joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d440
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x497599
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ebp, [esi + 0x10]
mov ecx, ebp
mov dword [esp + 0x24], ebx
call fcn.004401a0
lea ecx, [esi + 0x18]
mov byte [esp + 0x24], 1
call fcn.004401a0
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 2
call fcn.004401a0
lea edi, [esi + 0x3c]
mov ecx, edi
mov byte [esp + 0x24], 3
call fcn.004401a0
push 0x40400000
push 0x3f800000
lea ecx, [esp + 0x1c]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [ebp], ebx
mov dword [esi + 0x20], 0x41a00000
mov dword [esi + 0x24], 0x43c80000
mov dword [esi + 0x38], 0xbf800000
call fcn.004401d0
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], edx
pop edi
mov dword [esi + 0x5c], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x41d45a
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x497599
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ebp, [esi + 0x10]
mov ecx, ebp
mov dword [esp + 0x24], ebx
call fcn.004401a0
lea ecx, [esi + 0x18]
mov byte [esp + 0x24], 1
call fcn.004401a0
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 2
call fcn.004401a0
lea edi, [esi + 0x3c]
mov ecx, edi
mov byte [esp + 0x24], 3
call fcn.004401a0
push 0x40400000
push 0x3f800000
lea ecx, [esp + 0x1c]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [ebp], ebx
mov dword [esi + 0x20], 0x41a00000
mov dword [esi + 0x24], 0x43c80000
mov dword [esi + 0x38], 0xbf800000
call fcn.004401d0
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], edx
pop edi
mov dword [esi + 0x5c], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x42cfd0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov ebx, ecx
mov dword [ebx + 0x1fc], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cl, byte [eax]
cmp cl, 0x22
jne 0x42d001
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x42d01a
cmp cl, 0x22
je 0x42d014
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42cff2
jmp 0x42d01a
test cl, cl
je 0x42d01a
cmp cl, 0x20
je 0x42d014
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42d005
jmp 0x42d01a
cmp byte [eax], 0
je 0x42d01a
inc eax
cmp byte [eax], 0x20
jne 0x42d029
nop
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x42d020
mov cl, byte [eax]
cmp cl, 0x2d
je 0x42d035
cmp cl, 0x2f
jne 0x42d036
inc eax
mov cl, byte [eax]
cmp cl, 0x70
je 0x42d097
cmp cl, 0x50
je 0x42d097
cmp cl, 0x6c
je 0x42d097
cmp cl, 0x4c
je 0x42d097
cmp cl, 0x73
je 0x42d08b
cmp cl, 0x53
je 0x42d08b
cmp cl, 0x63
je 0x42d064
cmp cl, 0x43
jne 0x42d0f2
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x42d064
cmp cl, 0x3a
je 0x42d064
test cl, cl
je 0x42d07f
push eax
call fcn.0046291d
add esp, 4
mov dword [ebx + 0x1fc], 3
pop ebx
ret
mov dword [ebx + 0x1fc], 2
pop ebx
ret
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x42d097
cmp cl, 0x3a
je 0x42d097
push esi
push edi
mov edi, str.scrprev
mov esi, eax
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42d0dd
mov edi, str.ScrPrev
mov esi, eax
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x42d0dd
mov edi, str.SCRPREV
mov esi, eax
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x42d0e6
push eax
call fcn.0046291d
add esp, 4
pop edi
mov dword [ebx + 0x1fc], 4
pop esi
pop ebx
ret
Function at 0x42e900
Capabilities:
Access peb ldr_data
Check os version
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x498754
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
mov eax, dword [0x4bd96c]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x90], eax
call fcn.0043d4b0
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
xor ebx, ebx
push 0x20
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.SoftwareGameHouseFeedingFrenzy
mov dword [esp + 0xc4], ebx
mov byte [ecx + 4], bl
call fcn.00403b80
push 0x80000002
lea ecx, [esp + 0x30]
call fcn.0043d4e0
cmp al, bl
jne 0x42e9c1
lea ecx, [esp + 0xc]
call fcn.0043d4c0
push 0x25
push str.Screen_saver_not_installed_correctly.
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403b80
push 1
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4], 1
call fcn.00416b00
push 0x4b57ac
lea ecx, [esp + 0x3c]
push ecx
call fcn.00462586
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x49e5ee
mov byte [ecx + 4], bl
call fcn.00403b80
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x10
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.SaverInstallPath
mov byte [esp + 0xdc], 2
mov byte [ecx + 4], bl
call fcn.00403b80
lea edx, [esp + 0xac]
push edx
lea ecx, [esp + 0x48]
mov byte [esp + 0xd8], bl
call fcn.0043d8c0
mov eax, dword [esp + 0x88]
push ebx
push 0x49e5ee
push eax
push ebx
lea ecx, [esp + 0x84]
mov byte [esp + 0xac], 3
call fcn.00402d10
test eax, eax
jne 0x42ea8f
lea ecx, [esp + 0xc]
call fcn.0043d4c0
push 0x2a
push str.Screen_saver_couldnt_find_data_resources.
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403b80
push 1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4], 4
call fcn.00416b00
push 0x4b57ac
lea edx, [esp + 0x3c]
push edx
call fcn.00462586
mov eax, dword [esi + 0xfc]
cmp eax, ebx
mov dword [esi + 0x38], eax
jl 0x42eaa1
cmp eax, 5
jle 0x42eaa4
mov dword [esi + 0x38], ebx
cmp dword [esp + 0x8c], 0x10
mov eax, dword [esp + 0x78]
jae 0x42eab6
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0xc]
call fcn.0043d4c0
cmp dword [esp + 0x8c], 0x10
jb 0x42eadd
mov eax, dword [esp + 0x78]
push eax
call fcn.0046256d
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
mov dword [esp + 0x9c], 0xffffffff
call fcn.0043f2d0
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x90]
call fcn.00462751
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x42e921
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x498754
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
mov eax, dword [0x4bd96c]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x90], eax
call fcn.0043d4b0
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
xor ebx, ebx
push 0x20
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.SoftwareGameHouseFeedingFrenzy
mov dword [esp + 0xc4], ebx
mov byte [ecx + 4], bl
call fcn.00403b80
push 0x80000002
lea ecx, [esp + 0x30]
call fcn.0043d4e0
cmp al, bl
jne 0x42e9c1
lea ecx, [esp + 0xc]
call fcn.0043d4c0
push 0x25
push str.Screen_saver_not_installed_correctly.
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403b80
push 1
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4], 1
call fcn.00416b00
push 0x4b57ac
lea ecx, [esp + 0x3c]
push ecx
call fcn.00462586
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x49e5ee
mov byte [ecx + 4], bl
call fcn.00403b80
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x10
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.SaverInstallPath
mov byte [esp + 0xdc], 2
mov byte [ecx + 4], bl
call fcn.00403b80
lea edx, [esp + 0xac]
push edx
lea ecx, [esp + 0x48]
mov byte [esp + 0xd8], bl
call fcn.0043d8c0
mov eax, dword [esp + 0x88]
push ebx
push 0x49e5ee
push eax
push ebx
lea ecx, [esp + 0x84]
mov byte [esp + 0xac], 3
call fcn.00402d10
test eax, eax
jne 0x42ea8f
lea ecx, [esp + 0xc]
call fcn.0043d4c0
push 0x2a
push str.Screen_saver_couldnt_find_data_resources.
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403b80
push 1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4], 4
call fcn.00416b00
push 0x4b57ac
lea edx, [esp + 0x3c]
push edx
call fcn.00462586
mov eax, dword [esi + 0xfc]
cmp eax, ebx
mov dword [esi + 0x38], eax
jl 0x42eaa1
cmp eax, 5
jle 0x42eaa4
mov dword [esi + 0x38], ebx
cmp dword [esp + 0x8c], 0x10
mov eax, dword [esp + 0x78]
jae 0x42eab6
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0xc]
call fcn.0043d4c0
cmp dword [esp + 0x8c], 0x10
jb 0x42eadd
mov eax, dword [esp + 0x78]
push eax
call fcn.0046256d
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
mov dword [esp + 0x9c], 0xffffffff
call fcn.0043f2d0
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x90]
call fcn.00462751
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x431820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x498a36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, ebx
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
je 0x43185d
mov dword [esi + 4], 0x4a677c
mov dword [esi + 0x204], 0x4a2e74
push ebx
mov ecx, esi
call fcn.0044cd30
mov dword [esi + 0xc], 0x4a84e0
mov eax, dword [esi + 4]
mov dword [esi], 0x4a6764
mov dword [esi + 0xc], 0x4a6760
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 4], 0x4a6754
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
lea ecx, [eax - 0x200]
mov dword [eax + esi], ecx
lea ebp, [esi + 0x8c]
mov ecx, ebp
mov dword [esp + 0x24], ebx
call fcn.004401a0
lea ecx, [esi + 0x94]
mov byte [esp + 0x24], 1
call fcn.004401a0
lea ecx, [esi + 0x9c]
mov byte [esp + 0x24], 2
call fcn.00433c90
lea ecx, [esi + 0x108]
mov byte [esp + 0x24], 3
call fcn.00435540
lea ecx, [esi + 0x13c]
mov byte [esp + 0x24], 4
call fcn.00435540
lea ecx, [esi + 0x170]
mov byte [esp + 0x24], 5
call fcn.00431df0
mov dword [esi + 0x1b4], ebx
mov dword [esi + 0x1b8], ebx
mov dword [esi + 0x1bc], ebx
mov dword [esi + 0x1c4], ebx
mov dword [esi + 0x1c8], ebx
mov dword [esi + 0x1cc], ebx
lea edi, [esi + 0x1dc]
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
push 0xc2a00000
push 0x43a00000
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 9
mov dword [esi + 0x30], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x174], ebx
mov byte [esi + 0x198], bl
mov dword [esi + 0x194], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], 0xbf800000
call fcn.004401d0
mov edx, dword [eax]
mov dword [ebp], edx
mov eax, dword [eax + 4]
lea ecx, [esp + 0x14]
mov dword [ebp + 4], eax
call fcn.0043f2d0
push 0x42480000
push 0x43a00000
lea ecx, [esp + 0x1c]
call fcn.004401d0
mov ecx, dword [eax]
mov dword [esi + 0x94], ecx
mov edx, dword [eax + 4]
lea ecx, [esp + 0x14]
mov dword [esi + 0x98], edx
call fcn.0043f2d0
push 0xa
push str.NO_VERSION
mov ecx, edi
mov dword [esi + 0x88], 0x3e99999a
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1d0], ebx
mov dword [esi + 0x1d4], ebx
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1f8], ebx
mov dword [esi + 0x18], ebx
mov byte [esi + 0x178], bl
mov byte [esi + 0x180], bl
mov byte [esi + 0x179], bl
mov dword [esi + 0x188], ebx
mov dword [esi + 0x184], ebx
mov dword [esi + 0x17c], ebx
call fcn.00403b80
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [esi + 0x1fc], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x194], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x7c], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x431e60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x498ad8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [0x4bd96c]
push ebx
push esi
mov dword [esp + 0x30], eax
push edi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], ebx
call fcn.0043d4b0
push 0x21
mov edi, 0xf
push str.SoftwareGameHouseFeedingFrenzy_
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 1
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403b80
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 2
call fcn.00405850
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x40]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00403a90
push reloc.DSOUND.dll_DirectSoundCreate
lea ecx, [esp + 0x30]
call fcn.0043d4e0
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 9
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.foodCount
mov byte [ecx + 4], bl
call fcn.00403b80
lea ecx, [esp + 0x2c]
call fcn.0043d610
lea ecx, [esp + 0xc]
mov dword [esi], eax
call fcn.0043d4c0
mov eax, dword [esp + 0x30]
mov esi, 0x10
cmp eax, esi
jb 0x431f4d
mov eax, dword [esp + 0x1c]
push eax
call fcn.0046256d
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x40], bl
call fcn.0043f2d0
cmp dword [esp + 0x60], esi
jb 0x431f79
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0046256d
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x34]
call fcn.00462751
pop edi
pop esi
pop ebx
add esp, 0x38
ret 0x1c
Function at 0x431fa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x498ad8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [0x4bd96c]
push ebx
push esi
mov dword [esp + 0x30], eax
push edi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], ebx
call fcn.0043d4b0
push 0x21
mov edi, 0xf
push str.SoftwareGameHouseFeedingFrenzy_
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 1
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403b80
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 2
call fcn.00405850
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x40]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00403a90
push reloc.DSOUND.dll_DirectSoundCreate
lea ecx, [esp + 0x30]
call fcn.0043d4e0
mov eax, dword [esi]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 9
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.foodCount
mov byte [ecx + 4], bl
call fcn.00403b80
lea ecx, [esp + 0x2c]
call fcn.0043d7f0
lea ecx, [esp + 0xc]
call fcn.0043d4c0
mov eax, dword [esp + 0x30]
mov esi, 0x10
cmp eax, esi
jb 0x43208d
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0046256d
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x40], bl
call fcn.0043f2d0
cmp dword [esp + 0x60], esi
jb 0x4320b9
mov edx, dword [esp + 0x4c]
push edx
call fcn.0046256d
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x34]
call fcn.00462751
pop edi
pop esi
pop ebx
add esp, 0x38
ret 0x1c
Function at 0x43ab70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.004401a0
mov ecx, dword [esi + 0x128]
mov eax, dword [ecx]
lea edx, [esp + 0x14]
xor ebx, ebx
push edx
mov dword [esp + 0x44], ebx
call dword [eax + 0x16c]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edx
call fcn.0043f2d0
mov ecx, dword [esi + 0x128]
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
call dword [eax + 0x16c]
fld dword [eax]
fcomp dword [0x4ab0bc]
mov byte [esp + 0xb], 1
fnstsw ax
test ah, 0x41
je 0x43abef
mov byte [esp + 0xb], bl
lea ecx, [esp + 0x14]
call fcn.0043f2d0
mov al, byte [esp + 0xb]
mov ecx, dword [esi + 0x128]
cmp al, bl
mov eax, dword [ecx]
je 0x43ac28
call dword [eax + 0x12c]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
mov ecx, eax
call fcn.00440400
fmul dword [0x49e580]
fsubr dword [esp + 0xc]
jmp 0x43ac46
call dword [eax + 0x12c]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
mov ecx, eax
call fcn.00440400
fmul dword [0x49e580]
fadd dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
fstp dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov eax, dword [esi]
push ecx
push edx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call dword [eax + 0x1c0]
mov edx, dword [eax]
mov dword [esp + 0xc], edx
mov eax, dword [eax + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
call fcn.0043f2d0
push 0xc
push str.levelUpBurst
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00403b80
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebx
push ebx
push ecx
mov ecx, dword [esi + 0x2c8]
push edx
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x54], 1
call fcn.0044aa70
cmp dword [esp + 0x34], 0x10
mov byte [esp + 0x40], bl
jb 0x43acd2
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0046256d
add esp, 4
push 7
push str.levelUp
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00403b80
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push ebx
push ebx
push edx
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esi + 0x2c8]
mov byte [esp + 0x54], 2
call fcn.0044aa70
cmp dword [esp + 0x34], 0x10
jb 0x43ad27
mov edx, dword [esp + 0x20]
push edx
call fcn.0046256d
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov dword [esp + 0x40], 0xffffffff
call fcn.0043f2d0
mov ecx, dword [esp + 0x38]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x43d610
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x499778
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [ecx + 4]
test al, al
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], 0
jne 0x43d662
cmp eax, 0x10
jb 0x43d64d
mov eax, dword [esp + 0x1c]
push eax
call fcn.0046256d
add esp, 4
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x20
push edi
mov edi, dword [esp + 0x38]
cmp eax, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 4
jae 0x43d67c
lea eax, [esp + 0x20]
push esi
lea edx, [esp + 8]
push edx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x43d6c1
call fcn.00442dc0
cmp dword [esp + 0x38], 0x10
mov ecx, dword [esp + 0x24]
jae 0x43d6af
lea ecx, [esp + 0x24]
mov edx, dword [eax]
push esi
push ecx
push str.Unable_to_query_DWORD_registry_value:__s__Error:__d__n
push eax
call dword [edx + 0x58]
add esp, 0x10
jmp 0x43d6c5
mov edi, dword [esp + 0xc]
cmp dword [esp + 0x38], 0x10
pop esi
jb 0x43d6da
mov eax, dword [esp + 0x20]
push eax
call fcn.0046256d
add esp, 4
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x20

Function at 0x43d6f0
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x499760
push eax
mov dword fs:[0], esp
push ebp
push esi
push edi
mov ebp, ecx
mov al, byte [ebp + 4]
test al, al
mov dword [esp + 0x14], 1
jne 0x43d73c
call fcn.00442dc0
mov edx, dword [eax]
sub esp, 0x1c
mov edi, esp
push str.Unable_to_write_reg_value__s__registry_key_not_open_n
mov ecx, 7
lea esi, [esp + 0x3c]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [edx + 0x58]
add esp, 0x24
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x3c]
mov edi, 0x10
cmp eax, edi
jae 0x43d751
lea ecx, [esp + 0x3c]
cmp dword [esp + 0x34], edi
mov eax, dword [esp + 0x20]
jae 0x43d75f
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x4c]
inc edx
push edx
push ecx
push 1
push 0
push eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x43d79e
call fcn.00442dc0
cmp dword [esp + 0x34], edi
mov ecx, dword [esp + 0x20]
jae 0x43d78e
lea ecx, [esp + 0x20]
mov edx, dword [eax]
push esi
push ecx
push str.Unable_to_write_reg_value__s__Error:__d__n
push eax
call dword [edx + 0x58]
add esp, 0x10
cmp dword [esp + 0x34], edi
jb 0x43d7b1
mov eax, dword [esp + 0x20]
push eax
call fcn.0046256d
add esp, 4
cmp dword [esp + 0x50], edi
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
jb 0x43d7d9
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0046256d
add esp, 4
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 0x38
Function at 0x43d7f0
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x499778
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov ebx, ecx
mov al, byte [ebx + 4]
test al, al
mov dword [esp + 0x14], 0
jne 0x43d83c
call fcn.00442dc0
mov edx, dword [eax]
sub esp, 0x1c
mov edi, esp
push str.Unable_to_write_reg_value__s__registry_key_not_open_n
mov ecx, 7
lea esi, [esp + 0x3c]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [edx + 0x58]
add esp, 0x24
mov eax, dword [esp + 0x34]
mov edi, 0x10
cmp eax, edi
mov eax, dword [esp + 0x20]
jae 0x43d851
lea eax, [esp + 0x20]
mov edx, dword [ebx]
push 4
lea ecx, [esp + 0x3c]
push ecx
push 4
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x43d88f
call fcn.00442dc0
cmp dword [esp + 0x34], edi
mov ecx, dword [esp + 0x20]
jae 0x43d87f
lea ecx, [esp + 0x20]
mov edx, dword [eax]
push esi
push ecx
push str.Unable_to_write_reg_value__s__Error:__d__n
push eax
call dword [edx + 0x58]
add esp, 0x10
cmp dword [esp + 0x34], edi
jb 0x43d8a2
mov eax, dword [esp + 0x20]
push eax
call fcn.0046256d
add esp, 4
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x20