joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e070
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x404
mov eax, dword [0x6ab100]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
push esi
push edi
push ecx
push 0x75fcf0
lea eax, [esp + 0x14]
push str._s_Data__s
push eax
call fcn.00434600
lea eax, [esp + 0x1c]
push 0x699174
push eax
call fcn.005f7b8a
push 2
mov ebx, eax
push 0
push ebx
call fcn.005f8d0f
push ebx
call fcn.005f9433
push 0
push 0
push ebx
mov edi, eax
call fcn.005f8d0f
mov ecx, edi
call fcn.0045a430
push ebx
push edi
mov esi, eax
push 1
push esi
call fcn.005f7ecf
mov ecx, dword [esp + 0x450]
add esp, 0x44
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005e8cbe
add esp, 0x404
ret
Function at 0x442e40
Capabilities:
Print debug messages

Disassembly:
push ecx
push ebx
mov bl, dl
push esi
mov esi, dword [esp + 0x14]
test cl, cl
je 0x442e54
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test bl, bl
je 0x442e7e
mov eax, dword [0x85af70]
test eax, eax
je 0x442e7e
push esi
push 0x698c8c
push eax
call fcn.0043dc60
add esp, 0xc
push dword [0x85af70]
call fcn.005f97f8
add esp, 4
cmp byte [esp + 0x10], 0
je 0x442e94
mov ecx, dword [0x6abfd0]
push esi
call fcn.0044fa90
add esp, 4
pop esi
pop ebx
pop ecx
ret

Function at 0x447f90
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push 1
push 0x80
push 0x6de78a
call fcn.005f7ecf
add esp, 0x10
cmp eax, 1
jne 0x447fc8
lea ecx, [eax + 0x29]
call fcn.00459df0
mov edx, eax
mov eax, 0x80
push eax
push edx
push 3
call fcn.00459e10
add esp, 0xc
pop ecx
ret
mov ecx, 0x2b
mov edx, 0x698c8c
call fcn.00459df0
push eax
push edx
push 3
call fcn.00459e10
add esp, 0xc
pop ecx
ret

Function at 0x449e00
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
call fcn.00447ec0
push 0x699174
push 0x7628f0
mov dword [0x76c368], eax
call fcn.005f7b8a
mov esi, eax
add esp, 8
test esi, esi
jne 0x449e2a
lea eax, [esi + 6]
pop esi
pop ecx
ret
push 2
push 0
push esi
call fcn.005f8d0f
push esi
call fcn.005f9433
add esp, 0x10
mov dword [0x75fc64], eax
mov edx, 0x75fc64
lea ecx, [esp + 4]
call fcn.00449c00
cmp dword [0x75fc64], 0
jg 0x449e61
mov eax, 0xa
pop esi
pop ecx
ret
push 0
push dword [esp + 8]
push esi
call fcn.005f8d0f
add esp, 0xc
call fcn.00449ec0
cmp eax, 0xffffffff
jne 0x449e82
mov eax, 2
pop esi
pop ecx
ret
push esi
push dword [0x75fc64]
push 1
push dword [0x764104]
call fcn.005f7ecf
add esp, 0x10
cmp eax, dword [0x75fc64]
je 0x449ea9
mov eax, 7
pop esi
pop ecx
ret
push esi
call fcn.005f7cc6
add esp, 4
xor eax, eax
pop esi
pop ecx
ret
Function at 0x455c10
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push edi
push 0x699174
push ecx
call fcn.005f7b8a
mov edi, eax
add esp, 8
test edi, edi
jne 0x455c37
mov dword [0x6de77c], 6
pop edi
add esp, 8
ret
push ebp
push 2
push 0
push edi
call fcn.005f8d0f
add esp, 0xc
test eax, eax
jne 0x455d67
push edi
call fcn.005f9433
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x455d67
push 0
push 0
push edi
call fcn.005f8d0f
add esp, 0xc
test eax, eax
jne 0x455d67
push ebx
push esi
push 0x10
call fcn.005f137e
mov ebx, eax
lea ecx, [ebp + 1]
push ecx
mov dword [esp + 0x1c], ebx
mov dword [ebx], ebp
call fcn.005f137e
push edi
mov esi, eax
mov dword [ebx + 8], 0
push ebp
lea eax, [ebx + 8]
mov dword [ebx + 4], esi
push 1
push esi
mov dword [esp + 0x28], eax
call fcn.005f7ecf
add esp, 0x18
cmp eax, ebp
jae 0x455ccf
mov ecx, ebx
mov dword [0x6de77c], 7
call fcn.00455d80
pop esi
pop ebx
pop ebp
xor eax, eax
pop edi
add esp, 8
ret
push edi
mov byte [esi + ebp], 0
call fcn.005f7cc6
add esp, 4
cmp byte [esi], 0xef
jne 0x455cf0
cmp byte [esi + 1], 0xbb
jne 0x455cf0
cmp byte [esi + 2], 0xbf
jne 0x455cf0
add esi, 3
push 0xa
push esi
xor ebp, ebp
call fcn.005ea340
mov edi, eax
add esp, 8
test edi, edi
je 0x455d3c
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
mov ecx, esi
mov byte [edi], 0
call fcn.00455720
mov edx, esi
mov ecx, ebx
call fcn.00455800
lea esi, [edi + 1]
inc ebp
push 0xa
push esi
call fcn.005ea340
mov edi, eax
add esp, 8
test edi, edi
jne 0x455d10
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 4]
add eax, dword [ebx]
cmp esi, eax
jae 0x455d50
mov edx, esi
lea ecx, [ebx + 8]
call fcn.00455800
inc ebp
pop esi
mov dword [ebx + 0xc], ebp
mov eax, ebx
pop ebx
pop ebp
mov dword [0x6de77c], 0
pop edi
add esp, 8
ret
pop ebp
mov dword [0x6de77c], 7
xor eax, eax
pop edi
add esp, 8
ret

Function at 0x459e10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x86b1b0
call fcn.00431710
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.005f105b
mov eax, dword [ebp + 8]
add esp, 0x1c
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test eax, eax
mov ecx, 3
cmovne ecx, eax
xor esi, esi
mov eax, ecx
and eax, 2
mov dword [esp + 0xc], eax
mov eax, ecx
and eax, 1
and ecx, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test esi, esi
mov edi, 0x86b1b0
push 0x6a0ee8
cmovne edi, esi
push edi
call fcn.005f99a0
mov esi, eax
add esp, 8
test esi, esi
je 0x459e92
mov byte [esi], 0
inc esi
cmp dword [esp + 0xc], 0
je 0x459eb9
mov edx, 0x6dec10
mov eax, edi
sub edx, edi
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x459ea2
mov dword [0x6df014], 0x78
cmp dword [esp + 0x10], 0
je 0x459ec7
mov ecx, edi
call fcn.00464820
cmp dword [esp + 0x14], 0
je 0x459ed8
push edi
call ebx
push 0x699144
call ebx
test esi, esi
jne 0x459e70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459ef0
Capabilities:
Create thread
Terminate thread

Disassembly:
push 0
push 1
push 0
push 0
mov dword [0x86b18c], edx
mov dword [0x86b190], 0
mov dword [0x86b194], 0
mov dword [0x86b198], 0
mov word [0x86b1ac], 0
mov dword [0x86b1a4], 0
mov dword [0x86b1a8], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [0x86b1a4], eax
test eax, eax
je 0x459f98
push 0x86b1a0
push 0
push 0x86b18c
push 0x45a070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x86b19c], eax
test eax, eax
je 0x459f98
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xbb8
push dword [0x86b1a4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x459fa6
push 1
push dword [0x86b19c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
or eax, 0xffffffff
mov dword [0x6de77c], 0x11
ret
xor eax, eax
ret

Function at 0x459fb0
Capabilities:
Terminate thread

Disassembly:
push 1
push dword [0x86b19c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x86b194]
test eax, eax
je 0x459fe2
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x86b194], 0
mov dword [0x86b198], 0
ret

Function at 0x45a490
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push 0
mov esi, edx
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45a509
test esi, esi
jne 0x45a4bc
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45a4b0
sub ecx, edx
lea esi, [ecx + ebx]
sub esi, ebx
lea eax, [esi + 1]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x45a509
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push esi
push str._.s
push eax
call fcn.00434600
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov al, 1
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x45a510
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45a558
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x45a558
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x45a544
push eax
call fcn.00600659
add esp, 4
mov edi, eax
jmp 0x45a546
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop edi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4621e0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 1
push 0x40
push dword [0x789a9c]
call fcn.005f7ecf
mov eax, dword [0x6abba4]
add esp, 0x10
mov eax, dword [eax + 0x18]
jmp eax

Function at 0x4623c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x6ab100]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, ecx
mov esi, edx
push edi
push 2
push 8
push 0x789ae0
call fcn.005f7ecf
add esp, 0x10
push edi
push 1
cmp esi, 0xb
jge 0x4624b6
lea eax, [esp + 0x18]
push 5
push eax
call fcn.005f7ecf
add esp, 0x10
mov dword [0x789af0], 0
cmp word [0x789ae0], 0
mov eax, 0x4000
mov byte [0x789af4], 0xff
mov ecx, 1
mov word [0x789af6], ax
jne 0x462433
mov word [0x789ae0], cx
xor eax, eax
mov byte [0x789aa2], cl
mov word [0x789aa0], ax
mov dword [0x789aa4], 0x80000000
cmp word [0x789ae4], ax
jne 0x46245b
mov word [0x789ae4], cx
xor eax, eax
mov byte [0x789ab2], cl
mov word [0x789ab0], ax
mov dword [0x789ab4], 0x80000000
cmp word [0x789ae8], ax
jne 0x462483
mov word [0x789ae8], cx
xor eax, eax
mov byte [0x789ac2], cl
mov word [0x789ac0], ax
mov dword [0x789ac4], 0x80000000
mov word [0x789ad0], ax
mov byte [0x789ad2], cl
mov dword [0x789ad4], 0x80000000
jmp 0x46253b
lea eax, [esp + 0x13]
push 1
push eax
call fcn.005f7ecf
movzx eax, byte [esp + 0x1b]
push edi
push 1
mov dword [0x789af0], eax
lea eax, [esp + 0x23]
push 1
push eax
call fcn.005f7ecf
mov al, byte [esp + 0x2b]
push edi
push 2
mov byte [0x789af4], al
lea eax, [esp + 0x34]
push 1
push eax
call fcn.005f7ecf
mov ax, word [esp + 0x3c]
add esp, 0x30
mov word [0x789af6], ax
mov esi, 0x789aa2
push edi
push 2
lea eax, [esi - 2]
push 1
push eax
call fcn.005f7ecf
push edi
push 1
push 1
push esi
call fcn.005f7ecf
push edi
push 4
lea eax, [esi + 2]
push 1
push eax
call fcn.005f7ecf
add esi, 0x10
add esp, 0x30
cmp esi, 0x789ae2
jl 0x462506
call fcn.00462560
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
call fcn.005e8cbe
add esp, 0x14
ret

Function at 0x464c90
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
lea eax, [esp + 0xb]
push esi
push 1
push 1
push eax
mov edi, edx
call fcn.005f7ecf
add esp, 0x10
cmp eax, 1
jne 0x464cbb
movzx eax, byte [esp + 0xb]
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ecx
ret
push esi
call fcn.005f9e76
add esp, 4
neg eax
sbb eax, eax
pop edi
pop esi
pop ecx
ret
Function at 0x464dc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, ecx
push 2
push edi
push ebx
mov dword [esp + 0x1c], ebx
mov ebp, 0xffff
mov dword [esp + 0x20], edi
call fcn.005f8d0f
add esp, 0xc
test eax, eax
jne 0x464ed3
push ebx
call fcn.005f9433
cmp eax, ebp
mov dword [esp + 0x1c], eax
push 0x404
cmovb ebp, eax
call fcn.005f137e
mov esi, eax
add esp, 8
test esi, esi
je 0x464ed3
mov ebx, 4
cmp ebp, ebx
jbe 0x464ec0
mov ecx, 0x404
lea eax, [ebx + 0x400]
mov ebx, ebp
cmp eax, ebp
push 0
cmovbe ebx, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov edi, ebx
push eax
push dword [esp + 0x18]
cmp ebx, 0x404
mov dword [esp + 0x28], eax
cmova edi, ecx
call fcn.005f8d0f
add esp, 0xc
test eax, eax
jne 0x464ebc
push dword [esp + 0x10]
push 1
push edi
push esi
call fcn.005f7ecf
add esp, 0x10
cmp eax, 1
jne 0x464ebc
lea ecx, [edi - 3]
test ecx, ecx
jle 0x464eaf
lea eax, [esi + 3]
add eax, ecx
nop word [eax + eax]
mov edx, ecx
lea eax, [eax - 1]
dec ecx
cmp byte [eax - 3], 0x50
jne 0x464e9d
cmp byte [edx + esi], 0x4b
jne 0x464e9d
cmp byte [eax - 1], 5
jne 0x464e9d
cmp byte [eax], 6
je 0x464ea3
test ecx, ecx
jg 0x464e80
jmp 0x464eaf
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x14], eax
jne 0x464ebc
mov ecx, 0x404
cmp ebx, ebp
jb 0x464e24
mov edi, dword [esp + 0x14]
push esi
call fcn.005f10dd
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x4650c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
mov ebx, ecx
xor esi, esi
mov ebp, edx
push edi
test ebx, ebx
jne 0x4650dc
lea eax, [ecx - 0x66]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
mov eax, dword [ebx + 0x14]
add eax, dword [ebx + 0xc]
push 0
push eax
push dword [ebx]
call fcn.005f8d0f
add esp, 0xc
test eax, eax
je 0x4650f8
or esi, 0xffffffff
jmp 0x46511c
mov ecx, dword [ebx]
lea edx, [esp + 0x10]
call fcn.00464d20
test eax, eax
je 0x46510c
or esi, 0xffffffff
jmp 0x46511c
cmp dword [esp + 0x10], 0x2014b50
mov eax, 0xffffff99
cmovne esi, eax
mov ecx, dword [ebx]
lea edx, [esp + 0x18]
call fcn.00464cd0
mov ecx, dword [ebx]
lea edx, [esp + 0x1c]
or edi, 0xffffffff
test eax, eax
cmovne esi, edi
call fcn.00464cd0
mov ecx, dword [ebx]
lea edx, [esp + 0x20]
test eax, eax
cmovne esi, edi
call fcn.00464cd0
mov ecx, dword [ebx]
lea edx, [esp + 0x24]
test eax, eax
cmovne esi, edi
call fcn.00464cd0
mov ecx, dword [ebx]
lea edx, [esp + 0x28]
test eax, eax
cmovne esi, edi
call fcn.00464d20
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x50]
test eax, eax
cmovne esi, edi
call fcn.00465070
mov ecx, dword [ebx]
lea edx, [esp + 0x2c]
call fcn.00464d20
mov ecx, dword [ebx]
lea edx, [esp + 0x30]
test eax, eax
cmovne esi, edi
call fcn.00464d20
mov ecx, dword [ebx]
lea edx, [esp + 0x34]
test eax, eax
cmovne esi, edi
call fcn.00464d20
mov ecx, dword [ebx]
lea edx, [esp + 0x38]
test eax, eax
cmovne esi, edi
call fcn.00464cd0
mov ecx, dword [ebx]
lea edx, [esp + 0x3c]
test eax, eax
cmovne esi, edi
call fcn.00464cd0
mov ecx, dword [ebx]
lea edx, [esp + 0x40]
test eax, eax
cmovne esi, edi
call fcn.00464cd0
mov ecx, dword [ebx]
lea edx, [esp + 0x44]
test eax, eax
cmovne esi, edi
call fcn.00464cd0
mov ecx, dword [ebx]
lea edx, [esp + 0x48]
test eax, eax
cmovne esi, edi
call fcn.00464cd0
mov ecx, dword [ebx]
lea edx, [esp + 0x4c]
test eax, eax
cmovne esi, edi
call fcn.00464d20
mov ecx, dword [ebx]
lea edx, [esp + 0x14]
test eax, eax
cmovne esi, edi
call fcn.00464d20
test eax, eax
je 0x465227
or edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
mov edi, esi
test esi, esi
jne 0x465275
mov edx, dword [esp + 0x70]
test edx, edx
je 0x465279
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x74]
cmp eax, ecx
jae 0x46524b
mov byte [eax + edx], 0
mov dword [esp + 0x10], eax
jmp 0x46524f
mov dword [esp + 0x10], ecx
mov edi, esi
test eax, eax
je 0x465275
test ecx, ecx
je 0x465275
push dword [ebx]
push 1
push dword [esp + 0x18]
push edx
call fcn.005f7ecf
add esp, 0x10
cmp eax, 1
mov eax, 0xffffffff
cmovne edi, eax
test edi, edi
jne 0x4652b8
test ebp, ebp
je 0x4652aa
movups xmm0, xmmword [esp + 0x18]
movups xmmword [ebp], xmm0
movups xmm0, xmmword [esp + 0x28]
movups xmmword [ebp + 0x10], xmm0
movups xmm0, xmmword [esp + 0x38]
movups xmmword [ebp + 0x20], xmm0
movups xmm0, xmmword [esp + 0x48]
movups xmmword [ebp + 0x30], xmm0
movups xmm0, xmmword [esp + 0x58]
movups xmmword [ebp + 0x40], xmm0
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4652b8
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x465680
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
xor eax, eax
xor edx, edx
mov dword [esp + 4], eax
mov dword [esp], edx
push esi
test ecx, ecx
je 0x465807
mov esi, dword [ecx + 0x7c]
test esi, esi
je 0x465807
cmp dword [esi], eax
jne 0x4656ae
lea eax, [edx - 0x64]
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x4656bd
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [0x764104]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x14], ecx
cmp ecx, eax
jbe 0x4656d4
mov dword [esi + 0x14], eax
mov ecx, eax
push ebx
push ebp
push edi
test ecx, ecx
je 0x4657fd
lea ebp, [esi + 4]
mov ebx, dword [esi + 8]
test ebx, ebx
jne 0x46573d
mov eax, dword [esi + 0x58]
test eax, eax
je 0x46573d
mov ebx, 0x4000
cmp eax, ebx
push 0
cmovb ebx, eax
mov eax, dword [esi + 0x68]
add eax, dword [esi + 0x3c]
push eax
push dword [esi + 0x60]
call fcn.005f8d0f
add esp, 0xc
test eax, eax
jne 0x4657f2
push dword [esi + 0x60]
push 1
push ebx
push dword [esi]
call fcn.005f7ecf
add esp, 0x10
cmp eax, 1
jne 0x4657f2
add dword [esi + 0x3c], ebx
mov eax, dword [esi]
sub dword [esi + 0x58], ebx
mov dword [ebp], eax
mov dword [esi + 8], ebx
cmp dword [esi + 0x64], 0
jne 0x465796
mov edi, dword [esi + 0x14]
cmp edi, ebx
cmovae edi, ebx
xor edx, edx
test edi, edi
je 0x465762
mov eax, dword [ebp]
mov ecx, dword [esi + 0x10]
mov al, byte [edx + eax]
mov byte [edx + ecx], al
inc edx
cmp edx, edi
jb 0x465751
push edi
push dword [esi + 0x10]
push dword [esi + 0x50]
call fcn.00546340
mov edx, dword [esp + 0x1c]
add esp, 0xc
sub dword [esi + 0x5c], edi
sub dword [esi + 8], edi
sub dword [esi + 0x14], edi
add dword [esi + 0x10], edi
add dword [ebp], edi
add dword [esi + 0x18], edi
add edx, edi
mov edi, dword [esp + 0x14]
mov dword [esi + 0x50], eax
mov dword [esp + 0x10], edx
jmp 0x4657da
mov edi, dword [esi + 0x18]
mov ebx, dword [esi + 0x10]
push 2
push ebp
call fcn.00546640
mov ebp, dword [esi + 0x18]
sub ebp, edi
mov dword [esp + 0x1c], eax
push ebp
push ebx
push dword [esi + 0x50]
call fcn.00546340
mov edx, dword [esp + 0x24]
add esp, 0x14
sub dword [esi + 0x5c], ebp
add edx, ebp
mov edi, dword [esp + 0x14]
mov dword [esi + 0x50], eax
mov dword [esp + 0x10], edx
cmp edi, 1
je 0x4657fd
test edi, edi
jne 0x4657e8
lea ebp, [esi + 4]
cmp dword [esi + 0x14], 0
ja 0x4656e2
test edi, edi
je 0x4657fd
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
add esp, 8
ret
pop edi
pop ebp
pop ebx
mov eax, edx
pop esi
add esp, 8
ret
mov eax, 0xffffff9a
pop esi
add esp, 8
ret
Function at 0x48b4d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
call fcn.005fabce
mov edi, dword [eax]
mov eax, 0x6ad408
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48b4e3
lea ecx, [ebp + 0xc]
sub eax, edx
push ecx
push 0
push dword [ebp + 8]
mov ecx, 0x800
sub ecx, eax
lea eax, [eax + 0x6ad408]
push ecx
push eax
call fcn.00431710
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.005f105b
mov eax, dword [0x8d8868]
add esp, 0x1c
test eax, eax
je 0x48b52f
push 0x6ad408
call eax
add esp, 4
jmp 0x48b586
push esi
push 0x6ad408
call fcn.004b18b0
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._al_trace_suffix
push str.C:dev_allegro_winpkguniversal_allegro_srcdebug.c
push 0x13c
push esi
call fcn.0048b6b0
mov eax, dword [0x6a9698]
add esp, 0x10
pop esi
test eax, eax
je 0x48b586
push 0x6ad408
push 0x698c8c
push eax
call fcn.0043dc60
push dword [0x6a9698]
call fcn.005f97f8
add esp, 0x10
mov byte [0x6ad408], 0
call fcn.005fabce
mov dword [eax], edi
mov eax, dword [0x6a969c]
pop edi
test eax, eax
je 0x48b5a5
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
ret
Function at 0x48d400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6ab100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.005fabce
mov dword [eax], 0
test esi, esi
jne 0x48d442
call fcn.005fabce
pop esi
mov dword [eax], 0xe
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e8cbe
mov esp, ebp
pop ebp
ret
cmp word [esi], 0
jne 0x48d464
call fcn.005fabce
pop esi
mov dword [eax], 0x14
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e8cbe
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48d48c
call fcn.005fabce
pop esi
mov dword [eax], 2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e8cbe
mov esp, ebp
pop ebp
ret
test al, 0x10
je 0x48d448
push 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.005fbdc4
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48d4b0
push ebx
sub ecx, edx
sar ecx, 1
push str._wopendir
push str.C:dev_allegro_winpkguniversal_allegro_src_fshook_win.inc
push 0x7c
lea eax, [ecx*2 + 0x456]
push eax
call fcn.0048b6d0
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x48d4ff
call fcn.005fabce
pop ebx
pop esi
mov dword [eax], 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e8cbe
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20c]
lea esi, [ebx + 0x448]
mov eax, ecx
mov edx, esi
sub edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x48d511
push edi
cmp word [esi], ax
je 0x48d5a3
mov edi, esi
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x48d530
sub edi, ecx
push 0x2f
push esi
sar edi, 1
call fcn.005eab50
lea ecx, [edi + 0x223]
add esp, 8
lea ecx, [ebx + ecx*2]
cmp eax, ecx
je 0x48d5a3
mov edi, esi
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x48d560
sub edi, ecx
push 0x5c
push esi
sar edi, 1
call fcn.005eab50
lea ecx, [edi + 0x223]
add esp, 8
lea ecx, [ebx + ecx*2]
cmp eax, ecx
je 0x48d5a3
lea edi, [esi - 2]
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x48d590
mov eax, dword [0x6156f8]
mov dword [edi], eax
add esi, 0xfffffffe
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x48d5a6
mov eax, dword [0x6156fc]
mov edi, esi
push 0x104
mov dword [edi], eax
xor eax, eax
push eax
mov dword [ebx + 0x234], eax
lea eax, [ebx + 0x238]
push eax
mov dword [ebx + 0x440], 0xffffffff
mov dword [ebx + 0x444], 0
mov dword [ebx + 0x230], 0
call fcn.005ea9f0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, ebx
xor ecx, ebp
pop edi
pop ebx
pop esi
call fcn.005e8cbe
mov esp, ebp
pop ebp
ret
Function at 0x48d8f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x20
push edi
mov edi, 0x10
movzx edx, word [esi + 0x16]
mov eax, edx
and eax, 0xf000
cmp eax, 0x4000
cmovne ecx, edi
mov dword [esi + 0xc], ecx
test edx, 0x100
je 0x48d926
or ecx, 1
mov dword [esi + 0xc], ecx
test dl, dl
jns 0x48d930
or ecx, 2
mov dword [esi + 0xc], ecx
test dl, 0x40
je 0x48d93b
or ecx, 4
mov dword [esi + 0xc], ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 2
je 0x48d94c
or dword [esi + 0xc], 8
pop edi
pop esi
pop ebp
ret

Function at 0x48da00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6ab100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.005fcc7d
add esp, 8
test eax, eax
jne 0x48da44
mov eax, dword [ebp - 0x2e]
and eax, 0xf000
cmp eax, 0x4000
pop esi
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005e8cbe
mov esp, ebp
pop ebp
ret
push esi
call fcn.005fc4f5
mov ecx, dword [ebp - 4]
add esp, 4
test eax, eax
sete al
xor ecx, ebp
pop esi
call fcn.005e8cbe
mov esp, ebp
pop ebp
ret

Function at 0x4a13c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 0xc]
push 0
push 0
push esi
push 0x4a1610
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x10]
push 0
push 0
mov byte [esi + 0x1c], 0
mov dword [esi + 0x24], eax
call fcn.005fcfca
add esp, 0x18
mov dword [esi], eax
pop esi
pop ebp
ret