joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428050
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, edx
test ecx, ecx
jne 0x4280bc
push 0x2792a00
push dword [0x4b09c4]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push dword [0x4b0dd0]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [0x4b0dd0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x421
push dword [0x4b1654]
call esi
push 0
push 0
push 5
push dword [0x4b09c0]
call esi
push 0
push 0
push 0x411
push dword [0x4b09c4]
call esi
pop esi
ret
mov eax, dword [0x2792a0c]
mov edx, dword [0x2792a04]
sub eax, edx
mov ecx, dword [0x2792a00]
push 1
push eax
mov eax, dword [0x2792a08]
sub eax, ecx
push eax
push edx
push ecx
push dword [0x4b09c4]
call dword [sym.imp.USER32.dll_MoveWindow]
test esi, esi
je 0x4280ba
push 1
push dword [0x4b0dd0]
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [0x4b0dd0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x421
push dword [0x4b1654]
call esi
push 0
push 0
push 5
push dword [0x4b09c0]
call esi
pop esi
jmp fcn.004283f0

Function at 0x4288e0
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.004287f0
call fcn.00428860
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
push 0x64
push 0x2792d19
push 0x49b4c6
push 0x4a2164
push edi
call esi
call fcn.00428860
push eax
push 0x64
push 0x2792d7d
push 0x49b4c7
push 0x4a2170
push edi
call esi
call fcn.00428860
push eax
push 0x64
push 0x2792de1
push 0x49b4d1
push 0x4a2178
push edi
call esi
call fcn.00428860
push eax
push 0x64
push 0x2792e45
push 0x49b4d2
push 0x4a2180
push edi
call esi
mov eax, dword [esp + 0xc]
mov ecx, 0x64
mov esi, 0x2792d18
mov edi, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x428970
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x4af15c]
test eax, eax
je case.0x42898f.55
movzx eax, word [eax + 0x3e]
movzx eax, al
add eax, 0xffffffc9
cmp eax, 0x22
ja case.0x42898f.55
movzx eax, byte [eax + 0x428a6c]
jmp dword [eax*4 + 0x428a60]
mov eax, 0x32
jmp 0x4289a2
mov eax, 0x3c
cmp dword [0x4af438], 0
push esi
mov esi, 0x64
movd xmm1, eax
cmovne esi, dword [0x4af43c]
cvtdq2ps xmm1, xmm1
mov eax, dword [0x24b1aa4]
movd xmm0, esi
movss dword [0x4ade04], xmm1
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movsd xmm1, qword [0x4a6ad8]
divss xmm0, dword [0x4a6ae8]
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [0x246ccf0], xmm1
test eax, eax
je 0x428a19
push dword [eax]
push 0xc8
push 0x4b0ef0
push str.Speed_Limit
push str.Speed_Limit
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x428a2b
push str.Speed_Limit
push 0x4b0ef0
call fcn.0040e260
add esp, 8
push esi
push 0x4b0ef0
push str._s:__d__
push 0x4b0ef0
call fcn.0040e260
add esp, 0x10
push 0x4b0ef0
push 0
push 0x401
push dword [0x4b09c0]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
ret
Function at 0x428a90
Capabilities:
Enumerate files on windows
Read .ini file

Disassembly:
sub esp, 0x674
push ebx
push ebp
push esi
push edi
push 0xc
call fcn.0046b317
add esp, 4
mov dword [0x24b1aa8], eax
mov dword [eax + 8], 0
lea eax, [esp + 0x258]
push 0x4b0de0
push str._slang
push eax
call fcn.0040e260
add esp, 0xc
lea eax, [esp + 0x258]
push eax
lea eax, [esp + 0x364]
push str._s.lng
push eax
call fcn.0040e260
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x428c9f
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, 0x4a21e8
lea eax, [esp + 0x3c]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x428b40
test dl, dl
je 0x428b3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x428b40
add eax, 2
add ecx, 2
test dl, dl
jne 0x428b20
xor eax, eax
jmp 0x428b45
sbb eax, eax
or eax, 1
test eax, eax
je 0x428c88
mov eax, 0x4a21ec
lea ecx, [esp + 0x3c]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x428b76
test dl, dl
je 0x428b72
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x428b76
add ecx, 2
add eax, 2
test dl, dl
jne 0x428b56
xor eax, eax
jmp 0x428b7b
sbb eax, eax
or eax, 1
test eax, eax
je 0x428c88
test byte [esp + 0x10], 0x10
jne 0x428c88
lea eax, [esp + 0x3c]
push eax
push 0x4b0de0
lea eax, [esp + 0x158]
push str._slang_s
push eax
call fcn.0040e260
push 0x320
lea eax, [esp + 0x374]
push 0
push eax
call fcn.004682f0
add esp, 0x1c
lea eax, [esp + 0x150]
push eax
push 0x320
lea eax, [esp + 0x368]
push eax
call ebp
mov esi, dword [0x24b1aa8]
mov eax, dword [esi + 8]
test eax, eax
je 0x428bee
mov esi, eax
mov eax, dword [esi + 8]
test eax, eax
jne 0x428be5
push 0xc
call fcn.0046b317
lea ecx, [esp + 0x154]
mov dword [esi + 8], eax
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x428c05
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0046b317
mov ecx, dword [esi + 8]
add esp, 4
mov dword [ecx], eax
lea ecx, [esp + 0x150]
mov eax, dword [esi + 8]
mov edx, dword [eax]
nop dword [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x428c30
lea ecx, [esp + 0x360]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x428c48
sub ecx, edx
lea eax, [ecx + 7]
push eax
call fcn.0046b317
mov ecx, dword [esi + 8]
add esp, 4
mov dword [ecx + 4], eax
lea ecx, [esp + 0x360]
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x428c70
mov eax, dword [esi + 8]
mov dword [eax + 8], 0
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
jne 0x428b11
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x674
ret

Function at 0x428f60
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x428f7d
push dword [eax]
push 0xc8
push edx
push ecx
push ecx
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret
push ecx
push edx
call fcn.0040e260
add esp, 8
ret
Function at 0x428f90
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x428fb0
push dword [eax]
push 0xc8
push dword [esp + 0xc]
push edx
push ecx
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret
push ecx
push dword [esp + 8]
call fcn.0040e260
add esp, 8
ret

Function at 0x428fc0
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [0x24b1aa4]
lea eax, [esp - 0x320]
sub esp, 0x324
push esi
mov esi, dword [0x4b09c0]
test ecx, ecx
je 0x428ffa
push dword [ecx]
push 0xc8
push eax
mov eax, dword [esp + 0x338]
push eax
push eax
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x42900a
push dword [esp + 0x32c]
push eax
call fcn.0040e260
add esp, 8
xor eax, eax
nop dword [eax]
mov cl, byte [esp + eax + 8]
lea eax, [eax + 1]
mov byte [eax + 0x4b121f], cl
test cl, cl
jne 0x429010
lea eax, [esp + 8]
push eax
push 0
push 0x401
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
add esp, 0x324
ret

Function at 0x429040
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x358
lea eax, [esp + 0x34]
push ebx
push esi
mov esi, dword [0x24b1aa4]
mov ebx, ecx
push edi
mov edi, edx
test esi, esi
je 0x429077
push dword [esi]
push 0xc8
push eax
mov eax, dword [esp + 0x374]
push eax
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
jmp 0x429087
push dword [esp + 0x368]
push eax
call fcn.0040e260
add esp, 8
mov esi, dword [esp + 0x36c]
mov ecx, 0x49b4d3
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4290b5
test dl, dl
je 0x4290b1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4290b5
add eax, 2
add ecx, 2
test dl, dl
jne 0x429095
xor eax, eax
jmp 0x4290ba
sbb eax, eax
or eax, 1
test eax, eax
je 0x4290d2
push esi
lea eax, [esp + 0x44]
push eax
push 0x4a220c
push eax
call fcn.0040e260
add esp, 0x10
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], eax
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movlpd qword [esp + 0x1c], xmm0
push eax
push 1
push edi
push ebx
movlpd qword [esp + 0x34], xmm0
movlpd qword [esp + 0x3c], xmm0
mov dword [esp + 0x20], 0x30
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x28], 0
mov dword [esp + 0x48], 0x320
call dword [sym.imp.USER32.dll_SetMenuItemInfoA]
pop edi
pop esi
pop ebx
add esp, 0x358
ret
Function at 0x42b100
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x24b1aa4]
sub esp, 0x708
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
mov esi, ecx
test eax, eax
je 0x42b139
push dword [eax]
lea ecx, [esp + 0xd4]
push 0xc8
push ecx
push str.Audit_Total_ROMs
push str.Audit_Total_ROMs
push dword [eax + 4]
call ebx
jmp 0x42b14e
lea eax, [esp + 0xd0]
push str.Audit_Total_ROMs
push eax
call fcn.0040e260
add esp, 8
push edi
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea eax, [esp + 0xd4]
push eax
push 0x839
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b18e
push dword [eax]
lea ecx, [esp + 0x3f8]
push 0xc8
push ecx
push str.Audit_Current_ROM
push str.Audit_Current_ROM
push dword [eax + 4]
call ebx
jmp 0x42b1a3
lea eax, [esp + 0x3f4]
push str.Audit_Current_ROM
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0x3f4]
push eax
push 0x83b
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b1dc
push dword [eax]
lea ecx, [esp + 0xd8]
push 0xc8
push ecx
push str.Audit_File_Location
push str.Audit_File_Location
push dword [eax + 4]
call ebx
jmp 0x42b1f1
lea eax, [esp + 0xd4]
push str.Audit_File_Location
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0xd4]
push eax
push 0x7d9
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b22a
push dword [eax]
lea ecx, [esp + 0x3f8]
push 0xc8
push ecx
push 0x4a2a10
push 0x4a2a10
push dword [eax + 4]
call ebx
jmp 0x42b23f
lea eax, [esp + 0x3f4]
push 0x4a2a10
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0x3f4]
push eax
push 0x838
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b278
push dword [eax]
lea ecx, [esp + 0xd8]
push 0xc8
push ecx
push 0x4a2a18
push 0x4a2a18
push dword [eax + 4]
call ebx
jmp 0x42b28d
lea eax, [esp + 0xd4]
push 0x4a2a18
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0xd4]
push eax
push 0x836
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b2c6
push dword [eax]
lea ecx, [esp + 0x3f8]
push 0xc8
push ecx
push 0x4a2a20
push 0x4a2a20
push dword [eax + 4]
call ebx
jmp 0x42b2db
lea eax, [esp + 0x3f4]
push 0x4a2a20
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0x3f4]
push eax
push 0x837
push esi
call edi
mov eax, dword [0x24b1aa4]
pop edi
test eax, eax
je 0x42b325
push dword [eax]
lea ecx, [esp + 0xc]
push 0xc8
push ecx
push 0x4a2a28
push 0x4a2a34
push dword [eax + 4]
call ebx
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
pop ebx
add esp, 0x708
ret
lea eax, [esp + 8]
push 0x4a2a34
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
pop ebx
add esp, 0x708
ret
Function at 0x42b350
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x24b1aa4]
sub esp, 0x708
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
mov esi, ecx
test eax, eax
je 0x42b389
push dword [eax]
lea ecx, [esp + 0xd4]
push 0xc8
push ecx
push str.Translation_Author_TEXT
push str.Translation_Author_TEXT
push dword [eax + 4]
call ebx
jmp 0x42b39e
lea eax, [esp + 0xd0]
push str.Translation_Author_TEXT
push eax
call fcn.0040e260
add esp, 8
push edi
mov edi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea eax, [esp + 0xd4]
push eax
push 0x1b6e
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b3de
push dword [eax]
lea ecx, [esp + 0x3f8]
push 0xc8
push ecx
push str.Version_TEXT
push str.Version_TEXT
push dword [eax + 4]
call ebx
jmp 0x42b3f3
lea eax, [esp + 0x3f4]
push str.Version_TEXT
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0x3f4]
push eax
push 0x1b6f
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b42c
push dword [eax]
lea ecx, [esp + 0xd8]
push 0xc8
push ecx
push str.Creation_Date_TEXT
push str.Creation_Date_TEXT
push dword [eax + 4]
call ebx
jmp 0x42b441
lea eax, [esp + 0xd4]
push str.Creation_Date_TEXT
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0xd4]
push eax
push 0x1b70
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b47a
push dword [eax]
lea ecx, [esp + 0x3f8]
push 0xc8
push ecx
push str.Translation_Author
push str.Translation_Author
push dword [eax + 4]
call ebx
jmp 0x42b48f
lea eax, [esp + 0x3f4]
push str.Translation_Author
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0x3f4]
push eax
push 0x1b6b
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b4c8
push dword [eax]
lea ecx, [esp + 0xd8]
push 0xc8
push ecx
push str.Version
push str.Version
push dword [eax + 4]
call ebx
jmp 0x42b4dd
lea eax, [esp + 0xd4]
push str.Version
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0xd4]
push eax
push 0x1b6c
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b516
push dword [eax]
lea ecx, [esp + 0x3f8]
push 0xc8
push ecx
push str.Creation_Date
push str.Creation_Date
push dword [eax + 4]
call ebx
jmp 0x42b52b
lea eax, [esp + 0x3f4]
push str.Creation_Date
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0x3f4]
push eax
push 0x1b6d
push esi
call edi
mov eax, dword [0x24b1aa4]
test eax, eax
je 0x42b564
push dword [eax]
lea ecx, [esp + 0xd8]
push 0xc8
push ecx
push 0x4a2aa8
push 0x4a2aa8
push dword [eax + 4]
call ebx
jmp 0x42b579
lea eax, [esp + 0xd4]
push 0x4a2aa8
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 0xd4]
push eax
push 1
push esi
call edi
mov eax, dword [0x24b1aa4]
pop edi
test eax, eax
je 0x42b5c0
push dword [eax]
lea ecx, [esp + 0xc]
push 0xc8
push ecx
push 0x4a2aac
push str.Language_Information_Dialog
push dword [eax + 4]
call ebx
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
pop ebx
add esp, 0x708
ret
lea eax, [esp + 8]
push str.Language_Information_Dialog
push eax
call fcn.0040e260
add esp, 8
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop esi
pop ebx
add esp, 0x708
ret
Function at 0x42bb90
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push ecx
mov eax, dword [0xcbb7b4]
push ebx
push ebp
add eax, 0xf8000000
push esi
push edi
cmp eax, 0xffff
ja 0x42bd40
cmp dword [0x4b9670], 1
je 0x42bd0d
call fcn.00419740
mov edx, eax
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x42bbc1
mov ecx, 0x4af160
sub edx, eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42bbd2
sub ecx, esi
lea eax, [edx + 5]
add eax, ecx
push eax
call fcn.0046b317
add esp, 4
mov ebp, eax
call fcn.00419740
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x42bbf4
mov edx, 0x4af160
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x42bc08
sub edx, esi
lea edi, [ebp - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42bc14
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x42bc30
mov eax, dword [0x4a2c1c]
mov dword [ecx], eax
mov al, byte [0x4a2c20]
push 0x4a2c24
push ebp
mov byte [ecx + 4], al
call fcn.0046b3d9
mov esi, eax
add esp, 8
test esi, esi
je 0x42bc7a
push esi
push 0x8000
push 1
push 0x4b1670
call fcn.004748bb
push esi
call fcn.0046b467
add esp, 0x14
jmp 0x42bc8e
push 0x8000
push 0
push 0x4b1670
call fcn.004682f0
add esp, 0xc
mov esi, dword [0xcbb7b8]
mov edx, 0
and esi, 0xffffff
add esi, 1
je 0x42bcd3
mov edi, dword [0xcbb7b4]
mov ebx, dword [0xcbb7b0]
add edi, 0xf8000000
lea eax, [ebx + edx]
xor eax, 3
lea ecx, [edi + edx]
xor ecx, 3
inc edx
mov al, byte [eax + 0x4bb7b0]
mov byte [ecx + 0x4b1670], al
cmp edx, esi
jb 0x42bcb6
push 0x4a2c28
push ebp
call fcn.0046b3d9
mov esi, eax
push esi
push 0x8000
push 1
push 0x4b1670
call fcn.00474e4d
push esi
call fcn.0046b467
add esp, 0x1c
push ebp
call fcn.0046b2fc
mov dword [0x4b9670], 0xffffffff
jmp 0x42bd4a
mov ecx, dword [0x24d1abc]
mov eax, ecx
sub eax, 2
je 0x42bd34
push ecx
push str.unknown_dma_read_flashram:_x_n
call fcn.0040e1d0
add esp, 8
mov dword [0x17dc9c0], 1
jmp 0x42bd4d
mov eax, dword [0xcbb7b0]
mov dword [0x24d1ab8], eax
jmp 0x42bd4d
push str.unknown_dma_read_n
call fcn.0040e1d0
add esp, 4
or dword [0xcbb7c0], 1
cmp dword [0x16dc99c], 0
je 0x42bd7b
mov ecx, dword [0x16dc070]
mov eax, ecx
sub eax, dword [0x16dc9a0]
shr eax, 1
add dword [0x16dc1b4], eax
mov dword [0x16dc9a0], ecx
jmp 0x42bdba
mov ecx, dword [0x16dc184]
mov edx, dword [0x16dc9a0]
cmp dword [ecx + 0x14], edx
jae 0x42bda5
push str.PC__addr___last_addr_n
call fcn.0040e1d0
mov edx, dword [0x16dc9a0]
add esp, 4
mov ecx, dword [0x16dc184]
mov eax, dword [ecx + 0x14]
sub eax, edx
shr eax, 1
add dword [0x16dc1b4], eax
mov eax, dword [ecx + 0x14]
mov dword [0x16dc9a0], eax
mov edx, 0x1000
mov ecx, 0x10
call fcn.00438260
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x433b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x110
push esi
mov dword [esp + 4], 0x3020181
mov edx, 0xebc060
mov dword [esp + 8], 0x7060504
mov dword [esp + 0xc], 0xb0a0908
mov dword [esp + 0x10], 0xf0e0d0c
mov dword [esp + 0x14], 0x13121110
mov dword [esp + 0x18], 0x17161514
mov dword [esp + 0x1c], 0x1b1a1918
mov dword [esp + 0x20], 0x1f1e1d1c
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0x135f1a05
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x3c], 0xff01ffff
mov dword [esp + 0x40], 0xcd992566
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x68], 0x135f1a05
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0xffffffff
mov dword [esp + 0x78], 0xffffffff
mov dword [esp + 0x7c], 0xff01ffff
mov dword [esp + 0x80], 0xcd992566
mov dword [esp + 0x84], 0xffffffff
mov dword [esp + 0x88], 0x135f1a05
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0xffffffff
mov dword [esp + 0x98], 0xffffffff
mov dword [esp + 0x9c], 0xff01ffff
mov dword [esp + 0xa0], 0xcd992566
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 0xffffffff
mov dword [esp + 0xc8], 0x135f1a05
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 0xffffffff
mov dword [esp + 0xd8], 0xffffffff
mov dword [esp + 0xdc], 0xff01ffff
mov dword [esp + 0xe0], 0xcd992566
mov dword [esp + 0xe4], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf8], 0
mov dword [esp + 0xfc], 0
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0x3007100
mov dword [esp + 0x108], 0x3000300
mov dword [esp + 0x10c], 0x3000300
mov dword [esp + 0x110], 0x3000300
push edi
nop dword [eax]
lea eax, [edx + 1]
mov ecx, 0x4000
nop dword [eax + eax]
mov word [eax - 1], 0x300
lea eax, [eax + 2]
sub ecx, 1
jne 0x433df0
mov edi, edx
lea esi, [esp + 8]
add edx, 0x8000
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
cmp edx, 0xedc060
jl 0x433de0
pop edi
pop esi
add esp, 0x110
ret
Function at 0x458640
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48aa90
push eax
mov dword fs:[0], esp
cmp dword [0x4b0ee8], 0
push edi
mov edi, dword [0x4b0dc8]
je 0x4586b4
push str.Resume_emulation
call fcn.00419590
add esp, 4
mov dword [0x4b0dc8], 0
push dword [0x24b17c0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x4a0f70
call fcn.00428fc0
add esp, 4
push 0
push 0x426
push 0x402
push dword [0x4b1654]
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
jmp 0x4586b6
push 0
push 0x428
push 0x402
push dword [0x4b1654]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x4b0dc8]
cmp eax, edi
je 0x4586f5
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x426
push dword [0x4b09c4]
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push str.Emulation_Unlock
call fcn.00419590
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x45fec0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov eax, edx
mov ebp, ecx
push esi
push edi
mov ecx, eax
mov dword [esp + 0x14], eax
call fcn.0040c580
mov esi, eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x18]
mov edi, dword [esi*4 + 0x49cab8]
mov ebx, dword [edi*4 + 0x49cdf0]
mov ecx, dword [ebx*4 + 0x49ce50]
call ecx
mov eax, dword [0x4add98]
add esp, 8
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], ebx
mov dword [eax], ebp
mov eax, dword [0x4add98]
add eax, 4
mov dword [0x4add98], eax
mov dword [eax], ecx
mov edx, dword [0x4add98]
mov eax, dword [esp + 0x1c]
add edx, 4
mov dword [0x4add98], edx
cmp eax, 0x17
ja case.default.0x45ff3d
jmp dword [eax*4 + 0x4600d0]
mov dword [edx], 0
jmp 0x460075
movzx eax, byte [esp + 0x24]
mov eax, dword [eax*8 + 0x16dc080]
jmp 0x460073
movzx eax, byte [esp + 0x24]
mov eax, dword [eax*8 + 0x16dc080]
mov dword [edx], eax
mov ecx, dword [0x4add98]
movzx eax, byte [esp + 0x25]
add ecx, 4
mov dword [0x4add98], ecx
mov eax, dword [eax*8 + 0x16dc080]
mov dword [ecx], eax
jmp 0x460088
movzx eax, byte [esp + 0x24]
movsx ecx, word [esp + 0x26]
add ecx, dword [eax*8 + 0x16dc080]
mov dword [edx], ecx
mov ecx, dword [0x4add98]
movzx eax, byte [esp + 0x25]
add ecx, 4
mov dword [0x4add98], ecx
mov eax, dword [eax*8 + 0x16dc080]
mov dword [ecx], eax
jmp 0x460088
movzx eax, byte [esp + 0x24]
movsx ecx, word [esp + 0x26]
add ecx, dword [eax*8 + 0x16dc080]
mov dword [edx], ecx
jmp 0x460075
movzx eax, byte [esp + 0x24]
movsx ecx, word [esp + 0x26]
add ecx, dword [eax*8 + 0x16dc080]
mov dword [edx], ecx
movzx eax, byte [esp + 0x25]
mov ecx, dword [0x4add98]
add ecx, 4
mov dword [0x4add98], ecx
mov eax, dword [eax*4 + 0x1bdc9e0]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x460088
movzx eax, byte [esp + 0x26]
mov eax, dword [eax*8 + 0x16dc080]
jmp 0x460073
movzx eax, byte [esp + 0x25]
mov eax, dword [eax*8 + 0x16dc080]
jmp 0x460073
movzx eax, byte [esp + 0x25]
jmp 0x46006a
movzx eax, byte [esp + 0x25]
mov eax, dword [eax*4 + 0x1bdc9e0]
mov eax, dword [eax]
mov dword [edx], eax
movzx eax, byte [esp + 0x24]
mov ecx, dword [0x4add98]
add ecx, 4
mov dword [0x4add98], ecx
mov eax, dword [eax*4 + 0x1bdc9e0]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x460088
movzx eax, byte [esp + 0x24]
mov eax, dword [eax*4 + 0x1bdc9e0]
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [0x4add98]
add eax, 4
mov dword [0x4add98], eax
mov dword [eax], 0
mov edx, dword [0x4add98]
add edx, 4
mov dword [0x4add98], edx
cmp edx, 0x1becaa0
jb 0x4600c8
push 0
lea eax, [esp + 0x18]
sub edx, 0x1bdcca0
push eax
push edx
push 0x1bdcca0
push dword [0x1bdcc78]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [0x4add98], 0x1bdcca0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret