + 0xa4]
add esp, 0x10
mov esi, dword [ebp - 4]
mov ecx, edi
push 1
mov edx, esi
call fcn.0042dec0
mov al, byte [edi + 0xa4]
add esp, 4
xor al, bl
and al, 1
xor byte [edi + 0xa4], al
cmp edi, dword [esi + 0x3b8]
je 0x43544c
push 0x4812
push str.C:Users_soniaOneDriveDocumentosGitHubEngine_BonesEngine_Bones_v.1Engine_BonesSourceExternalImGuiimgui.cpp
push str.node__window__DockNode
call fcn.004cb34c
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x473d36
mov eax, dword [0x52a278]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x473d26
dec dword [eax + 0xb8]
push ecx
call fcn.004ccba1
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x473d6a
mov eax, dword [0x52a278]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x473d5a
dec dword [eax + 0xb8]
push ecx
call fcn.004ccba1
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x473d9e
mov eax, dword [0x52a278]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x473d8e
dec dword [eax + 0xb8]
push ecx
call fcn.004ccba1
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x473dee
mov eax, dword [0x52a278]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x473dde
dec dword [eax + 0xb8]
push ecx
call fcn.004ccba1
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x473e22
mov eax, dword [0x52a278]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x473e12
dec dword [eax + 0xb8]
push ecx
call fcn.004ccba1
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x473e56
mov eax, dword [0x52a278]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x473e46
dec dword [eax + 0xb8]
push ecx
call fcn.004ccba1
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00477910
Function at 0x486970
Capabilities:
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x52a278]
push esi
mov esi, ecx
push edi
mov edi, dword [eax + 0x4bbc]
cmp esi, 0xffffffff
jne 0x48698c
cmp dword [edi + 0x48], ecx
cmovne esi, dword [edi + 0x48]
mov eax, dword [edi + 0x40]
cmp esi, eax
jne 0x486998
or esi, 0xffffffff
jmp 0x48699d
cmp esi, 0xffffffff
jl 0x4869a1
cmp esi, eax
jl 0x4869b8
push 0xc21
push str.C:Users_soniaOneDriveDocumentosGitHubEngine_BonesEngine_Bones_v.1Engine_BonesSourceExternalImGuiimgui_tables.cpp
push str.column_n____1__column_n___table__ColumnsCount
call fcn.004cb34c
add esp, 0xc
test byte [edi + 4], 7
je 0x486a11
mov ax, word [edi + 0x4c]
mov word [edi + 0x1cc], si
mov esi, 0x51529d
mov word [edi + 0x4e], ax
mov al, 0x23
mov byte [edi + 0x1e3], 1
mov edi, dword [edi]
not edi
mov ecx, edi
cmp al, 0x23
jne 0x4869ef
cmp byte [esi], al
jne 0x4869ef
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x4f06e8]
test al, al
jne 0x4869e1
not ecx
xor edx, edx
call fcn.00422650
pop edi
pop esi
pop ecx
ret
Function at 0x49ae90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
or eax, 2
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0049b000
Function at 0x4b4b40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x524018]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x18]
push edi
push eax
push 0
push dword [ebp + 0x14]
mov dword [0x531120], eax
push 0x1000
push 0x530120
call fcn.004063a0
push dword [eax + 4]
push dword [eax]
call fcn.004c62be
add esp, 0x1c
mov dword [0x531120], 0
push 0x530120
push dword [ebp + 0xc]
push esi
push str._n_s__d__:__s
push 0x1000
push 0x531128
call fcn.004b1420
add esp, 0x18
push 0x531128
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0x531128
mov dword [esp + 0x34], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0xf
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b4be0
sub ecx, edx
push ecx
push 0x531128
lea ecx, [esp + 0x3c]
call fcn.004037c0
mov eax, dword [0x52a180]
test eax, eax
je 0x4b4d14
cmp dword [eax + 0x10], 0
je 0x4b4d14
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.004036e0
mov edx, dword [0x52a180]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov ecx, dword [edx + 0x10]
add ecx, 0xc
je 0x4b4c45
lea eax, [esp + 0x18]
push eax
call fcn.004b4d80
mov edx, dword [0x52a180]
add esp, 4
mov esi, dword [edx + 0x10]
add esi, 0x18
mov dword [esp + 0x10], esi
je 0x4b4ce2
mov ecx, dword [esi + 4]
mov ebx, ecx
mov edi, dword [esi + 8]
mov eax, edi
mov edx, dword [esi]
sub ebx, edx
sub eax, edx
sar ebx, 2
sar eax, 2
mov dword [esp + 0xc], ebx
cmp ebx, eax
jne 0x4b4cc6
xor ebx, ebx
cmp dword [esp + 0xc], ebx
jbe 0x4b4cb8
mov edi, edx
nop dword [eax]
mov eax, ecx
lea esi, [ebx + 1]
sub ecx, edi
mov dword [esp + 0xc], esi
sar ecx, 2
mov edx, edi
cmp esi, ecx
mov esi, dword [esp + 0x10]
jae 0x4b4ca4
mov eax, dword [edi + ebx*4 + 4]
mov dword [edi + ebx*4], eax
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov ebx, dword [esp + 0xc]
mov ecx, eax
sub eax, edx
mov edi, edx
sar eax, 2
cmp ebx, eax
jb 0x4b4c80
mov edi, dword [esi + 8]
mov eax, dword [ebp + 0x10]
sub edi, edx
sar edi, 2
mov dword [edx + edi*4 - 4], eax
jmp 0x4b4ce2
cmp ecx, edi
je 0x4b4cd5
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
add dword [esi + 4], 4
jmp 0x4b4ce2
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.004b4870
mov edx, dword [esp + 0x2c]
cmp edx, 0x10
jb 0x4b4d14
mov ecx, dword [esp + 0x18]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b4d0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b4d58
push edx
push ecx
call fcn.004bf0a3
add esp, 8
mov edx, dword [esp + 0x48]
cmp edx, 0x10
jb 0x4b4d46
mov ecx, dword [esp + 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4b4d3c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b4d58
push edx
push ecx
call fcn.004bf0a3
add esp, 8
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bee44
mov esp, ebp
pop ebp
ret
call fcn.004c27ef
int3
Function at 0x4bfcb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x4bfdea
mov ecx, dword [ebp - 4]
lea ecx, [ecx*4 + 4]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x4bfdea
xor ebx, ebx
cmp dword [ebp - 4], ebx
jle 0x4bfd8c
sub eax, esi
mov dword [ebp - 0xc], eax
mov edi, edi
push dword [esi]
call sub.SDL2.dll_SDL_wcslen
lea eax, [eax*2 + 2]
push eax
push dword [esi]
push str.UTF_16LE
push str.UTF_8
call sub.SDL2.dll_SDL_iconv_string
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4bfdea
push edi
call sub.SDL2.dll_SDL_strlen
add esp, 4
mov dword [ebp - 0x10], eax
lea ecx, [eax + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + esi], eax
test eax, eax
je 0x4bfdea
push dword [ebp - 0x10]
push edi
push eax
call sub.SDL2.dll_SDL_memcpy
push edi
call sub.SDL2.dll_SDL_free
inc ebx
add esp, 0x10
add esi, 4
cmp ebx, dword [ebp - 4]
jl 0x4bfd10
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 8]
push esi
mov dword [edi + ebx*4], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
call sub.SDL2.dll_SDL_SetMainReady
push edi
push dword [ebp - 4]
call fcn.004b5240
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 4], esi
jle 0x4bfdd4
jmp 0x4bfdc0
push dword [edi + esi*4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
inc esi
cmp esi, dword [ebp - 4]
jl 0x4bfdc0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push str.Out_of_memory___aborting
push str.Fatal_Error
push 0x10
call sub.SDL2.dll_SDL_ShowSimpleMessageBox
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d30cd
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d304f

Function at 0x4d5bcb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d5a41

Function at 0x4d9f2e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d9bab
Function at 0x5a0f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x5b59fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x5a1002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.005a4dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x5a1002
lea edx, [esp + 0x14]
push edx
push 0x5bb140
call fcn.0059c6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.005a520b
push 0x10
call fcn.005a51d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x5a0fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.005911c0
jmp 0x5a0fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.005a0b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x5a0ff0
mov ecx, edi
call fcn.005912c0
push edi
call fcn.005a51c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x5a1021
inc ebx
cmp ebx, 0x20
jb 0x5a0f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x5a41b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.005a4140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.005a4140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.005a4140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.005a4140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x5a4230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5a42d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0x5a42ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.005a4230
mov esi, eax
add esp, 8
test esi, esi
jne 0x5a42ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0x5a427e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0x5a42ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x5a4bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5a4c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x5b687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5a4c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5a4c52
xor eax, eax
pop esi
leave
ret 4