joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443680
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x50e8a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 4]
push eax
push ecx
mov ecx, esi
call fcn.00443590
test eax, eax
je 0x4436fb
mov cl, byte [eax + 0x38]
test cl, cl
jne 0x4436fb
mov eax, dword [esp + 4]
mov ecx, dword [esi + 8]
cmp eax, ecx
jae 0x4436e7
mov edx, dword [esi + 4]
mov ecx, dword [edx + eax*4]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
mov eax, dword [ecx]
push edx
call dword [eax + 0x6c]
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov ecx, dword [esp + 8]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
lea ecx, [esp + 0x18]
call fcn.0046e990
push 0x5cec28
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0
call fcn.00470b10
mov ecx, 0x5cec20
call fcn.00470660
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00470660
mov edx, eax
mov ecx, esi
call fcn.00465a30
push 0xffffffffffffffff
call fcn.005009bb
nop
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov eax, dword [eax + edi*4]
mov ebx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test ebx, ebx
je 0x443780
mov edx, dword [esi + 8]
xor eax, eax
test edx, edx
jbe 0x443779
mov ecx, dword [esi + 4]
mov ebp, dword [ecx]
cmp dword [ebp + 0x14], ebx
je 0x443780
inc eax
add ecx, 4
cmp eax, edx
jb 0x44376a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esi + 8]
lea ecx, [edx - 1]
cmp edi, ecx
je 0x4437ad
lea eax, [edi + 1]
mov ecx, dword [esi + 4]
mov ebx, eax
shl ebx, 0x1e
sub ebx, eax
add ebx, edx
lea edx, [ecx + eax*4]
shl ebx, 2
push ebx
lea eax, [ecx + edi*4]
push edx
push eax
call fcn.00500650
add esp, 0xc
mov eax, dword [esi + 8]
dec eax
mov dword [esi + 8], eax
jne 0x4437c9
mov ecx, dword [esi + 4]
push ecx
call fcn.004ffee0
add esp, 4
mov dword [esi + 4], 0
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x443696
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x50e8a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 4]
push eax
push ecx
mov ecx, esi
call fcn.00443590
test eax, eax
je 0x4436fb
mov cl, byte [eax + 0x38]
test cl, cl
jne 0x4436fb
mov eax, dword [esp + 4]
mov ecx, dword [esi + 8]
cmp eax, ecx
jae 0x4436e7
mov edx, dword [esi + 4]
mov ecx, dword [edx + eax*4]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
mov eax, dword [ecx]
push edx
call dword [eax + 0x6c]
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov ecx, dword [esp + 8]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
lea ecx, [esp + 0x18]
call fcn.0046e990
push 0x5cec28
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0
call fcn.00470b10
mov ecx, 0x5cec20
call fcn.00470660
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00470660
mov edx, eax
mov ecx, esi
call fcn.00465a30
push 0xffffffffffffffff
call fcn.005009bb
nop
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov eax, dword [eax + edi*4]
mov ebx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test ebx, ebx
je 0x443780
mov edx, dword [esi + 8]
xor eax, eax
test edx, edx
jbe 0x443779
mov ecx, dword [esi + 4]
mov ebp, dword [ecx]
cmp dword [ebp + 0x14], ebx
je 0x443780
inc eax
add ecx, 4
cmp eax, edx
jb 0x44376a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [esi + 8]
lea ecx, [edx - 1]
cmp edi, ecx
je 0x4437ad
lea eax, [edi + 1]
mov ecx, dword [esi + 4]
mov ebx, eax
shl ebx, 0x1e
sub ebx, eax
add ebx, edx
lea edx, [ecx + eax*4]
shl ebx, 2
push ebx
lea eax, [ecx + edi*4]
push edx
push eax
call fcn.00500650
add esp, 0xc
mov eax, dword [esi + 8]
dec eax
mov dword [esi + 8], eax
jne 0x4437c9
mov ecx, dword [esi + 4]
push ecx
call fcn.004ffee0
add esp, 4
mov dword [esi + 4], 0
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x443900
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push ebp
push esi
mov ebp, edx
mov esi, ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
push str.Text
push esi
call fcn.0050d670
add esp, 8
test eax, eax
jne 0x443928
mov eax, 1
jmp 0x44392f
push esi
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x443987
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
test ebp, ebp
mov edi, eax
je 0x443956
mov dword [ebp], edi
push edi
call fcn.004fff6b
mov ecx, edi
mov ebp, eax
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
pop esi
pop ebp
pop ebx
ret
Function at 0x44f1a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50f198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [esp + 0x24]
call fcn.0046e990
xor eax, eax
mov dword [esp + 8], 0x517838
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], al
and esi, 0x20
lea ecx, [esp + 8]
or esi, 0x84
mov dword [esp + 0x30], eax
push esi
push edi
call fcn.0044f600
test al, al
pop edi
pop esi
je 0x44f24b
lea ecx, [esp]
call fcn.0044fff0
mov dword [esp], 0x517838
lea ecx, [esp]
mov dword [esp + 0x28], 1
call fcn.0044fff0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0xffffffff
call fcn.0046ebb0
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov dword [esp], 0x517838
lea ecx, [esp]
mov dword [esp + 0x28], 2
call fcn.0044fff0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], 0xffffffff
call fcn.0046ebb0
mov ecx, dword [esp + 0x20]
xor al, al
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x451cd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x348
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x451e0e
or ecx, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
lea edx, [esp + 0x10c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10c]
test ecx, ecx
je 0x451d53
lea edx, [esp + 0x10c]
push 0x5c
push edx
call fcn.00501170
mov esi, eax
lea eax, [esp + 0x114]
push 0x2f
push eax
call fcn.00501170
add esp, 0x10
cmp eax, esi
jbe 0x451d41
mov esi, eax
test esi, esi
je 0x451d4a
lea eax, [esi + 1]
jmp 0x451d58
lea eax, [esp + 0x10c]
jmp 0x451d58
mov eax, str.In_Path_Name_Null_
mov byte [eax], 0
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 8]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 8]
test al, al
je 0x451db4
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 7]
mov cl, byte [esp + ecx + 7]
cmp cl, 0x5c
je 0x451daf
cmp cl, 0x2f
je 0x451daf
inc eax
mov byte [eax], 0x2f
lea edx, [eax + 1]
jmp 0x451db8
lea edx, [esp + 8]
mov edi, 0x531afc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x210]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
pop esi
je 0x451e04
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop edi
add esp, 0x348
ret
xor al, al
pop edi
add esp, 0x348
ret
not al
and al, 1
pop edi
add esp, 0x348
ret
Function at 0x451e20
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebp
push esi
push edi
mov ebp, ecx
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x451e78
mov al, byte [esp + ecx + 0xf]
lea ecx, [esp + ecx + 0xf]
cmp al, 0x2f
je 0x451e75
cmp al, 0x5c
jne 0x451e78
mov byte [ecx], 0
lea ecx, [esp + 0x10]
push 0
push ecx
call ebx
test eax, eax
jne 0x451ecd
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.00501170
add esp, 8
test eax, eax
jne 0x451eab
lea eax, [esp + 0x10]
push 0x2f
push eax
call fcn.00501170
add esp, 8
test eax, eax
je 0x451ec0
lea ecx, [esp + 0x10]
push 0
push ecx
mov byte [eax], 0
call ebx
test eax, eax
je 0x451e85
jmp 0x451e32
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x104
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x104
ret

Function at 0x452470
Capabilities:
Read .ini file

Disassembly:
fld dword [esp + 8]
sub esp, 0x14
lea eax, [esp]
push esi
push edi
sub esp, 8
mov esi, edx
mov edi, ecx
fstp qword [esp]
push 0x530f8c
push eax
call fcn.00500f16
mov eax, dword [esp + 0x30]
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 8]
push edi
push 0x14
push ecx
push edx
push eax
mov ecx, esi
call fcn.004c2f90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 8]
push ecx
call fcn.00500ae2
add esp, 4
pop edi
pop esi
add esp, 0x14
ret 8

Function at 0x452520
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push eax
push ecx
mov ecx, edx
call fcn.004c2f90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret 0xc
Function at 0x456900
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x50f7d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00487210
xor edi, edi
mov ecx, esi
mov dword [esp + 0x14], edi
mov dword [esi], 0x515b50
call fcn.00487f10
mov ecx, esi
mov dword [esp + 0x14], 1
mov dword [esi], 0x517d14
call fcn.00487f10
mov dword [esi + 0xc], edi
mov word [esi + 0x12], di
mov word [esi + 0x14], di
mov dword [esi + 0x3c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
xor eax, eax
mov word [esi + 8], di
mov word [esi + 0xa], di
mov ax, word [esi + 0x12]
push 1
push eax
mov ecx, esi
call fcn.00458bd0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x463ecf
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50fe38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push 0
push eax
mov ecx, esi
mov dword [esp + 0x20], esi
call fcn.00499050
lea edi, [esi + 0x34]
mov dword [esp + 0x18], 0
mov ecx, edi
call fcn.0048d930
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x40]
mov dword [esi], 0x5181f4
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], edx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [edi], ecx
lea ecx, [edi + 4]
mov bx, word [edx]
mov word [ecx], bx
mov dl, byte [edx + 2]
mov byte [ecx + 2], dl
mov cx, word [eax + 8]
mov word [edi + 8], cx
mov dl, byte [eax + 0xa]
mov ecx, dword [esp + 0x10]
mov byte [edi + 0xa], dl
mov eax, dword [eax + 0xc]
mov dword [edi + 0xc], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24
Function at 0x4658a0
Capabilities:
Set current directory

Disassembly:
sub esp, 0x104
lea eax, [esp]
push 0x104
push eax
push 0
mov byte [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4658eb
lea ecx, [esp]
push 0x5c
push ecx
call fcn.00501170
add esp, 8
test eax, eax
jne 0x4658e7
lea edx, [esp]
push 0x2f
push edx
call fcn.00501170
add esp, 8
test eax, eax
je 0x4658eb
mov byte [eax + 1], 0
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
add esp, 0x104
ret

Function at 0x465ae0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x454
lea eax, [esp + 0x54]
push esi
push edi
push ecx
push str.__s_
mov esi, edx
push eax
call fcn.00500f16
add esp, 0xc
test esi, esi
je 0x465b22
lea edi, [esp + 0x5c]
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x53223c
lea ecx, [esp + ecx + 0x64]
push ecx
call fcn.00500f16
add esp, 0xc
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0x44
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x460]
mov eax, 1
pop edi
cmp ecx, eax
mov word [esp + 0x34], ax
mov dword [esp + 0x30], eax
pop esi
jne 0x465b59
mov word [esp + 0x30], 0
lea edx, [esp + 0x44]
lea eax, [esp]
push edx
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x70]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
neg eax
add esp, 0x454
ret 4

Function at 0x465b90
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x5e3f70]
push 1
push 0
push 0
push esi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x20
cmp ecx, eax
pop esi
sbb eax, eax
neg eax
ret

Function at 0x467590
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x510050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push eax
push edi
mov dword [esp + 0x10], esi
call fcn.00474360
mov ecx, esi
mov dword [esp + 0x14], 0
mov dword [esi], 0x5184c0
call fcn.00466910
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push eax
push ecx
push edi
mov ecx, esi
mov dword [esp + 0x28], 1
mov dword [esi], 0x518748
call fcn.00467620
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x46d040
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, ecx
mov eax, 1
mov ecx, dword [esp + 4]
sub esp, 0x49c
shl eax, cl
push ebx
push ebp
push esi
push edi
cmp eax, 0x10000000
ja 0x46d0b0
je 0x46d0a6
cmp eax, 0x4000000
ja 0x46d095
je 0x46d08b
cmp eax, 0x1000000
je 0x46d081
cmp eax, 0x2000000
jne 0x46d0d1
push str.Hat_Right
jmp 0x46d256
push str.Hat_Left
jmp 0x46d256
push str.Hat_Up
jmp 0x46d256
cmp eax, 0x8000000
jne 0x46d0d1
push str.Hat_Down
jmp 0x46d256
push str.Left
jmp 0x46d256
cmp eax, 0x20000000
je 0x46d251
cmp eax, 0x40000000
je 0x46d24a
cmp eax, 0x80000000
je 0x46d243
mov ebp, dword [esp + 0x4b4]
mov esi, dword [edx]
inc ecx
push ecx
push str.Button__d
push ebp
call fcn.00470090
add esp, 0xc
inc esi
call dword [sym.imp.WINMM.dll_joyGetNumDevs]
cmp esi, eax
ja 0x46d262
lea eax, [esp + 0x318]
push 0x194
lea ecx, [esi - 1]
push eax
push ecx
call dword [sym.imp.WINMM.dll_joyGetDevCapsA]
lea edx, [esp + 0x388]
push str.CurrentJoystickSettings
push edx
push str.SystemCurrentControlSetControlMediaResourcesJoystick
lea eax, [esp + 0x24]
push str._s_s_s
push eax
call fcn.00500f16
add esp, 0x14
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46d262
push str.OEMName
push esi
lea eax, [esp + 0x220]
push str.Joystick_d_s
push eax
mov dword [esp + 0x24], 0x100
call fcn.00500f16
add esp, 0x10
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 0
lea eax, [esp + 0x224]
push 0
push eax
push ecx
call edi
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov esi, eax
call ebx
test esi, esi
jne 0x46d262
mov eax, dword [esp + 0x4b0]
lea ecx, [esp + 0x118]
push eax
push ecx
push str.SystemCurrentControlSetControlMediaPropertiesPrivatePropertiesJoystickOEM
lea edx, [esp + 0x24]
push str._s_sButtons_d
push edx
call fcn.00500f16
add esp, 0x14
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0xf003f
push esi
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46d262
push 0x100
mov ecx, ebp
mov dword [esp + 0x18], 0x100
call fcn.00470850
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x18]
push esi
push esi
push 0x5413c8
push eax
call edi
push 0xffffffffffffffff
mov ecx, ebp
call fcn.004708f0
mov ecx, dword [esp + 0x10]
push ecx
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret 8
push str.Down
jmp 0x46d256
push 0x532330
jmp 0x46d256
push str.Right
mov ecx, dword [esp + 0x4b8]
call fcn.0046ebf0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret 8
Function at 0x46d2d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x49c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebp, edx
inc esi
call dword [sym.imp.WINMM.dll_joyGetNumDevs]
cmp esi, eax
jbe 0x46d2f9
pop edi
pop esi
pop ebp
mov eax, 0xa6
pop ebx
add esp, 0x49c
ret
lea eax, [esp + 0x318]
push 0x194
lea ecx, [esi - 1]
push eax
push ecx
call dword [sym.imp.WINMM.dll_joyGetDevCapsA]
lea edx, [esp + 0x388]
lea eax, [esp + 0x18]
push str.CurrentJoystickSettings
push edx
push str.SystemCurrentControlSetControlMediaResourcesJoystick
push str._s_s_s
push eax
call fcn.00500f16
add esp, 0x14
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46d364
pop edi
pop esi
pop ebp
mov eax, 0xa6
pop ebx
add esp, 0x49c
ret
push str.OEMName
push esi
lea eax, [esp + 0x220]
push str.Joystick_d_s
push eax
mov dword [esp + 0x24], 0x100
call fcn.00500f16
add esp, 0x10
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 0
lea eax, [esp + 0x224]
push 0
push eax
push ecx
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov edx, dword [esp + 0x10]
push edx
call ebx
test esi, esi
je 0x46d3dc
push 0x5413c8
mov ecx, ebp
call fcn.0046ebf0
mov eax, 0xa6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret
lea eax, [esp + 0x118]
lea ecx, [esp + 0x18]
push eax
push str.SystemCurrentControlSetControlMediaPropertiesPrivatePropertiesJoystickOEM
push 0x532460
push ecx
call fcn.00500f16
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x46d42b
pop edi
pop esi
pop ebp
mov eax, 0xa6
pop ebx
add esp, 0x49c
ret
push 0x100
mov ecx, ebp
mov dword [esp + 0x18], 0x100
call fcn.00470850
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push eax
push 0
push 0
push str.OEMName
push edx
call edi
mov ecx, ebp
mov esi, eax
push 0xffffffffffffffff
call fcn.004708f0
mov eax, dword [esp + 0x10]
push eax
call ebx
mov eax, esi
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
and eax, 0xa6
pop ebx
add esp, 0x49c
ret
Function at 0x480a00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
push ebx
lea eax, [esp + 0x1c]
xor ebx, ebx
push esi
test eax, eax
mov esi, ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0xb], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x104
mov dword [esp + 0xc], ebx
je 0x480a82
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], bl
push ecx
push 0x20019
push ebx
push str.SoftwareMicrosoftWABDLLPath
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x480a73
lea edx, [esp + 0x18]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push ebx
push 0x5413c8
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x480a82
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
lea eax, [esp + 0x20]
jne 0x480a9a
mov eax, str.WAB32.dll.
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x5d22fc], eax
je 0x480b37
push str.WABOpen
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x5d22f8], eax
je 0x480b37
push ebx
lea ecx, [esp + 0x20]
push ebx
lea edx, [esp + 0x18]
push ecx
push edx
call eax
cmp eax, ebx
jne 0x480b37
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
lea edx, [esp + 0x18]
push edx
push 0x10
push ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x38]
test eax, eax
jne 0x480b37
mov eax, dword [esp + 0x14]
mov ecx, 4
cmp eax, ecx
jne 0x480b13
mov edx, dword [esp + 0xc]
add esi, ecx
push esi
call fcn.0047fe20
mov byte [esp + 0xb], al
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x480b25
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x480b37
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esp + 0x10], ebx
call fcn.004658a0
mov al, byte [esp + 0xb]
pop esi
pop ebx
add esp, 0x11c
ret