joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41efa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.004118f0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41f06b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41f06b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41f01e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x41f029
or bh, 8
and edi, 0x8000000
je 0x41f044
mov eax, dword [0x44115c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41f06b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41f46b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41f48f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41f4aa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x42443a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x42447c
call fcn.00428bc7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x42447c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x424473
xor eax, eax
jmp 0x424484
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0042448a
pop edi
pop esi
pop ebx
ret 4

Function at 0x429434
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x429462
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x429480
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042939a
jmp 0x429480
mov eax, dword [esi + 0x14]
test eax, eax
je 0x429480
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042939a
test edi, edi
mov eax, edi
jne 0x42946a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2d592525
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
mov eax, section..rsrc
nop
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5e4f5086
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x409350
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov ecx, dword [sym.imp.mameplib.dll_drivers]
mov edi, dword [ebp + 8]
mov edx, dword [ecx + esi*4]
mov eax, dword [edx + 8]
mov dword [esp], eax
call fcn.00401660
test eax, eax
mov ebx, eax
je 0x40946d
mov edx, 0xffffffff
mov dword [esp + 4], edx
mov esi, dword [edi]
mov dword [esp], esi
call sub.USER32.dll_WaitForInputIdle
mov dword [ebp - 0x18], edi
sub esp, 8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
mov dword [esp + 4], eax
mov dword [esp], 0x40e360
call sub.USER32.dll_EnumWindows
mov esi, dword [ebp - 0x14]
sub esp, 8
xor ecx, ecx
mov dword [esp + 0xc], ebx
mov edx, pe_nt_image_headers32
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.0044e1c5
mov ecx, dword [0x46a010]
sub esp, 0x10
mov edx, 8
mov dword [esp + 4], edx
mov esi, dword [ebp - 0x14]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp], esi
xor esi, esi
call fcn.0044e1c5
mov dword [ebp - 0x20], edi
sub esp, 0x10
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
mov edi, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40e360
call sub.USER32.dll_EnumWindows
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov ecx, pe_nt_image_headers32
mov dword [esp + 0xc], ebx
mov ebx, 8
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0044e1c5
mov edi, dword [ebp - 0x1c]
sub esp, 0x10
mov eax, dword [0x46a010]
mov dword [esp + 0xc], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.0044e1c5
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.00429280
test eax, eax
je 0x4094a3
mov eax, dword [sym.imp.mameplib.dll_drivers]
mov ebx, dword [eax + esi*4]
mov dword [esp], ebx
call dword [sym.imp.mameplib.dll_driver_get_clone]
test eax, eax
je 0x4094a3
mov esi, dword [eax + 8]
mov dword [esp], esi
call fcn.00401660
test eax, eax
mov ebx, eax
jne 0x40937d
mov edx, dword [0x46a020]
mov ecx, 0x6b
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.0044e135
sub esp, 8
mov ebx, eax
jmp 0x40937d
Function at 0x414fb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov edx, dword [eax]
test edx, edx
mov dword [ebp - 0x1c], edx
je 0x415050
mov edx, dword [ebp - 0x10]
xor ebx, ebx
mov esi, dword [edx + 4]
cmp esi, 0
jle 0x415006
mov esi, esi
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ecx + ebx*8]
test edi, edi
je 0x415001
mov eax, dword [ebp - 0x14]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x41509f
inc ebx
cmp esi, ebx
jg 0x414fe0
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x415048
xor ebx, ebx
cmp esi, 0
jmp 0x415021
mov edx, dword [ebp - 0x1c]
mov edi, dword [edx + ebx*8]
test edi, edi
je 0x415023
inc ebx
cmp esi, ebx
jg 0x415014
cmp esi, ebx
je 0x4150c5
mov edi, dword [ebp - 0x14]
mov dword [esp], edi
call sub.msvcrt.dll__strdup
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + ebx*8], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov edx, dword [ebp - 0x18]
mov dword [eax + ebx*8 + 4], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x40
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x10]
test eax, eax
mov dword [ebx], eax
je 0x4150b2
mov esi, dword [ebp - 0x10]
mov ecx, 0x40
mov dword [esi + 4], 8
mov edx, dword [ebp - 0x1c]
test dl, 4
je 0x415090
mov dword [edx], 0
mov ecx, 0x3c
mov edx, dword [ebp - 0x1c]
add edx, 4
cld
xor eax, eax
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
jmp 0x414fd1
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x415102
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [eax + ebx*8 + 4], edx
jmp 0x415048
mov dword [ebp + 8], str.error:_malloc_failed_in_set_folder_flag_n
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00428ae0
lea eax, [ebx*8 + 0x40]
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x1c]
mov dword [esp], ecx
call sub.msvcrt.dll_realloc
test eax, eax
je 0x41511b
cld
mov edx, dword [ebp - 0x10]
mov ecx, 0x10
mov dword [edx], eax
mov esi, dword [edx + 4]
lea edi, [eax + esi*8]
xor eax, eax
rep stosd dword es:[edi], eax
add dword [edx + 4], 8
mov ecx, dword [edx]
mov dword [ebp - 0x1c], ecx
jmp 0x41502b
mov dword [esp], edi
call sub.msvcrt.dll_free
mov edi, dword [ebp - 0x10]
mov esi, dword [edi]
mov dword [esi + ebx*8], 0
jmp 0x415048
mov dword [ebp + 8], str.error:_realloc_failed_in_set_folder_flag_n
jmp 0x4150b9

Function at 0x415130
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, 0x4712b8
pop ebp
jmp fcn.00414fb0
Function at 0x415150
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0xc], ebx
xor ebx, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov edi, dword [0x471e58]
mov esi, dword [0x472c74]
mov dword [esp], 0x12
mov dword [esp + 4], edi
call fcn.00429950
mov dword [esp], esi
mov ecx, 0x12
mov dword [esp + 4], ecx
call dword [sym.imp.mameplib.dll_mame_faccess]
mov dword [esp + 8], esi
mov edx, 0x4635e3
mov dword [esp], str.I__shave_ctrlr__s
test eax, eax
sete bl
test ebx, ebx
mov eax, 0x4635f6
cmove eax, edx
mov dword [esp + 4], eax
call fcn.00428ae0
test ebx, ebx
jne 0x4151d0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0xc], esi
mov ebx, str._s_s.cfg
lea esi, [ebp - 0x128]
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov dword [esp], edi
mov edi, 0x463607
call sub.msvcrt.dll__mkdir_1
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll_fopen
test eax, eax
mov ebx, eax
je 0x4151be
mov dword [esp + 4], eax
mov eax, dword [str._mameconfig_version_10___n_t_system_name_default___n_t_t_____n_t_t_tStandard_input_customization_file_n_t_t_t_dummy_file_for_GUI__n_t_t____n_t__system__n__mameconfig__n]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x421e30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x463e1c
push esi
mov esi, 0x463607
push ebx
sub esp, 0x24c
mov ebx, dword [0x471e30]
mov dword [esp], ebx
call sub.msvcrt.dll__mkdir
mov dword [esp], str.MAME32ui.ini
call fcn.00428e50
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x128]
mov dword [esp + 0xc], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x23c], eax
test eax, eax
je 0x421feb
mov dword [esp], 0x4712a0
call fcn.00429600
mov esi, dword [sym.imp.mameplib.dll_build_version]
mov dword [esp], esi
call sub.msvcrt.dll__strdup
mov dword [0x4712a0], eax
mov ecx, dword [0x471290]
mov dword [esp], ecx
call dword [sym.imp.mameplib.dll_options_set_datalist]
mov eax, 0x4712a0
call fcn.0041b960
xor eax, eax
xor edx, edx
cmp eax, dword [0x471150]
mov dword [ebp - 0x240], edx
jge 0x421fce
xor ebx, ebx
lea edi, [ebp - 0x238]
mov dword [ebp - 0x244], ebx
mov esi, dword [0x472eb0]
mov ebx, dword [ebp - 0x244]
mov edx, dword [ebp - 0x240]
add ebx, esi
mov esi, dword [sym.imp.mameplib.dll_drivers]
lea ecx, [ebx + 4]
mov dword [ebp - 0x134], ecx
lea eax, [ebx + 8]
mov dword [ebp - 0x138], ebx
mov ecx, dword [esi + edx*4]
add ebx, 0xc
mov dword [ebp - 0x12c], ebx
mov ebx, edi
mov dword [ebp - 0x130], eax
mov eax, dword [ecx + 8]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
nop
mov eax, dword [ebx]
add ebx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov ecx, edx
and ecx, 0x80808080
je 0x421f40
mov esi, ecx
lea eax, [ebx + 2]
shr esi, 0x10
and edx, 0x8080
cmove ecx, esi
mov dl, cl
mov esi, ebx
cmove esi, eax
add dl, cl
sbb esi, 3
xor ebx, ebx
nop
lea esi, [esi]
mov dword [esp], esi
mov eax, dword [ebx*4 + 0x45d950]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov edx, dword [ebp + ebx*4 - 0x138]
inc ebx
mov ecx, dword [edx]
mov dword [esp], edi
mov dword [esp + 4], ecx
call dword [sym.imp.mameplib.dll_options_set_int]
cmp ebx, 3
jbe 0x421f80
inc dword [ebp - 0x240]
add dword [ebp - 0x244], 0x1c
mov ebx, dword [ebp - 0x240]
cmp ebx, dword [0x471150]
jl 0x421ef0
mov esi, dword [ebp - 0x23c]
mov dword [esp], esi
call dword [sym.imp.mameplib.dll_options_output_ini_file]
mov edi, dword [ebp - 0x23c]
mov dword [esp], edi
call sub.msvcrt.dll_fclose
xor ebx, ebx
call fcn.0041dba0
cmp ebx, dword [0x471150]
jge 0x42200a
mov eax, ebx
inc ebx
call fcn.00421a80
cmp ebx, dword [0x471150]
jl 0x421ffa
xor esi, esi
cmp esi, dword [0x471140]
jge 0x42203b
xor ebx, ebx
lea esi, [esi]
lea edi, [edi]
mov ecx, dword [0x578490]
mov eax, ebx
inc esi
add ebx, 0x18
add eax, ecx
call fcn.00421700
cmp esi, dword [0x471140]
jl 0x422020
add esp, 0x24c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x427020
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov edx, dword [eax + 0xc]
test edx, edx
js 0x4270e6
cmp edx, dword [0x472f20]
jae 0x4270d4
mov ecx, dword [0x472f30]
mov ebx, dword [ecx + edx*4]
test ebx, ebx
je 0x4270d4
call fcn.004132b0
mov dword [esp + 0x14], edi
mov esi, 0x104
mov edx, dword [ebx]
mov dword [esp + 0xc], eax
mov eax, str._s_s_s.ini
mov dword [esp + 4], esi
lea esi, [ebp - 0x128]
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.0044ff50
call fcn.004132b0
mov edi, dword [ebp + 0x10]
mov edx, str._s_s_s.ini
mov dword [esp + 0x14], edi
mov ecx, dword [ebx]
mov edi, 0x104
mov dword [esp + 0xc], eax
lea ebx, [ebp - 0x238]
mov dword [esp + 8], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0044ff50
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.KERNEL32.dll_MoveFileA
sub esp, 8
mov ebx, dword [ebp - 0xc]
mov eax, 1
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.004132b0
mov dword [esp + 0xc], eax
mov esi, 0x104
mov eax, str._s_s.ini
mov dword [esp + 4], esi
lea esi, [ebp - 0x128]
mov ebx, 0x104
mov dword [esp + 0x10], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.0044ff50
call fcn.004132b0
mov dword [esp + 4], ebx
mov ecx, dword [ebp + 0x10]
mov edx, str._s_s.ini
mov dword [esp + 8], edx
lea ebx, [ebp - 0x238]
mov dword [esp], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
call fcn.0044ff50
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.KERNEL32.dll_MoveFileA
sub esp, 8
call fcn.004132b0
mov dword [esp + 0xc], eax
mov ecx, str._s_s
mov eax, 0x104
mov dword [esp + 8], ecx
mov dword [esp + 0x10], edi
mov edi, str._s_s
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0044ff50
call fcn.004132b0
mov dword [esp + 0xc], eax
mov edx, dword [ebp + 0x10]
mov ecx, 0x104
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp + 0x10], edx
mov dword [esp], ebx
call fcn.0044ff50
jmp 0x4270c5
Function at 0x427750
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov edx, dword [esi + 0xc]
test edx, edx
js 0x4277e0
mov ebx, dword [esi]
mov dword [esp], edi
call sub.msvcrt.dll_strlen
inc eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esi], eax
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov eax, esi
call fcn.004271b0
test eax, eax
je 0x4277c5
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00427020
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov ebx, dword [ebp - 0xc]
mov eax, 1
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esi], ebx
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.00414600
mov dword [esp + 0xc], eax
mov edx, str._s_s.ini
mov ebx, 0x104
mov dword [esp + 8], edx
lea eax, [ebp - 0x238]
mov dword [esp + 4], ebx
mov ebx, 0x104
mov dword [esp + 0x10], edi
mov dword [esp], eax
call fcn.0044ff50
call fcn.00414600
mov ecx, dword [esi]
mov edx, str._s_s.ini
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x128]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0044ff50
mov dword [esp], ebx
lea ecx, [ebp - 0x238]
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_MoveFileA
mov dword [ebp - 0x43c], eax
sub esp, 8
test eax, eax
jne 0x4278f2
mov dword [esp], 5
mov eax, str.Error_while_renaming_custom_file__s_to__s
mov edi, 0x10
mov dword [esp + 4], eax
mov esi, 0x4643ac
call dword [sym.imp.mameplib.dll_lang_message]
mov dword [esp + 0xc], ebx
lea ecx, [ebp - 0x238]
mov edx, 0x1f4
mov dword [esp + 0x10], ecx
lea ebx, [ebp - 0x438]
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.0044ff50
mov dword [esp + 4], ebx
mov dword [esp], 5
call dword [sym.imp.mameplib.dll_lang_message]
mov dword [esp], eax
call fcn.00429af0
mov ebx, eax
call fcn.004013e0
mov dword [esp], eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
call fcn.0044dda5
sub esp, 0x10
mov eax, dword [ebp - 0x43c]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 8], edi
mov eax, dword [esi]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00427020
mov ecx, dword [esi]
mov dword [esp], ecx
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_strlen
inc eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esi], eax
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
jmp 0x4278df
Function at 0x428980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x275c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0044f0a0
mov eax, dword [ebp + 8]
lea ebx, [ebp + 0xc]
mov edi, 0x464670
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x13a8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_vsprintf
mov dword [esp], ebx
call fcn.00429af0
mov esi, eax
call sub.USER32.dll_GetActiveWindow
mov dword [esp], eax
mov edx, 0x10
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
lea edi, [ebp - 0x2738]
mov dword [esp + 4], esi
mov esi, 0x454d414d
call fcn.0044dda5
mov dword [ebp - 0x2738], esi
sub esp, 0x10
mov ecx, 0x203a3233
mov dword [ebp - 0x2734], ecx
mov esi, edi
mov byte [ebp - 0x2730], 0
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp], edi
call sub.msvcrt.dll_strlen
mov word [eax + edi], 0xa
nop
lea esi, [esi]
mov ecx, dword [esi]
add esi, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
mov ecx, edx
and ecx, 0x80808080
je 0x428a20
mov dword [esp], edi
mov ebx, ecx
shr ebx, 0x10
and edx, 0x8080
cmove ecx, ebx
mov al, cl
lea ebx, [esi + 2]
cmovne ebx, esi
add al, cl
sbb ebx, 3
sub ebx, edi
call fcn.00429af0
mov dword [esp], 0xfffffff5
mov esi, eax
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
xor ecx, ecx
lea edx, [ebp - 0x273c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
mov eax, dword [0x4739e0]
sub esp, 0x14
test eax, eax
jne 0x428ab9
mov dword [esp], str.debug.txt
mov esi, 0x464688
mov dword [esp + 4], esi
call sub.msvcrt.dll_fopen
mov dword [0x4739e0], eax
test eax, eax
je 0x428ad3
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov edi, dword [0x4739e0]
mov dword [esp], edi
call sub.msvcrt.dll_fflush
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x428ae0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov eax, 0x13a4
mov ebp, esp
push ebx
call fcn.0044f0a0
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
mov ecx, 0x1388
mov dword [esp + 0xc], edx
lea ebx, [ebp - 0x1398]
mov dword [esp + 4], ecx
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll__vsnprintf
mov dword [esp], ebx
call fcn.00429af0
mov dword [esp], eax
call sub.KERNEL32.dll_OutputDebugStringW
sub esp, 4
mov ebx, dword [ebp - 4]
leave
ret