joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [0x4930fc], 0
jbe 0x42b79c
cmp byte [0x445034], 1
jne 0x42b763
push dword [0x4930fc]
pop dword [0x495224]
mov dword [0x495220], 0x497260
jmp 0x42b70d
push 2
push 0x495220
call sub.zlib1.dll_deflate
add esp, 8
mov dword [ebp - 4], eax
cmp dword [0x495230], 0
jne 0x42b70d
push 0
push 0x49ffbc
push 0x4000
push 0x49b260
push dword [0x4930dc]
call sub.kernel32.dll_WriteFile
mov dword [0x49522c], 0x49b260
mov dword [0x495230], 0x4000
add dword [0x49520f], 0x4000
cmp dword [0x495224], 0
ja 0x42b6b8
mov eax, 0x4000
sub eax, dword [0x495230]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x42b79c
push 0
push 0x49ffbc
push dword [ebp - 8]
push 0x49b260
push dword [0x4930dc]
call sub.kernel32.dll_WriteFile
mov dword [0x49522c], 0x49b260
mov dword [0x495230], 0x4000
mov eax, dword [ebp - 8]
add dword [0x49520f], eax
jmp 0x42b79c
push 0
push 0x49ffbc
push dword [0x4930fc]
push 0x497260
push dword [0x4930dc]
call sub.kernel32.dll_WriteFile
mov eax, dword [0x4930fc]
add dword [0x49520f], eax
push 1
push 0
push 0
push dword [0x4930dc]
call sub.kernel32.dll_SetFilePointer
mov dword [0x4930fc], 0
leave
ret

Function at 0x42b7b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 1
push 0
push 0
push dword [0x4930dc]
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 1
jne 0x42b8aa
call fcn.0042b680
cmp byte [0x445034], 1
jne 0x42b87f
mov dword [ebp - 8], 0
mov eax, 0x4000
sub eax, dword [0x495230]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x42b838
push 0
push 0x49ffbc
push dword [ebp - 0xc]
push 0x49b260
push dword [0x4930dc]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 0xc]
add dword [0x49520f], eax
mov dword [0x49522c], 0x49b260
mov dword [0x495230], 0x4000
cmp dword [ebp - 8], 1
je 0x42b868
push 4
push 0x495220
call sub.zlib1.dll_deflate
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [0x495230], 0
ja 0x42b85f
cmp dword [ebp - 0x10], 1
jne 0x42b866
mov dword [ebp - 8], 1
jmp 0x42b7ed
push 0x495220
call sub.zlib1.dll_deflateEnd
add esp, 4
mov dword [0x49521c], 2
push 1
push 0
push 0
push dword [0x4930dc]
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 4], eax
push 0
push 0
push dword [0x4930e4]
push dword [0x4930dc]
call sub.kernel32.dll_SetFilePointer
jmp 0x42b91d
push 1
push 0
push 0
push dword [0x4930dc]
call sub.kernel32.dll_SetFilePointer
mov dword [0x4930e4], eax
mov dword [0x4930fc], 0
cmp byte [0x445034], 1
jne 0x42b91d
push 0
push 0x38
push 0x495220
call fcn.0043edd0
mov dword [0x495224], 0
mov dword [0x495230], 0x4000
mov dword [0x49522c], 0x49b260
push 0x38
push section..data
push 0
push 9
push 0xf
push 8
push 9
push 0x495220
call sub.zlib1.dll_deflateInit2_
add esp, 0x20
push 0
push 0x49ffbc
push 0x12
push 0x49520e
push dword [0x4930dc]
call sub.kernel32.dll_WriteFile
push 0
push 0
push dword [ebp - 4]
push dword [0x4930dc]
call sub.kernel32.dll_SetFilePointer
leave
ret 4
Function at 0x42bb2f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push esi
cmp byte [0x445033], 2
je 0x42bb42
pop esi
leave
ret
cmp byte [0x445035], 1
jne 0x42bb4e
pop esi
leave
ret
push 0
pop dword [0x4930e8]
mov byte [0x644194], 0
push 0
push 0x4426b0
push 0x644194
lea eax, [ebp - 0x4c]
push eax
push str.RZX_files__.rzx_
push str.Stream_RZX
push dword [0x49ff24]
call fcn.0043a154
or eax, eax
jne 0x42bb8b
xor eax, eax
pop esi
leave
ret
push 0x4930d0
call fcn.004012e2
push 0x442440
push dword [0x49ff24]
push 0x644194
call fcn.0043eb30
or eax, eax
jne 0x42bbb3
xor eax, eax
pop esi
leave
ret
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x644194
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x42bbd9
xor eax, eax
pop esi
leave
ret
mov dword [0x4930dc], eax
push 0x642d44
push 0x644194
call fcn.0043f840
call fcn.0042fc9d
push 0
push 0
push 0
push dword [0x4930dc]
call sub.kernel32.dll_SetFilePointer
lea esi, [ebp - 0x56]
push 0
push 0xa
push esi
call fcn.0043edd0
mov dword [esi], 0x21585a52
mov byte [esi + 4], 0
mov byte [esi + 5], 0xd
push 0
push 0x49ffbc
push 0xa
push esi
push dword [0x4930dc]
call sub.kernel32.dll_WriteFile
lea esi, [ebp - 0x73]
push 0
push 0x1d
push esi
call fcn.0043edd0
mov byte [esi], 0x10
mov dword [esi + 1], 0x1d
mov word [esi + 0x19], 3
mov word [esi + 0x1b], 4
lea eax, [esi + 5]
push eax
push 0x44501f
call fcn.0043f840
push 0
push 0x49ffbc
push 0x1d
lea eax, [ebp - 0x73]
push eax
push dword [0x4930dc]
call sub.kernel32.dll_WriteFile
call fcn.0042b420
or eax, eax
jne 0x42bc96
push 0
push str.I_O_file_error
call fcn.0042a460
xor eax, eax
pop esi
leave
ret
call fcn.0042b3b0
mov dword [0x4930e0], 0
mov byte [0x445035], 1
push str.Stop_Streaming
push 0x4acb
push dword [0x4a0b98]
call fcn.0043f180
mov eax, 1
pop esi
leave
ret

Function at 0x42bcc9
Capabilities:
Clear file content

Disassembly:
push esi
cmp byte [0x445035], 0
jne 0x42bcd5
pop esi
ret
push 1
call fcn.0042b7b0
call fcn.0042b420
push dword [0x4930dc]
call sub.kernel32.dll_SetEndOfFile
cmp byte [0x445034], 1
jne 0x42bd02
push 0x495220
call sub.zlib1.dll_deflateEnd
add esp, 4
push dword [0x4930dc]
call sub.kernel32.dll_CloseHandle
mov dword [0x4930dc], 0
push 0x4930d0
call fcn.0042a05f
push 0x4930d0
call fcn.004012e2
mov byte [0x445035], 0
push 0x479d00
push 0x4acb
push dword [0x4a0b98]
call fcn.0043f180
pop esi
ret
Function at 0x42c49c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0
push 0
push dword [esi + 0xd]
push dword [0x486b3c]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x49ffb8
push 5
lea eax, [ebp - 5]
push eax
push dword [0x486b3c]
call sub.kernel32.dll_ReadFile
cmp dword [0x49ffb8], 5
je 0x42c4ee
push 0x479fc0
call fcn.0042c5d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
push 1
push 0
push 0xfffffffffffffffb
push dword [0x486b3c]
call sub.kernel32.dll_SetFilePointer
mov ebx, dword [ebp - 4]
push ebx
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov esi, eax
or esi, esi
jne 0x42c523
push str.Out_of_memory
call fcn.0042c5d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov edi, 0
push 0
push 0x49ffb8
push ebx
push esi
push dword [0x486b3c]
call sub.kernel32.dll_ReadFile
cmp dword [0x49ffb8], ebx
jne 0x42c562
push 0
push 0x49ffbc
push ebx
push esi
push dword [ebp + 0xc]
call sub.kernel32.dll_WriteFile
cmp dword [0x49ffbc], ebx
jne 0x42c562
mov edi, 1
push esi
call sub.kernel32.dll_GlobalFree
cmp edi, 1
jne 0x42c579
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret 8
push str.File_I_O_Error
call fcn.0042c5d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42c9e3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov byte [0x4fb70d], 0
mov byte [0x4fbb45], 0
mov word [0x4fbb38], 0
push dword [ebp + 8]
call fcn.0043de30
cmp eax, 5
jae 0x42ca16
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push dword [ebp + 8]
pop dword [0x4a0c1c]
push 4
push 0x5023d5
push dword [ebp + 8]
call fcn.0043dee0
push 0x5023d5
call fcn.0043de80
mov dword [0x502388], 0
mov dword [0x50238c], 0
mov eax, dword [0x5023d5]
cmp eax, 0x7061742e
jne 0x42ca5f
call fcn.0042d342
jmp 0x42caae
cmp eax, 0x6b6c622e
jne 0x42ca6d
call fcn.0042d342
jmp 0x42caae
cmp eax, 0x787a742e
jne 0x42ca7b
call fcn.0042d342
jmp 0x42caae
cmp eax, 0x7661772e
jne 0x42ca89
call fcn.0042cd83
jmp 0x42caae
cmp eax, 0x7773632e
jne 0x42ca97
call fcn.0042ccc3
jmp 0x42caae
cmp eax, 0x787a702e
jne 0x42caa5
call fcn.0042ceae
jmp 0x42caae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp eax, 1
jne 0x42ccac
call fcn.0040d130
cmp dword [0x4a0c38], 0
jne 0x42caee
push 0x104
push 0x643258
push dword [ebp + 8]
call fcn.0043f85d
push 0x104
push 0x642d44
push dword [ebp + 8]
call fcn.0043f85d
call fcn.0042fc9d
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, 0x8000
je 0x42cb0e
pushal
push str.Flipped_tape_polarity
call fcn.00404bd0
popal
xor byte [0x5023d2], 0x40
cmp byte [0x4c724c], 1
jne 0x42cca7
cmp byte [0x4c7233], 0
jne 0x42cca7
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, 0x8000
jne 0x42cca7
pushal
push str.Autoloading_tape
call fcn.00404bd0
popal
call fcn.00439e8e
push 0xc
call fcn.0041f863
mov byte [0x5016cb], 0
mov byte [0x5016cc], 0
cmp dword [0x50238c], 0
je 0x42cb7c
mov eax, dword [0x50238c]
cmp dword [eax], 0x3000013
jne 0x42cb7c
mov byte [0x5016cc], 1
mov byte [0x4fb6d2], 1
call fcn.0041f9e3
movzx eax, byte [0x4c7230]
cmp eax, 1
je 0x42cb98
or eax, eax
jne 0x42cbbe
mov dword [0x5016c0], 0x47893c
cmp byte [0x5016cc], 1
jne 0x42cca7
mov dword [0x5016c0], 0x47895a
jmp 0x42cca7
cmp eax, 2
jne 0x42cbe9
mov dword [0x5016c0], 0x478941
cmp byte [0x5016cc], 1
jne 0x42cca7
mov dword [0x5016c0], str._n_rload____code_r
jmp 0x42cca7
cmp eax, 3
jne 0x42cc14
mov dword [0x5016c0], 0x478941
cmp byte [0x5016cc], 1
jne 0x42cca7
mov dword [0x5016c0], str._n_rload____code_r
jmp 0x42cca7
cmp eax, 5
je 0x42cc1e
cmp eax, 4
jne 0x42cc3d
mov dword [0x5016c0], str._n_rload__t:__:_load____r
cmp byte [0x5016cc], 1
jne 0x42cca7
mov dword [0x5016c0], str._n_rload__t:__:_load____code_r
jmp 0x42cca7
cmp eax, 6
jne 0x42cc61
mov dword [0x5016c0], 0x478941
cmp byte [0x5016cc], 1
jne 0x42cca7
mov dword [0x5016c0], str._n_rload____code_r
jmp 0x42cca7
cmp eax, 7
jne 0x42cc85
mov dword [0x5016c0], 0x47893c
cmp byte [0x5016cc], 1
jne 0x42cca7
mov dword [0x5016c0], 0x47895a
jmp 0x42cca7
cmp eax, 8
jne 0x42cca7
mov dword [0x5016c0], 0x47893c
cmp byte [0x5016cc], 1
jne 0x42cca7
mov dword [0x5016c0], 0x47895a
mov eax, 1
cmp byte [0x5023d1], 0
je 0x42ccbc
push eax
call fcn.0042e9a0
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42ccc3
Capabilities:
Read file on windows

Disassembly:
call fcn.0042daf6
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [0x4a0c1c]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x42ccec
xor eax, eax
mov dword [0x44d020], eax
cmp dword [0x44d020], 0
jne 0x42ccfd
xor eax, eax
ret
push 0
push 0x49ffb8
push 0x20
push 0x47a178
push dword [0x44d020]
call sub.kernel32.dll_ReadFile
cmp dword [0x49ffb8], 0x20
jne 0x42d755
cmp dword [0x4a0c38], 0
jne 0x42cd41
push 0x104
push 0x643c80
push dword [0x4a0c1c]
call fcn.0043f85d
mov dword [0x502384], 0
mov edi, dword [0x4a0bc0]
mov dword [edi], 0x47a177
add edi, 4
xor eax, eax
mov dword [edi], eax
push dword [0x4a0c1c]
call sub.csw.dll_OpenCSW
mov dword [0x502370], eax
or eax, eax
jne 0x42cd77
jmp 0x42d755
mov byte [0x4fb443], 4
jmp 0x42d6d4

Function at 0x42cd83
Capabilities:
Read file on windows

Disassembly:
call fcn.0042daf6
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push dword [0x4a0c1c]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x42cdac
xor eax, eax
mov dword [0x44d020], eax
cmp dword [0x44d020], 0
jne 0x42cdbd
xor eax, eax
ret
push 0
push 0x49ffb8
push 0x2c
push 0x47a13b
push dword [0x44d020]
call sub.kernel32.dll_ReadFile
cmp dword [0x49ffb8], 0x2c
jne 0x42d755
cmp dword [0x4a0c38], 0
jne 0x42ce07
push 0x104
push 0x643b7c
push dword [0x4a0c1c]
call fcn.0043f85d
lea esi, [0x47a13b]
mov ax, word [esi + 0x16]
mov word [0x502494], ax
movzx eax, word [esi + 0x18]
or eax, eax
je 0x42ce29
cmp word [0x502494], 0
jne 0x42ce45
push 0x40
push str.Wave_File_Error
push str.Invalid_WAV_file
push dword [0x49ff24]
call fcn.0043d57a
jmp 0x42d755
push eax
push 0x3567e0
call fcn.0043f770
mov word [0x502496], ax
movzx eax, word [esi + 0x22]
mov dword [0x502484], eax
cmp eax, 8
je 0x42ce85
cmp eax, 0x10
je 0x42ce85
push 0x40
push str.Wave_File_Error
push str.SpecEmu_only_supports_8_bit_and_16_bit_wave_recordings
push dword [0x49ff24]
call fcn.0043d57a
jmp 0x42d755
mov dword [0x502384], 0
mov edi, dword [0x4a0bc0]
mov dword [edi], 0x47a13a
add edi, 4
xor eax, eax
mov dword [edi], eax
mov byte [0x4fb443], 3
jmp 0x42d6d4
Function at 0x42fc02
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push 0x5029a0
call fcn.004012e2
lea esi, [0x5029ac]
xor ebx, ebx
jmp 0x42fc58
mov al, bl
add al, 0x30
mov byte [0x47a96a], al
lea edx, [esi + 0xc]
push 0x502899
push 0x104
push edx
push 0x47a868
push str.File0
push str.Settings
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, 0x5029a0
push esi
push dword [eax + 4]
call fcn.00401317
add esi, 0x110
inc ebx
cmp ebx, 0xa
jb 0x42fc18
pop esi
pop ebx
ret

Function at 0x4304ce
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x481694], 0
push 0
push dword [0x49ff44]
call sub.user32.dll_ShowWindow
ret

Function at 0x4310aa
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00431136
or eax, eax
je 0x431131
mov edi, eax
cmp dword [0x503454], 0
je 0x4310d2
push 0
push dword [0x503454]
call sub.user32.dll_ShowWindow
push dword [edi]
pop dword [0x503454]
call fcn.004311a0
push 1
push dword [0x50346c]
push dword [0x503468]
push dword [0x503464]
push dword [0x503460]
push dword [0x503454]
call sub.user32.dll_MoveWindow
push 5
push dword [0x503454]
call sub.user32.dll_ShowWindow
push dword [0x503454]
call sub.user32.dll_SetFocus
push 0
push dword [ebp + 8]
push 0x130c
push dword [0x503450]
call sub.user32.dll_SendMessageA
pop edi
leave
ret 4
Function at 0x4319e1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov al, byte [0x5036e4]
push eax
call fcn.0043199d
mov eax, dword [0x5036dc]
mov word [ebp - 2], ax
push 0
push 0x49ffbc
push 2
lea eax, [ebp - 2]
push eax
push dword [0x5035c8]
call sub.kernel32.dll_WriteFile
cmp dword [0x5036dc], 0
jbe 0x431a39
push 0
push 0x49ffbc
push dword [0x5036dc]
push 0x5f9664
push dword [0x5035c8]
call sub.kernel32.dll_WriteFile
leave
ret

Function at 0x431a3b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
push ebx
mov byte [ebp - 5], 0
mov dword [ebp - 4], 0xffffffff
xor dh, dh
push 0x100
xor esi, esi
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edi]
inc edi
xor bl, dh
shl bl, 1
adc esi, 0
or bl, bl
jne 0x431a63
dec ecx
jne 0x431a5e
cmp esi, dword [ebp - 4]
jae 0x431a7a
mov dword [ebp - 4], esi
mov byte [ebp - 5], dh
inc dh
dec dword [esp]
jne 0x431a56
add esp, 4
mov al, byte [ebp - 5]
or al, al
je 0x431a97
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor byte [edi], al
inc edi
dec ecx
jne 0x431a91
mov cl, byte [ebp - 5]
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x432541
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push esi
push edi
push ebx
mov dword [0x5036e5], 0
lea eax, [ebp - 8]
push eax
push 0x6446a8
call fcn.0043ec10
or eax, eax
jne 0x43256e
jmp 0x432719
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push 0x6447ac
push 0x6446a8
call fcn.0043f840
push 0x6447ac
call fcn.0043f8e0
push eax
push 0x481b8a
call fcn.0043f840
lea eax, [ebp - 0x10c]
push eax
call fcn.0043df90
lea eax, [ebp - 0x10c]
push eax
call fcn.0043f8e0
push eax
push str.zx7.exe
call fcn.0043f840
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x6446a8
call fcn.0043f2c0
or eax, eax
jne 0x4325ed
push 0x40
push 0x442440
push str.WriteMemoryToFile_failed
push dword [0x49ff24]
call fcn.0043d57a
jmp 0x432719
push 0
push 0x44
push 0x49ff74
call fcn.0043edd0
mov dword [0x49ff74], 0x44
mov word [0x49ffa4], 0xa
lea esi, [0x6446a8]
lea edi, [0x6447ac]
mov byte [ebp - 0x418], 0
push 0x44252a
push edi
push 0x44252a
push 0x44252c
push 0x44252a
push esi
push 0x44252a
push 0x44252c
push 0x44252a
lea eax, [ebp - 0x10c]
push eax
push 0x44252a
lea eax, [ebp - 0x418]
push eax
push 0xb
call fcn.0043deb0
add esp, 0x34
push 0x49ff64
push 0x49ff74
push 0
push 0
push 8
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
or eax, eax
jne 0x4326a4
push 0x40
push 0x442440
push str.CreateProcess_failed
push dword [0x49ff24]
call fcn.0043d57a
jmp 0x432719
push 0xffffffffffffffff
push dword [0x49ff64]
call sub.kernel32.dll_WaitForSingleObject
push dword [0x49ff64]
call sub.kernel32.dll_CloseHandle
push dword [0x49ff68]
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 4]
push eax
push 0x5036e5
push 0x6447ac
call fcn.0043f040
or eax, eax
jne 0x4326e0
jmp 0x432719
mov eax, dword [ebp - 4]
or eax, eax
je 0x4326ec
cmp eax, dword [ebp + 0xc]
jb 0x4326ee
jmp 0x432719
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [0x5036e5]
call fcn.0043efd0
call fcn.00432741
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.00431a3b
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret 0xc
call fcn.00432741
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0043efd0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00431a3b
mov eax, dword [ebp + 0xc]
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x4331b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push esi
push edi
push ebx
mov ebx, 0
cmp ebx, 3
jg 0x433264
mov byte [ebp - 0x108], 0
lea eax, [ebx*2 + 0x485778]
push eax
push str.pacman.6
push str.roms_
push 0x4a0005
lea eax, [ebp - 0x108]
push eax
push 4
call fcn.0043deb0
add esp, 0x18
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x108]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x433243
push 0
push 0x49ffb8
push 0x1000
push dword [ebx*4 + 0x485768]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push 0x1000
push dword [ebx*4 + 0x485768]
call fcn.00424cc5
cmp ax, word [ebx*2 + 0x485780]
jne 0x433275
inc ebx
jmp 0x4331c1
mov byte [0x49ffe2], 1
mov eax, 1
pop ebx
pop edi
pop esi
leave
ret
mov byte [0x49ffe2], 0
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret

Function at 0x433612
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0xc]
add eax, 0x218
push 0x40
push 0x3000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x433643
mov esi, eax
mov eax, 0x4a0110
push esi
push dword [eax + 4]
call fcn.00401317
mov eax, esi
pop esi
leave
ret 8
Function at 0x43ab7b
Capabilities:
Write file on windows

Disassembly:
lea edi, [0x5c9666]
mov al, bl
stosb byte es:[edi], al
movzx eax, bh
mov esi, dword [eax*4 + 0x4fb308]
xor cx, cx
mov dx, 0x4000

Function at 0x43ab95
Capabilities:
Write file on windows

Disassembly:
cmp cx, dx
je 0x43ac11
dec dx
cmp cx, dx
je 0x43ac10
inc dx
mov dword [0x5038c0], esi
mov word [0x5038c4], cx
mov bh, 1
mov al, byte [esi]
inc esi
inc cx
cmp al, byte [esi]
je 0x43abcb
cmp bh, 1
je 0x43abe1
cmp al, 0xed
je 0x43ac00
cmp bh, 5
jae 0x43ac00
jmp 0x43abe1
inc esi
inc cx
inc bh
cmp bh, 0xff
je 0x43ac00
dec esi
dec cx
cmp cx, dx
jb 0x43abb4
dec bh
jmp 0x43abbb
mov esi, dword [0x5038c0]
mov cx, word [0x5038c4]
lodsb al, byte [esi]
stosb byte es:[edi], al
inc cx
cmp al, 0xed
jne fcn.0043ab95
cmp cx, dx
je 0x43ac11
movsb byte es:[edi], byte [esi]
inc cx
jmp fcn.0043ab95
mov bl, al
mov ax, 0xeded
stosw word es:[edi], ax
mov al, bh
stosb byte es:[edi], al
mov al, bl
stosb byte es:[edi], al
jmp fcn.0043ab95
movsb byte es:[edi], byte [esi]
mov eax, edi
sub eax, 0x5c9667
mov edx, eax
cmp byte [0x5038bc], 1
jne 0x43ac3d
push 0
push 0x49ffbc
push edx
push 0x5c9667
push dword [0x5c9660]
call sub.kernel32.dll_WriteFile
jmp 0x43ac5e
mov word [0x5c9664], ax
add edx, 3
push 0
push 0x49ffbc
push edx
push 0x5c9664
push dword [0x5c9660]
call sub.kernel32.dll_WriteFile
ret
Function at 0x43bad2
Capabilities:
Get file size
Log keystrokes via polling

Disassembly:
call fcn.0043a06d
call fcn.0041ce70
mov dword [0x4a0c1c], esi
call fcn.0043ca14
or eax, eax
je 0x43c6d7
mov byte [0x4a0c41], 0
push 0
push dword [0x44d01c]
call sub.kernel32.dll_GetFileSize
mov dword [0x5038e8], eax
mov dword [0x4a0c20], 0x4a0c69
mov dword [0x4a0c24], 0x1b
call fcn.0043ca9f
jne fcn.0043c696
call fcn.0043b9d7
mov al, byte [0x4fb2bb]
and al, 0x80
mov byte [0x4fb2bc], al
mov al, byte [0x4fb2bd]
shr al, 2
and al, 1
mov byte [0x4fb2c0], al
mov byte [0x4fb2c1], al
push dword [0x4fb33c]
pop dword [0x4a0c20]
mov dword [0x4a0c24], 0x4000
call fcn.0043ca9f
jne fcn.0043c696
push dword [0x4fb330]
pop dword [0x4a0c20]
mov dword [0x4a0c24], 0x4000
call fcn.0043ca9f
jne fcn.0043c696
cmp dword [0x5038e8], 0xc01b
jne 0x43bbf4
mov byte [0x4c7230], 1
call fcn.0041cbc0
push dword [0x4fb328]
pop dword [0x4a0c20]
mov dword [0x4a0c24], 0x4000
call fcn.0043ca9f
jne fcn.0043c696
mov bx, word [0x4fb2b6]
call fcn.0040f008
mov word [0x4fb2b8], ax
mov word [0x5013bc], ax
xor ax, ax
call fcn.0040ece0
add word [0x4fb2b6], 2
jmp 0x43bcde
push 0x10
call sub.user32.dll_GetAsyncKeyState
mov cl, byte [0x4c7222]
test ax, 0x8000
je 0x43bc0a
xor cl, 1
cmp cl, 1
jne 0x43bc13
mov al, 2
jmp 0x43bc15
mov al, 6
mov byte [0x4c7230], al
call fcn.0041cbc0
mov dword [0x4a0c20], 0x5c9664
mov dword [0x4a0c24], 0x4004
call fcn.0043ca9f
jne fcn.0043c696
mov al, byte [0x5cd666]
mov byte [0x4fb491], al
call fcn.004188d0
cmp byte [0x4c7222], 0
jne 0x43bc6b
mov al, byte [0x5cd667]
cmp al, 1
jne 0x43bc66
call fcn.0041c680
jmp 0x43bc6b
call fcn.0041c6a0
mov edi, dword [0x4fb380]
lea esi, [0x5c9664]
mov ecx, 0x1000
rep movsd dword es:[edi], dword [esi]
mov ax, word [0x5cd664]
mov word [0x4fb2b8], ax
mov word [0x5013bc], ax
xor al, al
call fcn.0043bcf5
jne fcn.0043c696
mov al, 1
call fcn.0043bcf5
jne fcn.0043c696
mov al, 3
call fcn.0043bcf5
jne fcn.0043c696
mov al, 4
call fcn.0043bcf5
jne fcn.0043c696
mov al, 6
call fcn.0043bcf5
jne fcn.0043c696
mov al, 7
call fcn.0043bcf5
jne fcn.0043c696
call fcn.0043ca80
mov byte [0x4a0c41], 1
mov al, byte [0x4fb43d]
call fcn.004186f9
ret
Function at 0x43cb20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push 0x104
lea eax, [ebp - 0x154]
push eax
push 0x64376c
call fcn.0043f85d
lea eax, [ebp - 0x154]
push eax
call fcn.0043f150
push 0
push 0x4426a0
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0x48644e
push str.Save_Screen
push dword [0x49ff24]
call fcn.0043a154
or eax, eax
je 0x43cc14
push 0x104
push 0x64376c
lea eax, [ebp - 0x154]
push eax
call fcn.0043f85d
push 0x4426a0
push 0x64376c
call fcn.0043f890
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x64376c
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffff
je 0x43cbfd
cmp dword [0x4fa944], 0
jne 0x43cbd9
push dword [0x4fb33c]
pop dword [0x4fa944]
push 0
push 0x49ffbc
push 0x1b00
push dword [0x4fa944]
push dword [ebp - 0x50]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0x50]
call sub.kernel32.dll_CloseHandle
jmp 0x43cc14
push 0x10
push 0x442440
push str.Unable_to_write_SCR_file
push dword [0x49ff24]
call fcn.0043d57a
leave
ret

Function at 0x43d133
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
push 0x6448b0
call sub.kernel32.dll_SetCurrentDirectoryA
push dword [ebp + 8]
call fcn.0043d16f
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
leave
ret 4

Function at 0x43d456
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
call fcn.0043e050
cmp eax, 0x1b00
je 0x43d486
push 0
push 0x442440
push 0x486494
push dword [0x49ff24]
call fcn.0043d57a
leave
ret 4
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x43d4d2
push 0
push 0x49ffb8
push 0x1b00
push dword [0x4fa944]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
call fcn.0040d2c0
jmp 0x43d4e9
push 0
push 0x442440
push str.Error_opening_.SCR_file
push dword [0x49ff24]
call fcn.0043d57a
leave
ret 4

Function at 0x43db50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add dword [ebp + 8], 1
call sub.kernel32.dll_GetCommandLineA
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push eax
call fcn.0043e540
cmp eax, 0
jb 0x43db85
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0
je 0x43db7e
mov eax, 1
jmp 0x43db8f
mov eax, 2
jmp 0x43db8f
cmp eax, 0xffffffff
jne 0x43db8f
mov eax, 3
leave
ret 8