joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499e00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movdqa xmm0, xmmword [eax]
lea edx, [esi - 1]
pxor xmm0, xmmword [edi]
movdqa xmmword [eax], xmm0
cmp edx, 1
jbe 0x499e4e
add edx, 0xfffffffe
lea ecx, [edi + 0x10]
shr edx, 1
inc edx
mov edi, edi
movdqa xmm0, xmmword [eax]
lea ecx, [ecx + 0x20]
aesenc xmm0, xmmword [ecx - 0x20]
movdqa xmmword [eax], xmm0
aesenc xmm0, xmmword [ecx - 0x10]
movdqa xmmword [eax], xmm0
dec edx
jne 0x499e30
movdqa xmm0, xmmword [eax]
add esi, esi
aesenc xmm0, xmmword [edi + esi*8 - 0x10]
movdqa xmmword [eax], xmm0
aesenclast xmm0, xmmword [edi + esi*8]
pop edi
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x499e70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
sub esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movdqa xmm1, xmmword [eax]
movdqa xmm0, xmmword [ecx]
mov eax, dword [ebp + 0x14]
pxor xmm0, xmm1
movdqa xmmword [ecx], xmm0
movdqa xmm0, xmmword [edx]
push esi
mov esi, dword [ebp + 0x10]
pxor xmm0, xmm1
movdqa xmmword [edx], xmm0
push edi
mov edi, dword [ebp + 0x1c]
movdqa xmm0, xmmword [esi]
pxor xmm0, xmm1
movdqa xmmword [esi], xmm0
movdqa xmm0, xmmword [eax]
pxor xmm0, xmm1
movdqa xmmword [eax], xmm0
cmp edi, 1
jbe 0x499f25
mov edi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
add edi, 0x10
dec ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
jmp 0x499ee0
dec dword [esp + 0xc]
lea edi, [edi + 0x10]
movdqa xmm1, xmmword [edi - 0x10]
movdqa xmm0, xmmword [ecx]
aesenc xmm0, xmm1
movdqa xmmword [ecx], xmm0
movdqa xmm0, xmmword [edx]
aesenc xmm0, xmm1
movdqa xmmword [edx], xmm0
movdqa xmm0, xmmword [esi]
aesenc xmm0, xmm1
movdqa xmmword [esi], xmm0
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
jne 0x499ee0
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
add edi, edi
movdqa xmm0, xmmword [ecx]
movdqa xmm1, xmmword [eax + edi*8]
mov eax, dword [ebp + 0x14]
aesenclast xmm0, xmm1
movdqa xmmword [ecx], xmm0
movdqa xmm0, xmmword [edx]
aesenclast xmm0, xmm1
movdqa xmmword [edx], xmm0
movdqa xmm0, xmmword [esi]
aesenclast xmm0, xmm1
movdqa xmmword [esi], xmm0
movdqa xmm0, xmmword [eax]
aesenclast xmm0, xmm1
pop edi
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49bc50
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x6ac158
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x759990]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, ecx
test ebx, ebx
je 0x49bc82
lea eax, [ebx + 4]
jmp 0x49bc84
xor eax, eax
push eax
push dword [esp + 0x48]
call fcn.0049bf40
mov dword [ebx + 0x10], eax
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
lea esi, [eax*2 + 4]
cmp ecx, esi
je 0x49bcd1
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
call fcn.00626c65
push esi
call fcn.00467630
add esp, 8
test esi, esi
jne 0x49bcbf
xor edx, edx
jmp 0x49bcd1
lea eax, [esi*4]
push eax
call fcn.00460b40
add esp, 4
mov edx, eax
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x44]
add ecx, 3
mov dword [ebx + 0x1c], edx
shr ecx, 2
lea edx, [esp + 0x14]
cmp ecx, 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x44], 1
cmovae eax, edx
mov dword [ebx + 0x18], esi
mov ebp, dword [eax]
push ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
call fcn.00467630
add esp, 4
test ebp, ebp
jne 0x49bd1a
xor edi, edi
mov dword [esp + 0x14], edi
jmp 0x49bd30
lea eax, [ebp*4]
push eax
call fcn.00460b40
add esp, 4
mov dword [esp + 0x14], eax
mov edi, eax
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x40]
lea esi, [ebp*4]
push eax
push dword [esp + 0x40]
mov dword [esp + 0x3c], 0
push esi
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x54], 4
call fcn.00624dd6
mov eax, dword [esp + 0x50]
sub esi, eax
push esi
add eax, edi
push 0
push eax
call fcn.00620a70
add esp, 0x1c
lea edx, [esp + 0x44]
lea ecx, [esp + 0x18]
call fcn.0046c5a0
mov eax, dword [ebx + 0x1c]
mov edx, 1
mov dword [eax], 0xb7e15163
cmp dword [ebx + 0x18], edx
jbe 0x49bda9
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
inc edx
mov eax, dword [ecx - 4]
sub eax, 0x61c88647
mov dword [ecx], eax
cmp edx, dword [ebx + 0x18]
jb 0x49bd93
mov eax, dword [ebx + 0x18]
lea ecx, [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x44], eax
cmp eax, ebp
mov dword [esp + 0x40], 0
lea edx, [esp + 0x44]
cmovae ecx, edx
mov eax, dword [ecx]
lea ecx, [eax + eax*2]
xor eax, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], eax
test ecx, ecx
je 0x49be25
lea ebx, [ebx]
xor edx, edx
div dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
xor edx, edx
mov eax, dword [ecx]
add eax, esi
add eax, dword [esp + 0x40]
rol eax, 3
mov dword [ecx], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
div ebp
lea eax, [edi + edx*4]
mov edx, dword [esp + 0x40]
lea ecx, [esi + edx]
add esi, edx
add esi, dword [eax]
rol esi, cl
mov dword [eax], esi
mov eax, dword [esp + 0x44]
inc eax
mov dword [esp + 0x44], eax
cmp eax, dword [esp + 0x3c]
jb 0x49bde0
push dword [esp + 0x14]
xor eax, eax
mov ecx, ebp
rep stosd dword es:[edi], eax
call fcn.00626c65
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x49be50
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x18]
push ebp
mov edx, dword [eax]
mov ebp, dword [eax + 8]
push esi
mov esi, dword [ebx]
add esi, dword [eax + 4]
push edi
mov edi, dword [ebx + 4]
add ebx, 8
add edi, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
test eax, eax
je 0x49bec0
mov edi, edi
lea ecx, [esi*2 + 1]
imul ecx, esi
lea edx, [edi*2 + 1]
imul edx, edi
rol ecx, 5
mov eax, ecx
rol edx, 5
xor eax, dword [esp + 0x18]
mov dword [esp + 0x18], esi
mov esi, edx
xor esi, ebp
mov ebp, edi
rol esi, cl
mov edi, eax
add esi, dword [ebx + 4]
mov ecx, edx
rol edi, cl
add edi, dword [ebx]
add ebx, 8
dec dword [esp + 0x10]
jne 0x49be80
mov edx, dword [ebx]
add ebp, dword [ebx + 4]
mov eax, dword [esp + 0x1c]
add edx, dword [esp + 0x18]
test eax, eax
je 0x49bed5
mov ecx, dword [eax]
jmp 0x49bed7
xor ecx, ecx
xor ecx, edx
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
test eax, eax
je 0x49beee
add eax, 4
test eax, eax
je 0x49beee
mov ecx, dword [eax]
jmp 0x49bef0
xor ecx, ecx
xor ecx, esi
mov dword [edx + 4], ecx
test eax, eax
je 0x49bf04
add eax, 4
test eax, eax
je 0x49bf04
mov ecx, dword [eax]
jmp 0x49bf06
xor ecx, ecx
xor ecx, ebp
mov dword [edx + 8], ecx
test eax, eax
je 0x49bf25
add eax, 4
test eax, eax
je 0x49bf25
mov eax, dword [eax]
xor eax, edi
pop edi
pop esi
pop ebp
mov dword [edx + 0xc], eax
pop ebx
pop ecx
ret 0xc
xor eax, eax
xor eax, edi
pop edi
pop esi
pop ebp
mov dword [edx + 0xc], eax
pop ebx
pop ecx
ret 0xc
Function at 0x49f300
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x6ac158
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x759990]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, ecx
test ebx, ebx
je 0x49f332
lea eax, [ebx + 4]
jmp 0x49f334
xor eax, eax
push eax
push dword [esp + 0x48]
call fcn.0049f580
mov dword [ebx + 0x10], eax
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
lea esi, [eax*2 + 2]
cmp ecx, esi
je 0x49f381
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
call fcn.00626c65
push esi
call fcn.00467630
add esp, 8
test esi, esi
jne 0x49f36f
xor edx, edx
jmp 0x49f381
lea eax, [esi*4]
push eax
call fcn.00460b40
add esp, 4
mov edx, eax
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x44]
add ecx, 3
mov dword [ebx + 0x1c], edx
shr ecx, 2
lea edx, [esp + 0x14]
cmp ecx, 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x44], 1
cmovae eax, edx
mov dword [ebx + 0x18], esi
mov ebp, dword [eax]
push ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
call fcn.00467630
add esp, 4
test ebp, ebp
jne 0x49f3ca
xor edi, edi
mov dword [esp + 0x14], edi
jmp 0x49f3e0
lea eax, [ebp*4]
push eax
call fcn.00460b40
add esp, 4
mov dword [esp + 0x14], eax
mov edi, eax
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x40]
lea esi, [ebp*4]
push eax
push dword [esp + 0x40]
mov dword [esp + 0x3c], 0
push esi
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x54], 4
call fcn.00624dd6
mov eax, dword [esp + 0x50]
sub esi, eax
push esi
add eax, edi
push 0
push eax
call fcn.00620a70
add esp, 0x1c
lea edx, [esp + 0x44]
lea ecx, [esp + 0x18]
call fcn.0046c5a0
mov eax, dword [ebx + 0x1c]
mov edx, 1
mov dword [eax], 0xb7e15163
cmp dword [ebx + 0x18], edx
jbe 0x49f459
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
inc edx
mov eax, dword [ecx - 4]
sub eax, 0x61c88647
mov dword [ecx], eax
cmp edx, dword [ebx + 0x18]
jb 0x49f443
mov eax, dword [ebx + 0x18]
lea ecx, [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x44], eax
cmp eax, ebp
mov dword [esp + 0x40], 0
lea edx, [esp + 0x44]
cmovae ecx, edx
mov eax, dword [ecx]
lea ecx, [eax + eax*2]
xor eax, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], eax
test ecx, ecx
je 0x49f4d5
lea ebx, [ebx]
xor edx, edx
div dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
xor edx, edx
mov eax, dword [ecx]
add eax, esi
add eax, dword [esp + 0x40]
rol eax, 3
mov dword [ecx], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
div ebp
lea eax, [edi + edx*4]
mov edx, dword [esp + 0x40]
lea ecx, [esi + edx]
add esi, edx
add esi, dword [eax]
rol esi, cl
mov dword [eax], esi
mov eax, dword [esp + 0x44]
inc eax
mov dword [esp + 0x44], eax
cmp eax, dword [esp + 0x3c]
jb 0x49f490
push dword [esp + 0x14]
xor eax, eax
mov ecx, ebp
rep stosd dword es:[edi], eax
call fcn.00626c65
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x49f500
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [ecx + 0x18]
push ebp
mov edx, dword [eax + 4]
mov ebp, dword [ecx + 0xc]
push esi
mov esi, dword [ebx]
add esi, dword [eax]
mov eax, dword [ebx + 4]
push edi
add eax, edx
xor edi, edi
test ebp, ebp
je 0x49f539
xor esi, eax
mov ecx, eax
rol esi, cl
add esi, dword [ebx + edi*8 + 8]
xor eax, esi
mov ecx, esi
rol eax, cl
add eax, dword [ebx + edi*8 + 0xc]
inc edi
cmp edi, ebp
jb 0x49f520
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x49f545
mov edx, dword [ecx]
jmp 0x49f547
xor edx, edx
xor edx, esi
mov esi, dword [esp + 0x1c]
mov dword [esi], edx
test ecx, ecx
je 0x49f568
add ecx, 4
test ecx, ecx
je 0x49f568
mov ecx, dword [ecx]
pop edi
xor ecx, eax
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
ret 0xc
xor ecx, ecx
pop edi
xor ecx, eax
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x49fb60
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx + 0x118]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [ecx + 0x11c]
push edi
push ebx
push dword [esp + 0x1c]
lea edi, [eax*4]
mov dword [esp + 0x18], ebx
push edi
push esi
mov dword [esp + 0x2c], 4
call fcn.00624dd6
sub edi, ebx
lea eax, [esi + ebx]
push edi
push 0
push eax
call fcn.00620a70
lea edx, [esp + 0x38]
lea ecx, [esp + 0x2c]
call fcn.0046c5a0
push eax
mov edx, esi
mov ecx, esi
call fcn.0046ecf0
add esp, 0x20
mov dword [esp + 0x1c], 0
mov ecx, dword [esi + 4]
mov edx, ecx
mov edi, dword [esi + 0x38]
mov eax, ecx
ror edx, 0x12
shr ecx, 3
ror eax, 7
xor edx, eax
mov eax, edi
xor edx, ecx
ror eax, 0x11
mov ecx, edi
shr edi, 0xa
ror ecx, 0x13
xor ecx, eax
xor ecx, edi
add edx, ecx
mov ecx, dword [esp + 0x1c]
add edx, dword [esi + 0x24]
add edx, dword [esi]
mov dword [esi + 0x40], edx
mov eax, dword [ecx + 0x714a30]
add ecx, 4
add dword [esi], eax
add esi, 4
mov dword [esp + 0x1c], ecx
cmp ecx, 0xc0
jb 0x49fbc4
mov ecx, 0xc8
lea esp, [esp]
mov eax, dword [ecx + 0x714a28]
lea esi, [esi + 0x10]
add dword [esi - 0x10], eax
mov eax, dword [ecx + 0x714a2c]
add dword [esi - 0xc], eax
mov eax, dword [ecx + 0x714a30]
add dword [esi - 8], eax
mov eax, dword [ecx + 0x714a34]
add ecx, 0x10
add dword [esi - 4], eax
cmp ecx, 0x108
jb 0x49fc20
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4af070
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jbe 0x4af08e
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.004b0450
add esp, 8
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [ebp + ecx - 0x14], edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp + eax - 0x14], ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jae 0x4af0eb
imul edx, dword [ebp - 8], 0x1000193
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x4af0c2
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x534960
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x759990]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
call fcn.004ccac0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.005348b0
push 0x6cc728
mov ecx, dword [ebp + 8]
push ecx
call fcn.00624b34
add esp, 8
mov dword [ebp - 0x2c], eax
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cvtss2sd xmm0, dword [ebp - 0x20]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x24]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x28]
sub esp, 8
movsd qword [esp], xmm0
push str.CenterPos__f__f__f_n
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00597960
add esp, 0x24
cvtss2sd xmm0, dword [ebp - 0x10]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0xc]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 8]
sub esp, 8
movsd qword [esp], xmm0
push str.CameraSetting__f__f__f_n
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00597960
add esp, 0x24
cvtss2sd xmm0, dword [ebp - 0x14]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x18]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x1c]
sub esp, 8
movsd qword [esp], xmm0
push str.CmrPos__f__f__f_n
push 0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00597960
add esp, 0x24
cvttss2si eax, dword [ebp - 0x14]
push eax
cvttss2si ecx, dword [ebp - 0x18]
push ecx
cvttss2si edx, dword [ebp - 0x1c]
push edx
cvttss2si eax, dword [ebp - 0x10]
push eax
cvttss2si ecx, dword [ebp - 0xc]
push ecx
cvttss2si edx, dword [ebp - 8]
push edx
cvttss2si eax, dword [ebp - 0x20]
push eax
cvttss2si ecx, dword [ebp - 0x24]
push ecx
cvttss2si edx, dword [ebp - 0x28]
push edx
push str.Line__x__dy__dz__ddistance__dpitch__drot__dup__dview__dcross__d__n
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00597960
add esp, 0x30
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.006249f9
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00622d3e
mov esp, ebp
pop ebp
ret 4

Function at 0x53ae50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x53d4c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x6cdf98
push 0x6cdf9c
call fcn.00624b34
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x53d4e8
xor al, al
jmp 0x53d513
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x2630
push ecx
call fcn.00625f15
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.006249f9
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x53d520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x262c], 0
jne 0x53d537
jmp 0x53d5b0
push 0x6cdfac
call dword [sym.imp.python27.dll_Py_BuildValue]
add esp, 4
push eax
push str.OnSaveInterfaceStatus
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x262c]
push edx
call fcn.00618660
add esp, 0xc
push 0x6cdfc8
push str.interface.cfg
call fcn.00624b34
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x53d587
push str.Cannot_open_interface.cfg
call fcn.0057e760
add esp, 4
jmp 0x53d5b0
mov eax, dword [ebp - 8]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x2630
push ecx
call fcn.00626b52
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.006249f9
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x53fe70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x759990]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x34]
push eax
push 3
mov ecx, dword [ebp - 0x2c]
call fcn.0059cff0
movzx ecx, al
test ecx, ecx
jne 0x53fea0
mov al, 1
jmp 0x53ffd9
movzx esi, word [ebp - 0x33]
mov ecx, dword [ebp - 0x2c]
call fcn.0059cf40
cmp esi, eax
jle 0x53feb7
mov al, 1
jmp 0x53ffd9
lea edx, [ebp - 0x50]
push edx
push 7
mov ecx, dword [ebp - 0x2c]
call fcn.0059d1d0
movzx eax, al
test eax, eax
jne 0x53fed3
xor al, al
jmp 0x53ffd9
movzx ecx, word [ebp - 0x4f]
sub ecx, 7
mov word [ebp - 0x20], cx
mov edx, dword [ebp - 0x4d]
mov dword [ebp - 0x40], edx
movzx eax, word [ebp - 0x20]
push eax
call fcn.0061f7ab
add esp, 4
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
movzx eax, word [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.0059d1d0
movzx ecx, al
test ecx, ecx
jne 0x53ff2b
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
push eax
call fcn.005701b0
add esp, 4
xor al, al
jmp 0x53ffd9
mov ecx, 0x772824
call fcn.00460200
push eax
call fcn.0057eec0
add esp, 4
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.00569210
add esp, 4
push eax
lea ecx, [ebp - 0x1c]
call fcn.0045fe90
push 0x6ce4d4
lea ecx, [ebp - 0x1c]
call fcn.00460200
push eax
call fcn.00624b34
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x53ff95
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.005701b0
add esp, 4
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x1c]
call fcn.00460780
mov al, byte [ebp - 0x21]
jmp 0x53ffd9
mov ecx, dword [ebp - 0x30]
push ecx
push 1
movzx edx, word [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.00626b52
add esp, 0x10
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.006249f9
add esp, 4
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
call fcn.005701b0
add esp, 4
mov byte [ebp - 0x22], 1
lea ecx, [ebp - 0x1c]
call fcn.00460780
mov al, byte [ebp - 0x22]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00622d3e
mov esp, ebp
pop ebp
ret
Function at 0x540c90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
lea eax, [ebp - 0xc]
push eax
push 1
call dword [sym.imp.DevIL.dll_ilGenImages]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.DevIL.dll_ilBindImage]
push 0x600
call dword [sym.imp.DevIL.dll_ilEnable]
push 0x602
call dword [sym.imp.DevIL.dll_ilOriginFunc]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.DevIL.dll_ilLoad]
movzx eax, al
test eax, eax
jne 0x540ce8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 2
xor al, al
jmp 0x540dfa
push 0xde4
call dword [sym.imp.DevIL.dll_ilGetInteger]
cmp eax, 0x40
je 0x540d08
mov edx, dword [ebp + 0xc]
mov dword [edx], 3
xor al, al
jmp 0x540dfa
push 0xde5
call dword [sym.imp.DevIL.dll_ilGetInteger]
cmp eax, 0x80
je 0x540d2a
mov eax, dword [ebp + 0xc]
mov dword [eax], 4
xor al, al
jmp 0x540dfa
lea ecx, [ebp - 0xc]
push ecx
push 1
call dword [sym.imp.DevIL.dll_ilDeleteImages]
call dword [sym.imp.DevIL.dll_ilShutDown]
push 0x6ce508
mov edx, dword [ebp + 8]
push edx
call fcn.00624b34
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x540d5f
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00626050
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.00626463
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x380], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.00626050
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x380]
push ecx
call fcn.0061f7ab
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x388], eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x380]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x388]
push edx
call fcn.00625f15
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.006249f9
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.005839a0
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 0x384], eax
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x542ac0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b17ff
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x759990]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00545ae0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CGuildMarkManager.0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004ab980
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004ab980
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004ba930
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.0045fb20
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00523800
mov byte [ebp - 4], 5
push str._mnd_mark
call fcn.006a77a8
add esp, 4
mov dword [ebp - 0x14], 0
jmp 0x542b6a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x1900
jae 0x542b88
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004b29c0
jmp 0x542b61
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret