joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408020
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 0x3a
push 0x8ee50c
call fcn.0044f470
mov esi, dword [esp + 0x128]
mov edi, dword [esp + 0x124]
mov ebx, dword [esp + 0x120]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 8
test eax, eax
je 0x408066
push 0x8ee50c
push esi
push edi
push ebx
call ebp
cmp eax, esi
jne 0x4080a1
mov al, byte [0xd0a188]
test al, al
je 0x40809f
push 0xd0a188
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push 0x8ee50c
push ecx
call fcn.00414c70
add esp, 8
lea edx, [esp + 0x10]
push edx
push esi
push edi
push ebx
call ebp
cmp eax, esi
jne 0x4080a1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x4080b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 0x3a
push 0x8ee50c
call fcn.0044f470
mov edi, dword [esp + 0x12c]
mov esi, dword [esp + 0x128]
mov ebx, dword [esp + 0x124]
mov ebp, dword [esp + 0x120]
add esp, 8
test eax, eax
je 0x408101
push 0x8ee50c
push edi
push esi
push 0x4eb920
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x408149
mov al, byte [0xd0a188]
test al, al
je 0x408144
push 0xd0a188
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push 0x8ee50c
push ecx
call fcn.00414c70
add esp, 8
lea edx, [esp + 0x10]
push edx
push edi
push esi
push 0x4eb920
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x408149
mov byte [esi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x4092c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x244
push ebx
push ebp
mov ebp, dword [esp + 0x250]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov bl, 0x41
movsx esi, bl
push esi
lea eax, [esp + 0x14]
push str._c:_
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x409325
push ebp
push esi
lea edx, [esp + 0x18]
push str._c:_s
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x409339
inc bl
cmp bl, 0x5a
jle 0x4092d9
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x244
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x244
ret
Function at 0x409350
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
push edi
push 0x8c8c68
call fcn.00415740
mov al, byte [0xd09e80]
xor ebx, ebx
add esp, 4
cmp al, bl
je 0x4093ed
push 0xd09e80
lea eax, [esp + 0x18]
push 0x4ba470
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x20]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4093ed
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0xd09f80
lea ecx, [esp + 0x18]
push ecx
push ebx
push str.InstPath
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4093e2
mov eax, dword [esp + 8]
push eax
jmp 0x4093e7
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4eb920
push 0xd09f80
call fcn.00414c70
add esp, 8
push 0xd0a084
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x4eb920
push 0xd0a084
call fcn.00414c70
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 8
push str.autoexec.scn
push 0xd0a28c
call edi
push 0xd0a28c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
js 0x409453
cmp byte [eax + 0xd0a28c], 0x5c
mov byte [eax + 0xd0a28c], bl
je 0x409453
dec eax
jns 0x409441
cmp byte [0xd0a28c], bl
je 0x40946d
push 0x4eb920
push 0xd0a28c
call fcn.00414c70
add esp, 8
push 0x104
push 0xd0a398
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, dword [0xd09e7c]
push edx
call fcn.00474cd0
add esp, 4
test eax, eax
jne 0x409499
pop edi
pop ebx
add esp, 0x110
ret
push esi
push 0x4eb920
push 0xd0a398
call fcn.00414c70
add esp, 8
push 0xd0a49c
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x4eb920
push 0xd0a49c
call fcn.00414c70
push 0x4eb920
push 0xd0a5a0
call fcn.00414c70
add esp, 0x10
push str.20011002
push 0x4d48cf
call edi
push 0x5c
push 0x8ee50c
call fcn.0044f430
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40953b
mov eax, dword [0xd0a7a8]
mov ecx, eax
shl ecx, 6
add ecx, eax
push 0x8ee50c
lea edx, [ecx*4 + 0x8eea50]
push edx
call edi
mov eax, dword [0xd0a7a8]
mov ecx, eax
shl ecx, 6
add ecx, eax
shl ecx, 2
sub ecx, 0x8ee50c
mov byte [ecx + esi + 0x8eea51], bl
inc dword [0xd0a7a8]
pop esi
pop edi
mov eax, 1
pop ebx
add esp, 0x110
ret
Function at 0x40aaa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x21c
push ebx
mov ebx, dword [esp + 0x22c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40ab05
mov edi, dword [esp + 0x22c]
mov eax, dword [edi + 4]
test eax, eax
lea esi, [edi + 4]
je 0x40aad9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], 0
push esi
push 0x4a4760
push 1
push 0
push 0x4a49a0
mov dword [edi + 8], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x40ab11
mov dword [esi], 0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x21c
ret
push 0x104
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [0x4c23c0], 3
je 0x40ab44
mov eax, dword [esi]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x24]
push edx
push eax
call dword [ecx + 0x34]
test eax, eax
jl 0x40ab05
mov ecx, dword [esi]
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.0040a4e0
add esp, 8
test eax, eax
je 0x40ab05
push ebx
lea edx, [edi + 0x30]
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi]
mov ebx, dword [esp + 0x230]
lea edx, [esp + 0x10]
push edx
push 0x4a48c0
mov dword [edi + 0x28], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x4a4890
push eax
call dword [ecx]
mov esi, dword [esi]
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x4a4810
push esi
call dword [eax]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
push str.Video_Renderer
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push eax
call dword [edx + 8]
test esi, esi
jl 0x40ac12
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x4a4920
push eax
call dword [ecx]
mov esi, eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jl 0x40ac12
mov ecx, dword [0x4c23bc]
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x74]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push ebx
push eax
call dword [edx + 0x7c]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 0x44000000
push eax
call dword [ecx + 0x24]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push edi
push 0x40d
push ebx
push eax
call dword [edx + 0x34]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [edi], 1
mov eax, dword [0x4c23c4]
mov dword [edi + 0x2c], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x21c
ret
Function at 0x40c6b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c785
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.0040c360
add esp, 8
test eax, eax
je 0x40c785
push edi
lea eax, [esi + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [esp + 0x10]
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
push 0x4a48c0
mov dword [esi + 0x104], edi
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x4a4890
push eax
call dword [ecx]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x74]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push edi
push eax
call dword [edx + 0x7c]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push 0x44000000
push eax
call dword [ecx + 0x24]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push esi
push 0x40f
push edi
push eax
call dword [edx + 0x34]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi], 1
mov eax, dword [0x4c23c4]
mov dword [esi + 0x108], eax
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x40cff0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
dec eax
cmp edi, eax
ja 0x40d119
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + edi*4]
mov esi, dword [eax + edi*4 + 4]
xor edx, edx
mov ebp, 0x1e
mov eax, edi
div ebp
and ecx, 0x3fffffff
and esi, 0x3fffffff
sub esi, ecx
mov eax, edx
shl eax, 4
lea ebp, [eax + ebx]
cmp dword [ebp + 0x64], edi
mov dword [esp + 0x18], edx
jne 0x40d04d
lea eax, [edx + 7]
shl eax, 4
cmp dword [eax + ebx], 0
jne 0x40d119
test esi, esi
je 0x40d0ff
push 0
push 0
push ecx
mov ecx, dword [ebx + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebx + 0x5c]
mov ecx, dword [ebx + 0x20]
push 0
lea edx, [esp + 0x14]
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40d084
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [ebx + 0x5c]
mov eax, dword [ebp + 0x68]
push esi
push edx
push eax
call fcn.00474250
add esp, 0xc
test eax, eax
jne 0x40d0b3
mov edi, dword [ebp + 0x68]
mov ecx, esi
mov esi, dword [ebx + 0x5c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add eax, 7
shl eax, 4
mov dword [eax + ebx], 1
mov ecx, dword [ebp + 0x68]
cmp dword [ecx], 0x3449414d
jne 0x40d0e7
mov dword [ebp + 0x6c], 1
mov dword [ebp + 0x64], edi
mov dword [ebx + 0x60], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
mov dword [ebp + 0x6c], 0
mov dword [ebp + 0x64], edi
mov dword [ebx + 0x60], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
add edx, 7
mov dword [ebp + 0x6c], 0
shl edx, 4
mov dword [edx + ebx], 0
mov dword [ebp + 0x64], edi
mov dword [ebx + 0x60], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x40d130
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor eax, eax
push eax
push eax
push eax
push eax
mov ecx, 0x92
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x30]
push DirectSoundCreate
push eax
push 0
call fcn.00405640
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [esi + 0x20], eax
jne 0x40d170
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x20
push esi
push eax
call ebx
test eax, eax
je 0x40d23b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40d20c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esi + 0x14]
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [esi + 0x20]
push ecx
push eax
push edx
mov dword [esi + 0x24], eax
call ebx
test eax, eax
je 0x40d23b
mov ebp, dword [esi + 0x14]
cmp ebp, 0x400
jbe 0x40d1c8
mov ebp, 0x400
xor ecx, ecx
test ebp, ebp
jle 0x40d1e6
mov eax, dword [esi + 0x24]
lea edi, [eax + ecx]
mov al, byte [edi]
mov dl, al
shl dl, 7
shr al, 1
or dl, al
inc ecx
cmp ecx, ebp
mov byte [edi], dl
jl 0x40d1ce
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x24]
push eax
mov eax, dword [esp + 0x28]
or ecx, 1
push ecx
push edx
push eax
lea ecx, [esi + 0x28]
push ecx
call fcn.00477b20
add esp, 0x14
test eax, eax
je 0x40d23b
mov edx, dword [esi + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea edi, [edx*4 + 4]
push edi
push 0
call ebp
test eax, eax
mov dword [esi + 0x2c], eax
je 0x40d23b
mov edx, dword [esi + 0x20]
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
push eax
push edx
call ebx
test eax, eax
jne 0x40d24e
push esi
call fcn.0040d3b0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esi + 8]
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
fild qword [esp + 0x10]
mov eax, dword [esi + 4]
cmp eax, edx
fdivr qword [0x4a1550]
fstp qword [esi + 0x38]
jbe 0x40d292
mov ecx, dword [esi + 0x2c]
mov edi, eax
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
and eax, 0x3fffffff
and ebx, 0x3fffffff
sub eax, ebx
cmp edx, eax
jae 0x40d28c
mov edx, eax
add ecx, 4
dec edi
jne 0x40d274
push edx
push 0
call ebp
mov dword [esi + 0x5c], eax
xor ebx, ebx
lea edi, [esi + 0x70]
push 0x80000
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
mov dword [edi - 8], eax
push esi
mov dword [edi], 0
call fcn.0040cff0
add esp, 8
test eax, eax
je 0x40d244
inc ebx
add edi, 0x10
cmp ebx, 0x1e
jb 0x40d29f
mov ecx, dword [0x4c21f4]
pop edi
mov dword [esi + 0x58], ecx
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x40d8f0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x40d937
mov ecx, dword [esi + 0x10]
cmp ecx, 3
je 0x40d908
cmp ecx, 2
jne 0x40d916
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x10], 1
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 0x10], 0
pop esi
ret

Function at 0x40d940
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x40d987
mov ecx, dword [esi + 0x10]
cmp ecx, 3
je 0x40d958
cmp ecx, 2
jne 0x40d966
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x10], 1
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [esi + 8]
push edx
push 0
push esi
push 0x40d8b0
push 0
push 0
mov dword [esi + 0x10], 1
call fcn.0044f2cb
add esp, 0x18
test eax, eax
mov dword [esi], eax
jne 0x40d9ae
pop esi
ret
mov ecx, dword [esi + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
pop esi
ret

Function at 0x40d9c0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0xc
mov eax, dword [0x8c3adc]
push ebp
mov ebp, dword [0x8c39d0]
push esi
mov esi, dword [eax + 0x80]
mov eax, dword [esi + ebp + 0xc]
add esi, ebp
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
je 0x40da8b
push ebx
jmp 0x40d9fa
mov esi, dword [esp + 0x14]
lea edx, [eax + ebp]
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00474180
add dword [esp + 0x18], eax
mov ebx, dword [esi + 0x10]
mov esi, dword [esi]
mov eax, dword [esi + ebp]
add esi, ebp
add esp, 8
add ebx, ebp
test eax, eax
je 0x40da72
mov edx, dword [esp + 0x18]
mov ecx, dword [ebx]
add edx, ecx
test eax, 0x80000000
mov dword [esp + 0x18], edx
je 0x40da41
and eax, 0x7fffffff
jmp 0x40da5b
lea edx, [eax + ebp + 2]
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00474180
add esp, 8
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esi + 4]
add esi, 4
add ebx, 4
test eax, eax
mov dword [esp + 0x10], ecx
jne 0x40da27
mov eax, dword [esp + 0x14]
add eax, 0x14
mov dword [esp + 0x14], eax
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x40d9f6
xor edi, edi
pop ebx
mov eax, dword [0x8c35bc]
mov esi, dword [0x8c39d4]
mov edx, dword [esp + 0x14]
push eax
push esi
mov dword [0x8c3eec], edi
mov dword [0x4c2014], edx
call fcn.00474180
mov ecx, dword [0x8c35bc]
mov dword [0x8c3ee8], eax
add esp, 8
xor eax, eax
cmp ecx, edi
jbe 0x40dad2
cmp byte [esi + eax], 0xcc
jne 0x40dacd
inc dword [0x8c3eec]
inc eax
cmp eax, ecx
jb 0x40dac1
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x410ab0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push esi
push edi
push 0xd09e80
lea eax, [esp + 0x18]
push str._sSystem
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x20]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410c9f
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
push eax
push 0xd09e18
lea ecx, [esp + 0x18]
push ecx
push 0
push str.gbFullScreenFlag
mov edi, 4
push edx
mov dword [esp + 0x28], 3
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x410b3c
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410c9f
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0xd09e1c
lea edx, [esp + 0x18]
push edx
push 0
push str.gbFullWindow
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x410b71
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410c9f
mov eax, dword [0xd09e20]
test eax, eax
je 0x410b90
mov edx, dword [0xd09e18]
mov dword [0xd09e1c], edx
mov dword [0xd09e18], 0
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0x4c2238
lea ecx, [esp + 0x18]
push ecx
push 0
push str.gnWindowLeft
push edx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x410bc5
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410c9f
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x4c223c
lea edx, [esp + 0x18]
push edx
push 0
push str.gnWindowTop
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x410bfa
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410c9f
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0x4c21f4
lea eax, [esp + 0x18]
push eax
push 0
push str.gdwWindowWidth
push ecx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x410c2c
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410c9f
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0x4c21f8
lea ecx, [esp + 0x18]
push ecx
push 0
push str.gdwWindowHeight
push edx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x410c5e
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410c9f
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x4c2204
lea edx, [esp + 0x18]
push edx
push 0
push str.gdwWindowBpp
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x410c90
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410c9f
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x410cba
push str.Registry_Read_Error.
push 0xd09bfc
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
xor eax, eax
pop esi
add esp, 0x110
ret
mov eax, 1
pop edi
mov dword [0xd0abd4], eax
pop esi
add esp, 0x110
ret
Function at 0x410cd0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0xd0abd4]
sub esp, 0x118
test eax, eax
push esi
je 0x410f0b
mov al, byte [0xd09e80]
test al, al
je 0x410f0b
push 0xd09e80
lea eax, [esp + 0x1c]
push str._sSystem
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0x20006
push 0
lea edx, [esp + 0x24]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x410d55
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [esp + 0x34]
push ecx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x410ef1
mov eax, dword [0xd09e20]
test eax, eax
je 0x410d74
mov edx, dword [0xd09e1c]
mov dword [0xd09e18], edx
mov dword [0xd09e1c], 0
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
push 0xd09e18
push 3
push 0
push str.gbFullScreenFlag
push eax
call esi
test eax, eax
je 0x410da5
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410ef1
mov edx, dword [esp + 4]
push 4
push 0xd09e1c
push 3
push 0
push str.gbFullWindow
push edx
call esi
test eax, eax
je 0x410dd0
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410ef1
mov eax, dword [0xd09dfc]
test eax, eax
je 0x410df8
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [0x4c2238], edx
mov dword [0x4c223c], eax
mov ecx, dword [esp + 4]
push 4
push 0x4c2238
push 3
push 0
push str.gnWindowLeft
push ecx
call esi
test eax, eax
je 0x410e23
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410ef1
mov eax, dword [esp + 4]
push 4
push 0x4c223c
push 3
push 0
push str.gnWindowTop
push eax
call esi
test eax, eax
je 0x410e4e
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410ef1
mov edx, dword [esp + 4]
push 4
push 0x4c21f4
push 3
push 0
push str.gdwWindowWidth
push edx
call esi
test eax, eax
je 0x410e76
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410ef1
mov ecx, dword [esp + 4]
push 4
push 0x4c21f8
push 3
push 0
push str.gdwWindowHeight
push ecx
call esi
test eax, eax
je 0x410e9e
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410ef1
mov eax, dword [esp + 4]
push 4
push 0x4c2204
push 3
push 0
push str.gdwWindowBpp
push eax
call esi
test eax, eax
je 0x410ec6
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410ef1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
je 0x410ee2
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x410ef1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x410f0b
push str.Registry_Write_Error.
push 0xd09bfc
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop esi
add esp, 0x118
ret
mov eax, 1
pop esi
add esp, 0x118
ret