joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469510
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x94
mov eax, dword [esp + 0x98]
push ebx
mov dword [esp + 0x10], eax
mov al, byte [esp + 0xa0]
xor ebx, ebx
push esi
cmp al, bl
push edi
mov esi, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x1c], bl
mov dword [esp + 0xc], vtable.FilePipe.0
jne 0x46955a
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0050b920
mov edi, eax
jmp 0x4695fb
push ebx
push str.Digest
mov ecx, esi
call fcn.0050aca0
lea edx, [esp + 0x20]
mov ecx, esi
push edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
mov dword [esp + 0x24], vtable.SHAPipe.0
call fcn.0050b920
lea edi, [esi + 0x39]
lea ecx, [esp + 0x20]
push edi
call fcn.0066abe0
lea ecx, [esp + 0x20]
mov byte [esi + 0x38], 1
call fcn.006064f0
push 0x14
push edi
push str.Digest
mov ecx, esi
call fcn.0050c2c0
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.0050b920
push ebx
push str.Digest
mov ecx, esi
mov edi, eax
call fcn.0050aca0
lea ecx, [esp + 0xc]
call fcn.0075ed30
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x94
ret 8

Function at 0x46bdc0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x8c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x38], bl
jne 0x46be39
lea eax, [esp + 0x14]
mov dword [esp + 0x18], ebx
push eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0x24], bl
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x3c], 0x67452301
mov dword [esp + 0x40], 0xefcdab89
mov dword [esp + 0x44], 0x98badcfe
mov dword [esp + 0x48], 0x10325476
mov dword [esp + 0x4c], 0xc3d2e1f0
mov dword [esp + 0x18], vtable.SHAPipe.0
call fcn.0050b920
lea ecx, [esi + 0x39]
push ecx
lea ecx, [esp + 0x18]
call fcn.0066abe0
lea ecx, [esp + 0x14]
mov byte [esi + 0x38], 1
call fcn.006064f0
add esi, 0x39
push 0x14
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call fcn.00493c50
pop esi
pop ebx
add esp, 0x8c
ret
Function at 0x482a20
Capabilities:
Get disk size

Disassembly:
sub esp, 0x28
push esi
push str.Checking_available_disk_space_n
call fcn.004068f0
add esp, 4
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x482add
push str.GetDiskFreeSpaceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x482ac5
push str.Using_GetDiskFreeSpaceEx_n
call fcn.004068f0
add esp, 4
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x14]
push eax
push ecx
push edx
push 0
call esi
test al, al
jne 0x482a92
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetDiskFreeSpaceEx_failed_with_error_code__d____s_n
call fcn.004068f0
add esp, 0xc
jmp 0x482aea
fild dword [esp + 0x18]
fmul qword [0x788e10]
fiadd dword [esp + 0x14]
fmul qword [0x788e08]
call fcn.0076a6b0
mov esi, eax
shr eax, 0xa
push eax
push str.Free_disk_space_is__d_Mb_n
call fcn.004068f0
add esp, 8
mov eax, esi
pop esi
add esp, 0x28
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetProcAddress_failed_with_error_code__d____s_n
call fcn.004068f0
add esp, 0xc
jmp 0x482aea
push str.Failed_to_get_module_handle_for_KERNEL32.DLL_n
call fcn.004068f0
add esp, 4
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x482b35
mov esi, dword [esp + 4]
imul esi, dword [esp + 8]
shr esi, 0xa
imul esi, dword [esp + 0xc]
mov edx, esi
shr edx, 0xa
push edx
push str.Free_disk_space_is__d_Mb_n
call fcn.004068f0
add esp, 8
mov eax, esi
pop esi
add esp, 0x28
ret
xor eax, eax
pop esi
add esp, 0x28
ret
Function at 0x4916d0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push str.COPYPROTECTION___Checking_if_launcher_is_running_n
call fcn.004068f0
mov eax, dword [str.48BC11BD_C4D7_466b_8A31_C6ABBAD47B3E]
add esp, 4
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test esi, esi
je 0x49170a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop ebx
ret

Function at 0x493a80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x493a8a
mov dword [ecx + 8], eax
mov dl, byte [esp + 4]
push esi
mov byte [eax + ecx + 8], dl
mov esi, dword [ecx + 4]
inc esi
mov eax, esi
mov dword [ecx + 4], esi
cmp eax, 4
jne 0x493afd
mov al, byte [ecx + 4]
mov byte [ecx + 0xc], al
mov eax, dword [ecx + 4]
inc eax
cmp eax, esi
jae 0x493abc
mov dl, byte [ecx + 8]
mov byte [ecx + eax + 8], dl
inc eax
cmp eax, 4
jb 0x493aaf
mov eax, dword [ecx + 8]
push ebx
mov dword [esp + 0xc], eax
mov eax, dword [ecx]
push edi
lea esi, [esp + 0x10]
not eax
mov edi, 4
mov edx, eax
xor ebx, ebx
mov bl, byte [esi]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x7c0624]
xor eax, edx
inc esi
dec edi
jne 0x493ad2
not eax
pop edi
mov dword [ecx], eax
mov dword [ecx + 4], 0
pop ebx
pop esi
ret 4

Function at 0x493b10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [ecx + 4]
xor edx, edx
cmp eax, edx
jne 0x493b1c
mov dword [ecx + 8], edx
push ebx
mov bl, byte [esp + 8]
cmp bl, dl
push edi
setne bl
mov byte [eax + ecx + 8], bl
mov edi, dword [ecx + 4]
inc edi
mov eax, edi
mov dword [ecx + 4], edi
cmp eax, 4
jne 0x493b91
mov al, byte [ecx + 4]
mov byte [ecx + 0xc], al
mov eax, dword [ecx + 4]
inc eax
cmp eax, edi
jae 0x493b54
mov bl, byte [ecx + 8]
mov byte [ecx + eax + 8], bl
inc eax
cmp eax, 4
jb 0x493b47
mov eax, dword [ecx + 8]
push ebp
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
push esi
lea esi, [esp + 0x14]
not eax
mov edi, 4
mov ebp, eax
xor ebx, ebx
mov bl, byte [esi]
and ebp, 0xff
xor ebp, ebx
shr eax, 8
mov ebx, dword [ebp*4 + 0x7c0624]
xor eax, ebx
inc esi
dec edi
jne 0x493b6a
not eax
pop esi
mov dword [ecx], eax
mov dword [ecx + 4], edx
pop ebp
pop edi
pop ebx
ret 4
Function at 0x493c50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
push esi
cmp ebp, ebx
push edi
mov esi, ecx
je 0x493db0
mov edi, dword [esp + 0x18]
cmp edi, ebx
jle 0x493db0
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x493ccb
mov edx, 4
cmp eax, edx
jae 0x493ccb
mov cl, byte [ebp]
mov byte [eax + esi + 8], cl
mov ecx, dword [esi + 4]
inc ecx
mov eax, ecx
mov dword [esi + 4], ecx
cmp eax, edx
jne 0x493cc5
mov al, cl
mov byte [esi + 0xc], al
mov eax, dword [esi + 4]
inc eax
cmp eax, edx
jae 0x493cad
mov cl, byte [esi + 8]
mov byte [esi + eax + 8], cl
inc eax
cmp eax, edx
jb 0x493ca1
mov ecx, dword [esi]
mov eax, dword [esi + 8]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
call fcn.00493e20
mov dword [esi], eax
mov dword [esi + 4], ebx
inc ebp
dec edi
cmp edi, ebx
jg 0x493c70
mov eax, edi
shr eax, 2
mov edx, eax
dec eax
test edx, edx
je 0x493d26
inc eax
mov dword [esp + 0x14], eax
neg eax
lea eax, [edi + eax*4]
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov ecx, ebp
not eax
mov edi, 4
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x7c0624]
xor eax, edx
inc ecx
dec edi
jne 0x493cf0
not eax
mov dword [esi], eax
mov eax, dword [esp + 0x14]
add ebp, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x493ce5
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
jle 0x493db0
mov dword [esp + 0x14], edi
mov eax, dword [esi + 4]
mov cl, byte [ebp]
cmp eax, ebx
jne 0x493d3f
mov dword [esi + 8], ebx
mov byte [eax + esi + 8], cl
mov ecx, dword [esi + 4]
inc ecx
mov edi, 4
mov eax, ecx
mov dword [esi + 4], ecx
cmp eax, edi
jne 0x493da4
mov al, cl
mov byte [esi + 0xc], al
mov eax, dword [esi + 4]
inc eax
cmp eax, edi
jae 0x493d6e
mov cl, byte [esi + 8]
mov byte [esi + eax + 8], cl
inc eax
cmp eax, edi
jb 0x493d62
mov edx, dword [esi + 8]
mov eax, dword [esi]
mov dword [esp + 0x18], edx
lea ecx, [esp + 0x18]
not eax
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x7c0624]
xor eax, edx
inc ecx
dec edi
jne 0x493d7d
not eax
xor ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [esp + 0x14]
inc ebp
dec eax
mov dword [esp + 0x14], eax
jne 0x493d32
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x493e10
mov cl, al
mov byte [eax + esi + 8], cl
mov eax, dword [esi + 4]
inc eax
cmp eax, 4
jae 0x493dd3
mov dl, byte [esi + 8]
mov byte [esi + eax + 8], dl
inc eax
cmp eax, 4
jb 0x493dc6
mov eax, dword [esi + 8]
mov esi, dword [esi]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
not esi
mov ecx, 4
mov edx, esi
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
shr esi, 8
mov edx, dword [edx*4 + 0x7c0624]
xor esi, edx
inc eax
dec ecx
jne 0x493de7
not esi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esi]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x493e20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, edx
dec edx
test esi, esi
not eax
je 0x493e51
push ebx
lea esi, [edx + 1]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x7c0624]
xor eax, edx
inc ecx
dec esi
jne 0x493e32
pop ebx
not eax
pop esi
ret 4
Function at 0x4b7810
Capabilities:
Terminate process

Disassembly:
push esi
push edi
call fcn.00522200
mov eax, dword [0x7c1bd4]
dec eax
je 0x4b78ca
dec eax
je 0x4b78ff
dec eax
je 0x4b78ba
mov edi, dword [sym.imp.USER32.dll_ShowCursor]
push 1
call edi
mov edx, 5
mov ecx, 0xf7
call fcn.00495170
mov esi, eax
test esi, esi
je 0x4b7883
push str.Resource_found_n
call fcn.004068f0
mov eax, dword [0xb0de30]
mov ecx, dword [0xb0dbd8]
add esp, 4
push 0
push 0x4b7710
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
mov esi, eax
push 0
call edi
mov eax, esi
pop edi
pop esi
ret
push str.Resource_not_found_n
call fcn.004068f0
mov edx, dword [0xb0de30]
mov eax, dword [0xb0dbd8]
add esp, 4
push 0
push 0x4b7710
push edx
push 0xf7
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov esi, eax
push 0
call edi
mov eax, esi
pop edi
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_AllocConsole]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_FreeConsole]
test eax, eax
jne 0x4b78e0
call edi
call esi
push str.Error___Recursive_exception_detected._Program_halted._r_n_See_EXCEPT.TXT_file_for_details_r_r_n
call fcn.00781c94
add esp, 4
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00781977
call edi
pop edi
mov eax, 0x481
pop esi
ret
Function at 0x4d0e10
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push edx
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
test eax, eax
push 0x14b
push esi
sete byte [esp + 0x23]
call edi
push 7
push 0
push 0x4de
push esi
call edi
xor edx, edx
mov ecx, str.GUI:RandomEx
push 0xd2
push str.C:RA2GDlgSupp.cpp
call fcn.006eea10
push eax
push 0
push 0x4c2
push esi
call edi
push 0xfffffffffffffffe
push eax
push 0x151
push esi
call edi
mov ebx, dword [0xa1e028]
xor ebp, ebp
test ebx, ebx
jle 0x4d0eb4
mov eax, dword [0xa1e01c]
mov eax, dword [eax + ebp*4]
mov cl, byte [eax + 0x1a5]
test cl, cl
je 0x4d0eaf
mov eax, dword [eax + 0x60]
push eax
push 0
push 0x4c2
push esi
call edi
push ebp
push eax
push 0x151
push esi
call edi
inc ebp
cmp ebp, ebx
jl 0x4d0e85
push 0
push 0
push 0x14e
push esi
call edi
mov al, byte [esp + 0x13]
test al, al
jne 0x4d0ed1
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4d0f60
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
mov eax, dword [0xa256dc]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [0xa256e0]
mov dword [esp + 0x18], eax
mov eax, 0xfffffffe
mov dword [esp + 0x14], edi
cmp ecx, eax
jne 0x4d0f89
mov dword [esp + 0x18], eax
test edx, edx
jne 0x4d0f94
mov esi, 0x6a1
jmp 0x4d0ff1
cmp edx, 1
jne 0x4d0fa0
mov esi, 0x510
jmp 0x4d0ff1
cmp edx, 2
jne 0x4d0fac
mov esi, 0x513
jmp 0x4d0ff1
cmp edx, 3
jne 0x4d0fb8
mov esi, 0x51e
jmp 0x4d0ff1
cmp edx, 4
jne 0x4d0fc4
mov esi, 0x514
jmp 0x4d0ff1
cmp edx, 5
jne 0x4d0fd0
mov esi, 0x51f
jmp 0x4d0ff1
cmp edx, 6
jne 0x4d0fdc
mov esi, 0x520
jmp 0x4d0ff1
sub edx, 7
neg edx
sbb edx, edx
and edx, 0xfffffade
add edx, 0x521
mov esi, edx
push esi
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
push 0
push 0
push 0x146
push esi
push edi
sete byte [esp + 0x27]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ebp, eax
xor edi, edi
test ebp, ebp
jle 0x4d1043
mov ecx, dword [esp + 0x14]
push 0
push edi
push 0x150
push esi
push ecx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp eax, dword [esp + 0x18]
je 0x4d106c
inc edi
cmp edi, ebp
jl 0x4d1024
mov ebp, dword [esp + 0x14]
mov al, byte [esp + 0x13]
test al, al
jne 0x4d1058
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, 0x6a1
jne 0x4d1082
xor esi, esi
mov eax, 0x6da
jmp 0x4d1114
mov ebp, dword [esp + 0x14]
push 0
push edi
push 0x14e
push esi
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x4d1047
cmp esi, 0x510
jne 0x4d1096
mov esi, 1
mov eax, 0x6db
jmp 0x4d1114
cmp esi, 0x513
jne 0x4d10aa
mov esi, 2
mov eax, 0x6dc
jmp 0x4d1114
cmp esi, 0x51e
jne 0x4d10be
mov esi, 3
mov eax, 0x6dd
jmp 0x4d1114
cmp esi, 0x514
jne 0x4d10d2
mov esi, 4
mov eax, 0x6de
jmp 0x4d1114
cmp esi, 0x51f
jne 0x4d10e6
mov esi, 5
mov eax, 0x6df
jmp 0x4d1114
cmp esi, 0x520
jne 0x4d10fa
mov esi, 6
mov eax, 0x6e0
jmp 0x4d1114
cmp esi, 0x521
jne 0x4d110e
mov esi, 7
mov eax, 0x6e1
jmp 0x4d1114
or esi, 0xffffffff
or eax, 0xffffffff
push eax
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
test esi, esi
mov edi, eax
jne 0x4d1129
mov esi, 0x6a1
jmp 0x4d1184
cmp esi, 1
jne 0x4d1135
mov esi, 0x510
jmp 0x4d1184
cmp esi, 2
jne 0x4d1141
mov esi, 0x513
jmp 0x4d1184
cmp esi, 3
jne 0x4d114d
mov esi, 0x51e
jmp 0x4d1184
cmp esi, 4
jne 0x4d1159
mov esi, 0x514
jmp 0x4d1184
cmp esi, 5
jne 0x4d1165
mov esi, 0x51f
jmp 0x4d1184
cmp esi, 6
jne 0x4d1171
mov esi, 0x520
jmp 0x4d1184
sub esi, 7
neg esi
sbb esi, esi
and esi, 0xfffffade
add esi, 0x521
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x147
push esi
push ebp
call ebx
push 0
push eax
push 0x150
push esi
push ebp
call ebx
mov ecx, eax
call fcn.004d0a00
mov edx, eax
mov ecx, edi
call fcn.005da2f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4d11c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, edx
push edi
mov ebp, ecx
push esi
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
push 0
push 0
push 0x146
push esi
push ebp
sete byte [esp + 0x27]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x4d122d
push 0
push edi
push 0x150
push esi
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp eax, dword [esp + 0x1c]
je 0x4d121d
inc edi
cmp edi, ebx
jl 0x4d1200
jmp 0x4d122d
push 0
push edi
push 0x14e
push esi
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov al, byte [esp + 0x13]
test al, al
jne 0x4d1242
mov eax, dword [esp + 0x14]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, 0x6a1
jne 0x4d1256
xor esi, esi
mov eax, 0x6da
jmp 0x4d12e8
cmp esi, 0x510
jne 0x4d126a
mov esi, 1
mov eax, 0x6db
jmp 0x4d12e8
cmp esi, 0x513
jne 0x4d127e
mov esi, 2
mov eax, 0x6dc
jmp 0x4d12e8
cmp esi, 0x51e
jne 0x4d1292
mov esi, 3
mov eax, 0x6dd
jmp 0x4d12e8
cmp esi, 0x514
jne 0x4d12a6
mov esi, 4
mov eax, 0x6de
jmp 0x4d12e8
cmp esi, 0x51f
jne 0x4d12ba
mov esi, 5
mov eax, 0x6df
jmp 0x4d12e8
cmp esi, 0x520
jne 0x4d12ce
mov esi, 6
mov eax, 0x6e0
jmp 0x4d12e8
cmp esi, 0x521
jne 0x4d12e2
mov esi, 7
mov eax, 0x6e1
jmp 0x4d12e8
or esi, 0xffffffff
or eax, 0xffffffff
push eax
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
test esi, esi
mov edi, eax
jne 0x4d12fd
mov esi, 0x6a1
jmp 0x4d1358
cmp esi, 1
jne 0x4d1309
mov esi, 0x510
jmp 0x4d1358
cmp esi, 2
jne 0x4d1315
mov esi, 0x513
jmp 0x4d1358
cmp esi, 3
jne 0x4d1321
mov esi, 0x51e
jmp 0x4d1358
cmp esi, 4
jne 0x4d132d
mov esi, 0x514
jmp 0x4d1358
cmp esi, 5
jne 0x4d1339
mov esi, 0x51f
jmp 0x4d1358
cmp esi, 6
jne 0x4d1345
mov esi, 0x520
jmp 0x4d1358
sub esi, 7
neg esi
sbb esi, esi
and esi, 0xfffffade
add esi, 0x521
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x147
push esi
push ebp
call ebx
push 0
push eax
push 0x150
push esi
push ebp
call ebx
mov ecx, eax
call fcn.004d0a00
mov edx, eax
mov ecx, edi
call fcn.005da2f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4d1770
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov ebx, edx
push edi
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
test eax, eax
push 0x14b
push esi
sete byte [esp + 0x23]
call edi
push 1
push 0
push 0x4dd
push esi
call edi
push 9
push 0
push 0x4de
push esi
call edi
xor edx, edx
mov ecx, str.GUI:RandomAsSymbols
push 0x197
push str.C:RA2GDlgSupp.cpp
call fcn.006eea10
push eax
push 0
push 0x4c2
push esi
call edi
mov ebp, eax
push 0xfffffffffffffffe
push ebp
push 0x151
push esi
call edi
push 0xffffffffffffffff
push ebp
push 0x498
push esi
call edi
cmp ebx, 0x6a2
jne 0x4d180b
mov dword [esp + 0x14], 0
jmp 0x4d188b
cmp ebx, 0x522
jne 0x4d181d
mov dword [esp + 0x14], 1
jmp 0x4d188b
cmp ebx, 0x523
jne 0x4d182f
mov dword [esp + 0x14], 2
jmp 0x4d188b
cmp ebx, 0x524
jne 0x4d1841
mov dword [esp + 0x14], 3
jmp 0x4d188b
cmp ebx, 0x525
jne 0x4d1853
mov dword [esp + 0x14], 4
jmp 0x4d188b
cmp ebx, 0x526
jne 0x4d1865
mov dword [esp + 0x14], 5
jmp 0x4d188b
cmp ebx, 0x527
jne 0x4d1877
mov dword [esp + 0x14], 6
jmp 0x4d188b
sub ebx, 0x528
neg ebx
sbb ebx, ebx
and ebx, 0xfffffff8
add ebx, 7
mov dword [esp + 0x14], ebx
xor eax, eax
mov ebx, 0x84e3f0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
mov ebp, dword [esp + 0x14]
cmp eax, ebp
sete cl
test cl, cl
mov byte [esp + 0x12], cl
jne 0x4d18b2
cmp eax, 0xffffffff
jne 0x4d18e9
mov eax, dword [ebx - 8]
push eax
push 0
push 0x4c2
push esi
call edi
mov ebp, eax
mov eax, dword [ebx - 4]
push eax
push ebp
push 0x498
push esi
call edi
mov ecx, dword [esp + 0x18]
push ecx
push ebp
push 0x151
push esi
call edi
mov al, byte [esp + 0x12]
test al, al
je 0x4d18e9
mov dword [esp + 0x1c], ebp
mov edx, dword [esp + 0x18]
add ebx, 0xc
inc edx
cmp ebx, 0x84e450
mov dword [esp + 0x18], edx
jl 0x4d189a
mov edx, dword [esp + 0x1c]
push 0
push edx
push 0x14e
push esi
call edi
mov al, byte [esp + 0x13]
test al, al
jne 0x4d191d
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4d1a60
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, edx
mov ebp, ecx
push esi
push ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
sete byte [esp + 0xb]
cmp esi, 0x6a2
jne 0x4d1a95
xor eax, eax
jmp 0x4d1aff
cmp esi, 0x522
jne 0x4d1aa4
mov eax, 1
jmp 0x4d1aff
cmp esi, 0x523
jne 0x4d1ab3
mov eax, 2
jmp 0x4d1aff
cmp esi, 0x524
jne 0x4d1ac2
mov eax, 3
jmp 0x4d1aff
cmp esi, 0x525
jne 0x4d1ad1
mov eax, 4
jmp 0x4d1aff
cmp esi, 0x526
jne 0x4d1ae0
mov eax, 5
jmp 0x4d1aff
cmp esi, 0x527
jne 0x4d1aef
mov eax, 6
jmp 0x4d1aff
mov eax, esi
sub eax, 0x528
neg eax
sbb eax, eax
and al, 0xf8
add eax, 7
push ebx
push edi
xor edx, edx
mov ecx, 0x84e3f0
cmp dword [ecx], eax
je 0x4d1b1a
add ecx, 0xc
inc edx
cmp ecx, 0x84e450
jl 0x4d1b08
jmp 0x4d1b2d
cmp edx, 0xffffffff
je 0x4d1b2d
lea eax, [edx + edx*2]
mov dword [eax*4 + 0x84e3f0], 0xffffffff
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x146
push esi
push ebp
call ebx
xor edi, edi
test eax, eax
mov dword [esp + 0x18], eax
jle 0x4d1c12
push 0
push edi
push 0x150
push esi
push ebp
call ebx
mov ebp, eax
cmp ebp, dword [esp + 0x24]
je 0x4d1b74
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
inc edi
cmp edi, eax
jl 0x4d1b4e
jmp 0x4d1c12
mov ecx, dword [esp + 0x14]
push 0
push edi
push 0x14e
push esi
push ecx
call ebx
cmp ebp, 0xfffffffe
je 0x4d1c0e
cmp esi, 0x6a2
jne 0x4d1b99
xor esi, esi
jmp 0x4d1c03
cmp esi, 0x522
jne 0x4d1ba8
mov esi, 1
jmp 0x4d1c03
cmp esi, 0x523
jne 0x4d1bb7
mov esi, 2
jmp 0x4d1c03
cmp esi, 0x524
jne 0x4d1bc6
mov esi, 3
jmp 0x4d1c03
cmp esi, 0x525
jne 0x4d1bd5
mov esi, 4
jmp 0x4d1c03
cmp esi, 0x526
jne 0x4d1be4
mov esi, 5
jmp 0x4d1c03
cmp esi, 0x527
jne 0x4d1bf3
mov esi, 6
jmp 0x4d1c03
sub esi, 0x528
neg esi
sbb esi, esi
and esi, 0xfffffff8
add esi, 7
lea edx, [ebp + ebp*2]
mov dword [edx*4 + 0x84e3f0], esi
mov ebp, dword [esp + 0x14]
mov al, byte [esp + 0x13]
pop edi
test al, al
pop ebx
jne 0x4d1c29
mov eax, dword [esp + 0x14]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor esi, esi
test esi, esi
jne 0x4d1c36
mov edx, 0x6a2
jmp 0x4d1c93
cmp esi, 1
jne 0x4d1c42
mov edx, 0x522
jmp 0x4d1c93
cmp esi, 2
jne 0x4d1c4e
mov edx, 0x523
jmp 0x4d1c93
cmp esi, 3
jne 0x4d1c5a
mov edx, 0x524
jmp 0x4d1c93
cmp esi, 4
jne 0x4d1c66
mov edx, 0x525
jmp 0x4d1c93
cmp esi, 5
jne 0x4d1c72
mov edx, 0x526
jmp 0x4d1c93
cmp esi, 6
jne 0x4d1c7e
mov edx, 0x527
jmp 0x4d1c93
mov edx, esi
sub edx, 7
neg edx
sbb edx, edx
and edx, 0xfffffad7
add edx, 0x528
mov ecx, ebp
call fcn.004d1770
inc esi
cmp esi, 8
jl 0x4d1c2b
pop esi
pop ebp
add esp, 0x10
ret 4
Function at 0x4eadf0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push str.Houses
call fcn.0050be00
xor ebx, ebx
test eax, eax
mov dword [esp + 0x10], eax
jle 0x4eaec9
lea eax, [esp + 0x14]
push 0x14
push eax
push 0x824884
push ebx
push str.Houses
mov ecx, ebp
call fcn.0050c100
mov ecx, ebp
push eax
push str.Houses
call fcn.0050dca0
lea ecx, [esp + 0x14]
push 0xffffffffffffffff
push str.Country
push ecx
mov ecx, ebp
call fcn.0046a620
mov esi, eax
cmp esi, 0xffffffff
jne 0x4eae53
xor esi, esi
push 0x15f90
call fcn.0076d5a7
add esp, 4
test eax, eax
je 0x4eae79
mov edx, dword [0xa1e01c]
mov ecx, dword [edx + esi*4]
push ecx
mov ecx, eax
call fcn.004e0e00
mov esi, eax
jmp 0x4eae7b
xor esi, esi
lea edx, [esp + 0x14]
test edx, edx
jne 0x4eae89
mov byte [esp + 0x28], dl
jmp 0x4eaea2
lea eax, [esp + 0x14]
push 0x14
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0076d960
add esp, 0xc
mov byte [esp + 0x3c], 0
lea edi, [esi + 0x15ee0]
lea edx, [esp + 0x28]
cmp edx, edi
je 0x4eaebc
mov ecx, 5
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
inc ebx
cmp ebx, eax
jl 0x4eae11
mov eax, dword [0xa1a5b8]
xor edi, edi
test eax, eax
jle 0x4eaf2f
mov eax, dword [0xa1a5ac]
push ebp
mov esi, dword [eax + edi*4]
mov ecx, esi
call fcn.004eaf80
mov eax, dword [0xa255a8]
test eax, eax
jne 0x4eaf23
mov al, byte [esi + 0x134]
test al, al
jne 0x4eaf01
mov al, byte [esi + 0x135]
test al, al
je 0x4eaf10
mov ecx, dword [0xa255a0]
mov edx, dword [ecx + 0x60c]
push edx
jmp 0x4eaf1c
mov eax, dword [0xa255a0]
mov ecx, dword [eax + 0x610]
push ecx
mov ecx, esi
call fcn.004e2380
mov eax, dword [0xa1a5b8]
inc edi
cmp edi, eax
jl 0x4eaed4
test eax, eax
jne 0x4eaf74
mov eax, dword [0xa1e028]
xor esi, esi
test eax, eax
jle 0x4eaf74
push 0x15f90
call fcn.0076d5a7
add esp, 4
test eax, eax
je 0x4eaf60
mov edx, dword [0xa1e01c]
mov ecx, dword [edx + esi*4]
push ecx
mov ecx, eax
call fcn.004e0e00
jmp 0x4eaf62
xor eax, eax
push ebp
mov ecx, eax
call fcn.004eaf80
mov eax, dword [0xa1e028]
inc esi
cmp esi, eax
jl 0x4eaf3c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret