joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421500
Capabilities:
Set registry value

Disassembly:
sub esp, 0x1c
mov eax, dword [sym.imp.msvcr80.dll___argc]
cmp dword [eax], 1
mov dword [esp], 1
jle 0x421748
push ebp
mov ebp, dword [sym.imp.advapi32.dll_RegSetValueExA]
push esi
push edi
mov edi, dword [sym.imp.msvcr80.dll__stricmp]
jmp 0x421530
mov ecx, dword [sym.imp.msvcr80.dll___argv]
mov eax, dword [esp + 0xc]
mov edx, dword [ecx]
mov esi, dword [edx + eax*4]
mov al, byte [esi]
cmp al, 0x2d
je 0x421571
cmp al, 0x2f
je 0x421571
cmp byte [0x440660], 0
jne 0x421712
mov edx, 0x440660
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x421560
jmp 0x42172c
add esi, 1
push str.window
push esi
call edi
add esp, 8
test eax, eax
jne 0x4215dd
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push 0xf003f
push eax
push 0x4289ea
push eax
push str.SoftwareLucasArtsLoom
push 0x80000001
mov dword [esp + 0x3c], eax
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x42172c
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.WindowFullScreen
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x42172c
push str.fullscreen
push esi
call edi
add esp, 8
test eax, eax
jne 0x42164c
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0x4289ea
push 0
push str.SoftwareLucasArtsLoom
push 0x80000001
mov dword [esp + 0x40], 1
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x42172c
push 4
lea edx, [esp + 0x20]
push edx
push 4
push eax
mov eax, dword [esp + 0x24]
push str.WindowFullScreen
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x42172c
push str.nosmooth
push esi
call edi
add esp, 8
test eax, eax
jne 0x42166e
push eax
push str.SmoothGraphics
call fcn.00424f10
add esp, 8
jmp 0x42172c
push str.smooth
push esi
call edi
add esp, 8
test eax, eax
jne 0x421691
push 1
push str.SmoothGraphics
call fcn.00424f10
add esp, 8
jmp 0x42172c
push str.noswitchres
push esi
call edi
add esp, 8
test eax, eax
jne 0x4216b0
push eax
push str.SwitchResolutions
call fcn.00424f10
add esp, 8
jmp 0x42172c
push str.switchres
push esi
call edi
add esp, 8
test eax, eax
jne 0x4216d0
push 1
push str.SwitchResolutions
call fcn.00424f10
add esp, 8
jmp 0x42172c
push str.nofixaspect
push esi
call edi
add esp, 8
test eax, eax
jne 0x4216ef
push eax
push str.FixAspectRatio
call fcn.00424f10
add esp, 8
jmp 0x42172c
push str.fixaspect
push esi
call edi
add esp, 8
test eax, eax
jne 0x42170f
push 1
push str.FixAspectRatio
call fcn.00424f10
add esp, 8
jmp 0x42172c
add esi, 0xffffffff
push esi
push str.__s__is_not_a_recognized_command_line_switch
push 1
mov eax, 0x15b8
call fcn.00424f70
add esp, 0xc
call fcn.004231f0
mov eax, dword [esp + 0xc]
mov edx, dword [sym.imp.msvcr80.dll___argc]
add eax, 1
cmp eax, dword [edx]
mov dword [esp + 0xc], eax
jl 0x421530
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x421750
Capabilities:
Check os version
Execute anti-debugging instructions

Disassembly:
sub esp, 0xac
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
xor ecx, ecx
cmp dword [esp + 0x34], 1
setne cl
mov dword [0x48e680], ecx
pushal
mov eax, 1
cpuid
mov dword [esp + 0x30], eax
popal
mov eax, dword [esp + 0x10]
shr eax, 8
and eax, 0xf
cmp eax, 5
jae 0x4217c1
push eax
push str.CPUID___d
push 0xa
mov eax, 0x15b1
call fcn.00424f70
add esp, 0xc
jmp 0x421877
mov edi, dword [sym.imp.kernel32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.kernel32.dll_GetThreadPriority]
push 0xf
mov ebp, eax
call edi
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push 0
call dword [sym.imp.kernel32.dll_Sleep]
mov ebx, dword [sym.imp.winmm.dll_timeGetTime]
call ebx
mov esi, eax
add esi, 1
call ebx
cmp eax, esi
jb 0x4217f2
push eax
push edx
rdtsc
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
pop edx
pop eax
add esi, 0x64
lea esp, [esp]
call ebx
cmp eax, esi
jb 0x421810
push eax
push edx
rdtsc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
pop edx
pop eax
push ebp
call edi
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push 0
call dword [sym.imp.kernel32.dll_Sleep]
mov edx, dword [esp + 0x14]
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
sbb eax, dword [esp + 0x20]
push 0
push 0x186a0
push eax
push edx
call fcn.00427e00
cmp eax, 0x3c
mov dword [0x4f2864], eax
jge 0x421875
push eax
push str.Speed___d_MHz
push 0xa
mov eax, 0x15b2
call fcn.00424f70
add esp, 0xc
jmp 0x421877
xor eax, eax
mov ecx, dword [esp + 0xb8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004274fa
add esp, 0xac
ret
Function at 0x421890
Capabilities:
Get disk information
Set current directory

Disassembly:
sub esp, 0x210
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20c], eax
cmp byte [0x440660], 0
push ebx
mov ebx, dword [sym.imp.msvcr80.dll_sprintf]
push ebp
mov ebp, dword [sym.imp.msvcr80.dll_fopen]
push edi
je 0x421965
mov eax, 0x440660
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4218c8
sub eax, edx
cmp byte [eax + 0x44065f], 0x5c
je 0x4218f7
mov edi, 0x440660
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4218e4
mov ax, word [0x428f6c]
mov word [edi], ax
push str.loomdisk01.lec
push 0x440660
lea ecx, [esp + 0x18]
push 0x42892c
push ecx
call ebx
lea edx, [esp + 0x20]
push 0x42856c
push edx
call ebp
add esp, 0x18
test eax, eax
je 0x421965
push eax
call dword [sym.imp.msvcr80.dll_fclose]
push str.loom
push 0x440660
lea eax, [esp + 0x1c]
push 0x42892c
push eax
call ebx
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004274fa
add esp, 0x210
ret
push 0x42856c
push str.loomdisk01.lec
call ebp
add esp, 8
test eax, eax
je 0x4219a7
push eax
call dword [sym.imp.msvcr80.dll_fclose]
add esp, 4
push str.loom
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004274fa
add esp, 0x210
ret
push esi
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.kernel32.dll_GetDriveTypeA]
mov dword [esp + 0x10], eax
xor esi, esi
lea ebx, [ebx]
mov eax, dword [esp + 0x10]
mov edx, 1
mov ecx, esi
shl edx, cl
test eax, edx
je 0x421a22
lea ecx, [esi + 0x41]
push ecx
lea edx, [esp + 0x11c]
push str._c:_
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x118]
push eax
call edi
cmp eax, 5
jne 0x421a22
push str.loomdisk01.lec
lea ecx, [esp + 0x11c]
push ecx
lea edx, [esp + 0x1c]
push 0x42892c
push edx
call ebx
lea eax, [esp + 0x24]
push 0x42856c
push eax
call ebp
add esp, 0x18
test eax, eax
jne 0x421a5c
add esi, 1
cmp esi, 0x1a
jl 0x4219c0
push str.loomdisk01.lec
push str.Looking_for___s_
push 2
mov eax, 0x15b4
call fcn.00424f70
add esp, 0xc
mov ecx, dword [esp + 0x21c]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004274fa
add esp, 0x210
ret
push eax
call dword [sym.imp.msvcr80.dll_fclose]
push str.loom
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x20]
push 0x42892c
push edx
call ebx
add esp, 0x14
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
xor eax, eax
jmp 0x421a43
Function at 0x421e10
Capabilities:
Create thread

Disassembly:
push 0x48e91c
push 0x440320
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_GetProcessAffinityMask]
mov edx, dword [0x440320]
mov eax, 1
mov dword [0x48e714], eax
xor ecx, ecx
push esi
lea ebx, [ebx]
mov esi, eax
shl esi, cl
test edx, esi
jne 0x421e51
add ecx, eax
cmp ecx, 0x20
jl 0x421e40
jmp 0x421e58
shl eax, cl
mov dword [0x48e714], eax
push eax
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov esi, dword [sym.imp.kernel32.dll_SetThreadAffinityMask]
push eax
call esi
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push 1
mov dword [0x443674], eax
call dword [sym.imp.winmm.dll_timeBeginPeriod]
push 0
push 0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateEventA]
push 0
push 0x21
mov dword [0x48e68c], eax
mov eax, dword [0x48e924]
push 0
push eax
call dword [sym.imp.user32.dll_SetTimer]
push 0x440768
push 0
push 0
push 0x421f70
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
mov dword [0x443664], eax
jne 0x421ee1
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
push eax
push str.CreateThread_game____08X
call esi
push eax
mov eax, 0x15b4
call fcn.00424f70
add esp, 0xc
pop esi
ret
mov ecx, dword [0x48e714]
push ecx
push eax
call esi
xor eax, eax
pop esi
ret
Function at 0x422e70
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [0x48e924]
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x20]
xor eax, eax
cmp esi, dword [0x4405a4]
push edi
setne al
push ecx
mov edi, eax
call dword [sym.imp.user32.dll_IsIconic]
test eax, eax
je 0x422ea1
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x14
ret
cmp dword [0x48e67c], 0
jne 0x422e98
mov dword [0x48e67c], 1
call fcn.00423040
test edi, edi
mov ebx, dword [sym.imp.user32.dll_ShowWindow]
je 0x422ece
mov edx, dword [0x48e924]
push 0
push edx
call ebx
call fcn.004236f0
test edi, edi
mov edi, dword [sym.imp.user32.dll_SetWindowPos]
mov dword [0x4405a4], esi
je 0x422f67
mov eax, dword [0x48e924]
neg esi
sbb esi, esi
and esi, 0xff320000
add esi, 0xce0000
push esi
mov esi, dword [sym.imp.user32.dll_SetWindowLongA]
push 0xfffffffffffffff0
push eax
call esi
mov ecx, dword [0x4405a4]
mov edx, dword [0x48e924]
neg ecx
sbb ecx, ecx
and ecx, 8
push ecx
push 0xffffffffffffffec
push edx
call esi
mov eax, dword [0x48e924]
push 0x27
push 0
push 0
push 0
push 0
push 0
push eax
call edi
mov ecx, dword [0x48e924]
push 3
push 0
push 0
push 0
push 0
push 1
push ecx
call edi
mov edx, dword [0x4405a4]
mov eax, dword [0x48e924]
push 3
push 0
push 0
push 0
neg edx
push 0
sbb edx, edx
push edx
push eax
call edi
cmp dword [0x4405a4], 0
je 0x422f91
mov esi, dword [sym.imp.user32.dll_GetSystemMetrics]
push 4
push 1
call esi
push eax
push 0
call esi
mov ecx, dword [0x48e924]
push eax
push 0
push 0
push 0xffffffffffffffff
push ecx
jmp 0x422fc8
lea esi, [esp + 0x10]
call fcn.004230e0
mov eax, dword [esp + 0x14]
mov edx, dword [0x44353c]
mov ecx, dword [esp + 0x10]
sub edx, eax
add edx, dword [esp + 0x1c]
push 4
push edx
mov edx, dword [0x440ba4]
sub edx, ecx
add edx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [0x48e924]
push ecx
push 0xffffffffffffffff
push eax
call edi
call fcn.00421f80
mov ecx, dword [0x48e924]
push 5
push ecx
call ebx
mov edx, dword [0x48e924]
push 1
push 0
push edx
call dword [sym.imp.user32.dll_InvalidateRect]
call fcn.004233b0
mov esi, eax
test esi, esi
je 0x42300b
cmp dword [0x4405a4], 0
je 0x42300b
push 0
call fcn.00422e70
add esp, 4
mov esi, eax
mov eax, dword [0x48e924]
push eax
call dword [sym.imp.user32.dll_SetFocus]
call fcn.00423040
mov dword [0x48e67c], 0
call fcn.00422e00
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x4245f0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_CreateEventA]
push 0
push 0
mov esi, eax
push 1
lea ebx, [esi + 0x34]
push 0
mov dword [ebx], 0
call edi
test eax, eax
mov dword [esi + 0x38], eax
jne 0x424637
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
push eax
push str.CreateEvent_____08X
call esi
push eax
mov eax, 0x15b6
call fcn.00424f70
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x10]
push 0
push 0
push 1
shr eax, 1
push 0
mov dword [esi + 0x3c], eax
call edi
test eax, eax
mov dword [esi + 0x40], eax
je 0x424615
push 0
push 0
push 1
push 0
call edi
test eax, eax
mov dword [esi + 0x54], eax
je 0x424615
test dword [esi + 0xc], 0x100
lea edi, [esi + 0x30]
mov dword [edi], 0
je 0x4246b0
mov eax, dword [esi + 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edi
push 0x4282ec
push eax
call edx
test eax, eax
jne 0x4246b0
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push ebx
push 2
push eax
call edx
test eax, eax
je 0x4246b0
push eax
push str.IDirectSoundNotify_SetNotificationPositions_____08X
push eax
mov eax, 0x15b6
call fcn.00424f70
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x50]
push ecx
push 0
push esi
push 0x424290
push 0
push 0
mov dword [esi + 0x44], eax
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x4c], eax
jne 0x4246f6
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
push eax
push str.CreateThread_stream____08X
call esi
push eax
mov eax, 0x15b6
call fcn.00424f70
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov edx, dword [0x48e714]
push edx
push eax
call dword [sym.imp.kernel32.dll_SetThreadAffinityMask]
mov eax, dword [esi + 0x4c]
push 0xf
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x424720
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
xor esi, esi
mov eax, 0x4405a8
cmp dword [eax], 0
je 0x42473a
add eax, 0x5c
add esi, 1
cmp eax, 0x440660
jl 0x424728
cmp esi, 2
je 0x4247fa
imul esi, esi, 0x5c
push 0x5c
add esi, 0x4405a8
push 0
push esi
call sub.msvcr80.dll_memset
add esp, 0xc
cmp dword [0x440ba0], 0
mov dword [esi], 1
jne 0x4247a3
mov ecx, edi
imul ecx, ecx, 0x3e8
mov eax, 0x2f8df18f
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x3e8
push esi
push 0x4243b0
push eax
call fcn.00424a10
lea ecx, [edi + edi]
add esp, 0xc
mov dword [esi + 0x58], eax
mov dword [esi + 0x10], ecx
mov eax, esi
pop esi
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push edi
push edx
push eax
call fcn.00424460
add esp, 0xc
test eax, eax
jne 0x4247e2
mov ecx, dword [esp + 0x10]
push ecx
mov eax, esi
call fcn.004245f0
add esp, 4
test eax, eax
jne 0x4247e2
mov eax, dword [esi + 4]
mov edx, dword [eax]
push 1
push 0
push 0
push eax
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x42479f
push 0x11
mov dword [esi], 0
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4247fa
call fcn.004231f0
xor eax, eax
pop esi
ret
Function at 0x424a10
Capabilities:
Create thread

Disassembly:
push esi
push 0x28
push 0
call dword [sym.imp.msvcr80.dll_realloc]
mov esi, eax
add esp, 8
xor eax, eax
test esi, esi
je 0x424abd
mov dword [esi], eax
mov dword [esi + 4], eax
push edi
mov edi, dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
push eax
mov dword [esi + 0x14], eax
push eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
push eax
mov dword [esi + 0x20], eax
push eax
mov dword [esi + 0x24], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 8], eax
call edi
cmp dword [esi + 8], 0
mov dword [esi + 0xc], eax
pop edi
je 0x424abb
test eax, eax
je 0x424abb
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esi + 0x14], eax
call fcn.00424970
cmp dword [esi + 0x10], 0
je 0x424abb
cmp dword [0x48e680], 0
je 0x424ad8
lea edx, [esi + 4]
push edx
push 0
push esi
push 0x424900
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
mov dword [esi], eax
jne 0x424abf
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.winmm.dll_timeKillEvent]
xor eax, eax
pop esi
ret
mov ecx, dword [0x48e714]
push ecx
push eax
call dword [sym.imp.kernel32.dll_SetThreadAffinityMask]
mov edx, dword [esi]
push 0xf
push edx
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, esi
pop esi
ret
Function at 0x424bc0
Capabilities:
Create directory
Get common file path
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0xc
call fcn.004206d0
test eax, eax
je 0x424bee
push str.SHGetFolderPathA
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x424bee
push esi
push 0
push 0
push 0x801a
push 0
call eax
add esp, 0xc
ret
push ebx
push edi
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
mov ebx, dword [sym.imp.kernel32.dll_CreateDirectoryA]
jne 0x424c85
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
push 0
push str.AppData
push eax
call edi
test eax, eax
jne 0x424c7a
cmp dword [esp + 0x10], 1
jne 0x424c7a
lea ecx, [esp + 0xc]
push ecx
push esi
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x18]
push str.AppData
push eax
mov dword [esp + 0x24], 0x104
call edi
test eax, eax
jne 0x424c7a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
push 0
push esi
call ebx
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
push 0x104
push esi
push str.USERPROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x424ca1
push 0
push esi
call ebx
jmp 0x424cb1
push 0x104
push esi
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x424d2b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x424cb6
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
je 0x424ce3
mov edi, esi
add edi, 0xffffffff
lea ecx, [ecx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x424cd0
mov ax, word [0x428f6c]
mov word [edi], ax
mov eax, esi
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x424ce8
mov ecx, dword [str.Application_Data]
mov dword [eax], ecx
mov edx, dword [0x4299dc]
mov dword [eax + 4], edx
mov ecx, dword [0x4299e0]
mov dword [eax + 8], ecx
mov edx, dword [0x4299e4]
mov dword [eax + 0xc], edx
mov cl, byte [0x4299e8]
push 0
push esi
mov byte [eax + 0x10], cl
call ebx
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
pop edi
mov dword [esi], 0x5c3a43
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x424d40
Capabilities:
Create directory

Disassembly:
cmp byte [0x443540], 0
jne 0x424e49
push ebx
push esi
push edi
mov esi, 0x443540
call fcn.00424bc0
test eax, eax
je 0x424d68
mov dword [0x443540], 0x5c3a63
mov eax, 0x443540
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x424d70
sub eax, edx
cmp byte [eax + 0x44353f], 0x5c
je 0x424da3
mov edi, 0x443540
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x424d90
mov ax, word [0x428f6c]
mov word [edi], ax
mov eax, 0x443540
add eax, 0xffffffff
jmp 0x424db0
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x424db0
mov ecx, dword [str.LucasArts]
mov edx, dword [0x429a00]
mov ebx, dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov dword [eax], ecx
mov cx, word [0x429a04]
push 0
mov dword [eax + 4], edx
push 0x443540
mov word [eax + 8], cx
call ebx
mov edi, 0x443540
add edi, 0xffffffff
lea ecx, [ecx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x424df0
mov dx, word [0x428f6c]
mov word [edi], dx
mov edi, str.GAMELoom
call fcn.00424b50
mov ecx, eax
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x424e10
mov edi, 0x443540
sub eax, ecx
mov esi, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x424e25
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 0x443540
rep movsb byte es:[edi], byte [esi]
call ebx
pop edi
pop esi
pop ebx
mov eax, dword [esp + 4]
push eax
push 0x443540
push str._s_s
push 0x442018
call dword [sym.imp.msvcr80.dll_sprintf]
add esp, 0x10
mov eax, 0x442018
ret

Function at 0x424e70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
lea eax, [esp + 0x18]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareLucasArtsLoom
push 0x80000001
mov dword [esp + 0x1c], ebp
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424ef6
push ebx
mov ebx, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x2c]
push edi
push eax
call ebx
test eax, eax
jne 0x424ee6
mov eax, 4
cmp dword [esp + 0x14], eax
jne 0x424ee6
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
push esi
push edi
push ecx
call ebx
mov esi, 1
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
pop ebx
jne 0x424f00
push ebp
push edi
call fcn.00424f10
add esp, 8
mov eax, dword [esp + 8]
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x424f10
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0x4289ea
push 0
push str.SoftwareLucasArtsLoom
push 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x424f64
mov ecx, dword [esp]
push 4
lea edx, [esp + 0x14]
push edx
push 4
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x424fa0
Capabilities:
Read file on windows

Disassembly:
push 0x42856c
push str.CDDA.SOU
call dword [sym.imp.msvcr80.dll_fopen]
add esp, 8
test eax, eax
mov dword [0x49e944], eax
je 0x424fd2
push eax
push 0x320
push 1
push 0x4d84d8
call dword [sym.imp.msvcr80.dll_fread]
add esp, 0x10
push edi
push 0x425420
push 1
push 0x10
mov edi, 0x4000
call fcn.00424720
add esp, 0xc
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x49e948], eax
mov al, cl
pop edi
ret

Function at 0x425270
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 2
push edi
jmp 0x425290
movzx esi, byte [0x43075b]
add esi, dword [esp + 0x10]
and esi, 0x80000001
jns 0x4252a8
dec esi
or esi, 0xfffffffe
inc esi
imul esi, esi, 0x1cb74
add esi, 0x49edf0
mov eax, dword [esi + 0x1cb64]
mov ecx, dword [esi + 0x1cb68]
sub ecx, eax
xor edx, edx
mov edi, 0x1cb60
div edi
mov eax, edi
add ecx, 0x1cb60
sub eax, edx
cmp ecx, eax
jl 0x4252db
mov ecx, eax
mov eax, 0x6f74ae27
imul ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
imul edi, edi, 0x930
cmp dword [esi + 0x1cb6c], 0
mov dword [esp + 0x14], edi
je 0x4253fe
test edi, edi
je 0x4253fe
lea ecx, [ecx]
mov eax, dword [0x49e944]
test eax, eax
je 0x4253dd
mov ecx, dword [esi + 0x1cb70]
push 0
push ecx
push eax
call dword [sym.imp.msvcr80.dll_fseek]
mov edx, dword [0x49e944]
push edx
push 0x499
push 1
push 0x49e950
call dword [sym.imp.msvcr80.dll_fread]
add esp, 0x1c
test eax, eax
je 0x4253dd
mov eax, dword [esi + 0x1cb64]
xor edx, edx
mov ecx, 0x1cb60
div ecx
mov cl, byte [0x49e950]
mov al, cl
sar al, 4
and al, 0xf
movzx ebx, al
mov edi, 0x49e951
add edx, esi
and cl, 0xf
movzx eax, cl
mov dword [esp + 0x1c], eax
mov eax, 0x24c
movsx bp, byte [edi]
mov ecx, ebx
shl bp, cl
mov ecx, dword [esp + 0x1c]
add edx, 2
add edx, 2
mov word [edx - 4], bp
movsx bp, byte [edi + 1]
shl bp, cl
add edi, 2
sub eax, 1
mov word [edx - 2], bp
jne 0x425386
mov edi, dword [esp + 0x14]
add dword [esi + 0x1cb70], 0x499
add dword [esi + 0x1cb64], 0x930
sub edi, 0x930
test edi, edi
mov dword [esp + 0x14], edi
jne 0x425310
jmp 0x4253fe
test edi, edi
je 0x4253fe
mov eax, dword [esi + 0x1cb64]
xor edx, edx
mov ecx, 0x1cb60
div ecx
push edi
push 0
add edx, esi
push edx
call sub.msvcr80.dll_memset
add esp, 0xc
add dword [esp + 0x10], 1
sub dword [esp + 0x18], 1
jne 0x425290
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4274fa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x427504
repz ret
jmp fcn.0042781f