joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c6e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x4ff074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [0x7e7f84], eax
mov eax, dword [eax + 0xb0]
push edi
inc eax
push eax
push 0x554ab0
push 0x558f44
push 0x50
push 0x5549d0
call fcn.0042cda0
mov edi, 7
add esp, 0x14
mov esi, 0x52cdb0
mov dword [ebp - 0x288], edi
mov ebx, 1
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [0x7e7f84]
push ebx
movzx eax, byte [eax + 0xb0]
add eax, 0x41
push eax
push str.shots
push str._s_shot_c_d
lea eax, [ebp - 0x284]
push 0x80
push eax
call fcn.0042cda0
lea eax, [ebp - 0x284]
push eax
push 0xa92828
push str._s_s.dat
lea eax, [ebp - 0x184]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x2c
lea eax, [ebp - 0x184]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x47c7b9
xor al, al
jmp 0x47c7c2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
test al, al
je 0x47c85b
lea eax, [ebp - 0x284]
push eax
push 0xa92828
push str._s_s.dat
lea eax, [ebp - 0x184]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x14
lea eax, [ebp - 0x184]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47c838
push 0
lea eax, [ebp - 0x28c]
push eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x84]
push eax
push str.___s
push 0x50
push esi
call fcn.0042cda0
mov edi, dword [ebp - 0x288]
mov byte [esi + 0xac], 1
jmp 0x47c874
push 0xb0a8c8
push str.___s
push 0x50
push esi
call fcn.0042cda0
mov byte [esi + 0xac], 0
mov esi, dword [esi + 0xcc]
add esp, 0x10
inc ebx
sub edi, 1
mov dword [ebp - 0x288], edi
jne 0x47c740
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
Function at 0x491920
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4ff074]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x7ea98b], 0
push esi
mov esi, ecx
je 0x491949
mov ecx, str.IN_Net_ServerReadLD
call fcn.004bfb10
cmp word [esi], 0x52
jne 0x4919d8
movzx eax, word [esi + 2]
cmp eax, 0x31
jb 0x4919d8
cmp eax, 0x35
jbe 0x49197f
cmp eax, 0x37
jne 0x4919d8
mov ecx, 0xb0b980
call fcn.0042cf70
mov eax, dword [0xa88e4c]
mov byte [eax], 0x10
call fcn.0045b170
jmp 0x4919d8
push 0xb0b980
push 0xa92828
push str._s_s.dat
lea eax, [ebp - 0x108]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0xa88e4c]
mov byte [eax], 0x10
cmp byte [0x7ea8b0], 0xff
jne 0x4919ce
mov byte [0x7ea8b0], 1
mov ecx, 0x5580f0
jmp 0x4919d3
mov ecx, 0x558010
call fcn.00460890
cmp byte [0x7ea98b], 0
je 0x4919eb
mov ecx, str.OUT_Net_ServerReadLD
call fcn.004bfb10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
Function at 0x4a1f60
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [0xa91e1c]
mov edx, 0x2a6
push esi
xor esi, esi
mov word [0xa88898], ax
mov byte [0x9eaf02], cl
mov word [0x7d51e8], si
lea eax, [edx + 1]
test cl, cl
jne 0x4a1fa8
mov dword [0x7d51e0], 0x29502a1
mov dword [0x7d51e4], 0x2a70295
mov dword [0x7d51fc], 0x2a702a4
jmp 0x4a1fe5
cmp byte [0x7e8120], 1
jne 0x4a1fc7
mov dword [0x7d51e0], 0x2940294
mov dword [0x7d51e4], 0x2a70294
jmp 0x4a1fdb
mov dword [0x7d51e0], 0x2920293
mov dword [0x7d51e4], 0x2a70292
mov dword [0x7d51fc], 0x2a702a6
xor esi, esi
mov dword [0x7d51f8], 0x2a702a7
mov word [0x7d5200], si
cmp dword [0x7e8110], esi
jne 0x4a202c
cmp byte [0x7e8029], 7
je 0x4a202c
mov si, word [0x7d1098]
cmp si, ax
je 0x4a202c
cmp si, dx
je 0x4a202c
test cl, cl
mov eax, 0x29e
cmove dx, ax
mov word [0x7d1098], dx
pop esi
jmp fcn.00411a30
Function at 0x4bd0c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x4ff074]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
movzx edi, cx
cmp dword [edi*4 + 0xa897d0], 0
lea ebx, [edi*4 + 0xa897d0]
je 0x4bd122
mov eax, dword [edi*4 + 0xa89be0]
test eax, eax
je 0x4bd110
push eax
call fcn.004d68ce
add esp, 4
mov dword [edi*4 + 0xa89be0], 0
mov ecx, dword [ebx]
test ecx, ecx
je 0x4bd11c
mov eax, dword [ecx]
push ecx
call dword [eax + 0x48]
mov dword [ebx], 0
lea eax, [edi - 9]
cmp eax, 0x17
ja case.0x4bd131.11
movzx eax, byte [eax + 0x4bd310]
jmp dword [eax*4 + 0x4bd300]
mov cl, byte [0x7ea8f7]
inc cl
jmp 0x4bd150
mov cl, byte [0x7ea952]
jmp 0x4bd150
mov cl, byte [0x7ea968]
test cl, cl
movzx eax, cl
mov edx, 1
cmove eax, edx
movzx eax, al
push eax
mov eax, edi
shl eax, 7
add eax, 0xb1eee0
push eax
push str.audio_s_d.dat
lea eax, [esp + 0x24]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x14
jmp 0x4bd1a7
mov eax, edi
shl eax, 7
add eax, 0xb1eee0
push eax
push str.audio_s.dat
lea eax, [esp + 0x20]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4bd20d
lea eax, [esp + 0x18]
push eax
push str.SFX:_Failed_reading_file__s
lea eax, [esp + 0x120]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x10
lea ecx, [esp + 0x118]
call fcn.004bfb10
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [esp + 0x10]
call fcn.004d68c5
mov edx, dword [esp + 0x14]
add esp, 4
mov ecx, eax
mov dword [esp + 0xc], eax
push 0xc
push esi
call fcn.0042d590
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi*4 + 0xa89be0], 0
mov ecx, dword [esp + 0x10]
lea eax, [ecx - 0x2c]
mov dword [edi*4 + 0xa89b40], eax
jne 0x4bd26d
push eax
call fcn.004d68c5
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [edi*4 + 0xa89be0], eax
mov edx, dword [esp + 0xc]
lea eax, [edi + edi*8]
lea esi, [eax*2 + 0xa89870]
lea eax, [ecx - 0x2c]
push eax
movups xmm0, xmmword [edx + 0x14]
lea eax, [edx + 0x2c]
push eax
push dword [edi*4 + 0xa89be0]
movups xmmword [esi], xmm0
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esp + 0xc]
call fcn.004d68ce
mov eax, dword [0xa89168]
add esp, 4
mov ecx, dword [eax]
push 0
push 0
push 0
push ecx
mov dword [esp], 0x40000000
push 0
push esi
push ebx
push eax
call dword [ecx + 0x20]
test eax, eax
jns 0x4bd2e7
mov ecx, str.SFX:_Error_creating_source_voice
call fcn.004bfb10
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x21c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
Function at 0x4bd5c0
Capabilities:
Write file on windows

Disassembly:
movzx eax, byte [0xa88b6a]
push esi
push edi
push 0xa8911c
mov eax, dword [eax*4 + 0xa89114]
add eax, dword [0xa8905c]
push 1
push 2
push 0
push 0x1000
push eax
push 0xa89c80
call fcn.004d62e0
mov esi, dword [0xa8905c]
mov edi, eax
add esi, edi
add esp, 0x1c
mov dword [0xa8905c], esi
cmp esi, 0x7c000
ja 0x4bd62e
test edi, edi
je 0x4bd62e
jns 0x4bd78b
mov ecx, str.Music:_Error_in_stream
mov byte [0xa88acf], 0
call fcn.004bfb10
pop edi
pop esi
jmp fcn.004bdf10
cmp byte [0xa88ae6], 0
je 0x4bd708
push 0xffffffffffffffff
push 0xa89c80
call fcn.004d5ca0
mov ecx, 1
add esp, 8
mov word [0xa89154], cx
mov cx, word [eax + 4]
mov word [0xa89156], cx
mov ecx, dword [eax + 8]
mov dword [0xa89158], ecx
mov ecx, dword [eax + 4]
imul ecx, dword [eax + 8]
push 0
push 0
push 0x564420
add ecx, ecx
mov dword [0xa8915c], ecx
mov ax, word [eax + 4]
add ax, ax
mov dword [0xa89162], 0x10
mov word [0xa89160], ax
mov eax, dword [0xa89168]
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x40000000
push 0
push 0xa89154
push 0xa8986c
push eax
call dword [ecx + 0x20]
test eax, eax
jns 0x4bd6c8
pop edi
mov ecx, str.Music:_Error_creating_source_voice
pop esi
jmp fcn.004bfb10
call fcn.004bd330
mov edx, dword [0xa8986c]
test edx, edx
je 0x4bd6f2
movzx eax, word [0xa89b30]
mov ecx, dword [edx]
push 0
push 0x558644
push eax
push edx
call dword [ecx + 0x38]
mov edx, dword [0xa8986c]
mov esi, dword [0xa8905c]
mov byte [0xa88ae6], 0
mov byte [0xa88b9a], 1
jmp 0x4bd70e
mov edx, dword [0xa8986c]
mov cl, byte [0xa88b6a]
movzx eax, cl
xor cl, 1
mov dword [0xa897a8], esi
mov dword [0xa897a4], 0x40
mov byte [0xa88b6a], cl
mov eax, dword [eax*4 + 0xa89114]
mov dword [0xa897ac], eax
mov dword [0xa8905c], 0
test edx, edx
je 0x4bd78e
mov eax, dword [edx]
push 0
push 0xa897a4
push edx
call dword [eax + 0x54]
test eax, eax
js 0x4bd78e
mov ecx, dword [0xa8986c]
test ecx, ecx
je 0x4bd76f
mov eax, dword [ecx]
push 0
push 0
push ecx
call dword [eax + 0x4c]
inc byte [0xa88ace]
test edi, edi
jne 0x4bd78b
mov al, byte [0xa88b6e]
and al, 1
neg al
sbb al, al
add al, 2
mov byte [0xa88b6b], al
pop edi
pop esi
ret
mov ecx, str.Audio:_Error_submitting_source_buffer
call fcn.004bfb10
pop edi
pop esi
jmp fcn.004bdf10
Function at 0x4bd800
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4ff074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xa89c80
mov bh, dl
mov dword [ebp - 0x118], 0x4bd7a0
mov bl, cl
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], fcn.004bd7f0
mov dword [ebp - 0x10c], 0
mov dword [0xa891a8], 0
call fcn.004d5ba0
movsx eax, byte [0x4ff8da]
add esp, 4
movzx ecx, bl
cmp ecx, eax
je 0x4bd932
shl ecx, 7
lea eax, [ebp - 0x108]
add ecx, 0xb1e9e0
push ecx
push str.audio_s.dat
push 0x80
push eax
call fcn.0042cda0
mov eax, dword [0xa891ac]
add esp, 0x10
test eax, eax
je 0x4bd8a9
push eax
call fcn.004d68ce
add esp, 4
mov dword [0xa891ac], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4bd8eb
mov ecx, str.Music:_Failed_reading_music_file
call fcn.004bfb10
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x120]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0x120]
push eax
mov dword [0xa891a4], eax
call fcn.004d68c5
mov edx, dword [0xa891a4]
add esp, 4
mov ecx, eax
mov dword [0xa891ac], eax
push 0xd
push esi
call fcn.0042d590
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x4ff8da], bl
movups xmm0, xmmword [ebp - 0x118]
sub esp, 0x10
mov eax, esp
push 0
push 0
push 0xa89c80
push 0xa891a4
movups xmmword [eax], xmm0
call fcn.004d5ce0
add esp, 0x20
test eax, eax
je 0x4bd977
mov ecx, str.Music:_Cant_open_callbacks
call fcn.004bfb10
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
mov byte [0xa88b6e], bh
xor ecx, ebp
mov dword [0xa8905c], 0
mov byte [0xa88acf], 1
mov dword [0xa8911c], 0
mov byte [0xa88b6b], 0
pop ebx
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
Function at 0x4bdab0
Capabilities:
Create thread

Disassembly:
mov cl, byte [0xa88acf]
test cl, cl
je 0x4bdb21
mov al, byte [0xa88ace]
cmp al, 2
jae 0x4bdb21
cmp byte [0xa88c26], 1
jbe 0x4bdafa
cmp byte [0xa88b77], 0
jne 0x4bdb21
push 0
push 0
push 0
push 0x4bd9c0
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4bdb21
mov byte [0xa88b77], 1
jmp 0x4bdb21
push esi
xor esi, esi
nop dword [eax]
test cl, cl
je 0x4bdb20
cmp al, 2
jae 0x4bdb20
call fcn.004bd5c0
inc esi
cmp esi, 2
jae 0x4bdb20
mov cl, byte [0xa88acf]
mov al, byte [0xa88ace]
jmp 0x4bdb00
pop esi
cmp byte [0xa88b9a], 0
je 0x4bdbd7
movss xmm0, dword [0xa89058]
movss xmm3, dword [0xa8901c]
ucomiss xmm0, xmm3
lahf
test ah, 0x44
jnp 0x4bdbd1
movss xmm1, dword [0xa91980]
movaps xmm2, xmm0
mulss xmm1, dword [0x4fc020]
subss xmm2, xmm3
movaps xmm4, xmm1
xorps xmm4, xmmword [0x4fd2b0]
comiss xmm2, xmm4
jbe 0x4bdb7b
comiss xmm1, xmm2
jbe 0x4bdb7b
movaps xmm0, xmm3
jmp 0x4bdb8f
comiss xmm2, xmm1
jb 0x4bdb86
subss xmm0, xmm1
jmp 0x4bdb8f
comiss xmm4, xmm2
jb 0x4bdb97
addss xmm0, xmm1
movss dword [0xa89058], xmm0
ucomiss xmm0, dword [0x4fbf44]
lahf
test ah, 0x44
jp 0x4bdbb0
call fcn.004bdf10
inc dword [0xa89018]
ret
cmp byte [0xa88b72], 0
je 0x4bdbd1
mov ecx, dword [0xa8986c]
test ecx, ecx
je 0x4bdbd1
mov eax, dword [ecx]
push 0
push ecx
movss dword [esp], xmm0
push ecx
call dword [eax + 0x30]
inc dword [0xa89018]
ret
Function at 0x4be2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
movaps xmm5, xmm0
movss xmm4, dword [0xa897c8]
movzx eax, cx
movaps xmm6, xmm1
movss xmm1, dword [0x4fc020]
add ecx, 0x4000
push esi
mov esi, dword [0x7eaeb4]
movss xmm0, dword [eax*4 + 0x94ab20]
movss xmm3, dword [eax*4 + 0x98ab20]
mulss xmm0, xmm1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
addss xmm0, xmm6
movzx eax, cx
mulss xmm3, xmm4
add ecx, 0x4000
movss dword [esi + 4], xmm0
addss xmm3, xmm5
movss xmm0, dword [eax*4 + 0x98ab20]
mulss xmm0, xmm4
movss dword [esi], xmm3
addss xmm0, xmm5
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
movss dword [esi + 0x1c], xmm0
movss xmm0, dword [eax*4 + 0x94ab20]
mov eax, dword [ebp + 8]
mulss xmm0, xmm1
addss xmm0, xmm6
movss dword [esi + 0x20], xmm0
mov dword [esi + 0x48], eax
movss dword [esi + 0x38], xmm5
movss dword [esi + 0x3c], xmm6
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], edx
movzx eax, cx
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
movss xmm0, dword [eax*4 + 0x98ab20]
mulss xmm0, xmm2
mulss xmm0, dword [0x7ea9ac]
addss xmm0, xmm5
movss dword [esi + 0x54], xmm0
movss xmm0, dword [eax*4 + 0x94ab20]
lea eax, [ecx + 0x4000]
mulss xmm0, xmm2
movzx eax, ax
addss xmm0, xmm6
movss dword [esi + 0x58], xmm0
movss xmm0, dword [eax*4 + 0x98ab20]
mulss xmm0, xmm4
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
addss xmm0, xmm5
movss dword [esi + 0x70], xmm0
movss xmm0, dword [eax*4 + 0x94ab20]
mulss xmm0, xmm1
addss xmm0, xmm6
movss dword [esi + 0x74], xmm0
movups xmm0, xmmword [esi + 0x70]
mov eax, dword [esi + 0x88]
movups xmmword [esi + 0x8c], xmm0
movq xmm0, qword [esi + 0x80]
movq qword [esi + 0x9c], xmm0
mov dword [esi + 0xa4], eax
movups xmm0, xmmword [esi + 0x38]
mov eax, dword [esi + 0x50]
movups xmmword [esi + 0xa8], xmm0
movq xmm0, qword [esi + 0x48]
movq qword [esi + 0xb8], xmm0
mov dword [esi + 0xc0], eax
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x18]
movups xmmword [esi + 0xc4], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [esi + 0xd4], xmm0
mov dword [esi + 0xdc], eax
mov ecx, 5
add esi, 0xe0
mov dword [0x7eaeb4], esi
pop esi
pop ebp
jmp fcn.0043bca0
Function at 0x4bf2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp word [0x4ff8dc], 0xffff
movzx eax, word [0x90a948]
movss dword [ebp - 0x14], xmm0
push esi
mov esi, 0xa91380
movss dword [ebp - 0x10], xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
push edi
mov dword [ebp - 8], esi
mulss xmm0, dword [0x4fbfc4]
movss dword [ebp - 0x1c], xmm0
movss xmm0, dword [0x4fc8b4]
divss xmm0, dword [0x7ea9ac]
movss dword [ebp - 0x18], xmm0
je 0x4bf32e
cmp word [0x7eafbc], 0
je 0x4bf313
call fcn.0043bba0
mov eax, dword [0xa91e30]
push 0
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x104]
or eax, 0xffffffff
mov word [0x4ff8dc], ax
mov cl, 2
call fcn.0043bdd0
mov dword [ebp - 0xc], 0x20
nop dword [eax]
movss xmm0, dword [esi + 4]
xorps xmm1, xmm1
mulss xmm0, dword [ebp - 0x10]
addss xmm0, dword [ebp - 0x14]
movss dword [ebp - 4], xmm0
movss xmm0, dword [esi]
comiss xmm1, xmm0
jbe 0x4bf367
xorps xmm0, xmmword [0x4fd2b0]
mulss xmm0, dword [ebp - 0x18]
cvttss2si eax, xmm0
movzx eax, ax
movss xmm0, dword [eax*4 + 0x94ab20]
mulss xmm0, dword [ebp - 0x1c]
call fcn.004d6c60
mov edx, dword [0x90a8c0]
mov esi, eax
mov ecx, edx
movss xmm1, dword [ebp - 4]
shr ecx, 0x10
movzx edi, cl
mov ecx, edx
imul edi, esi
shr ecx, 8
movzx eax, cl
imul eax, esi
and edi, 0xffffff00
shl edi, 8
or edi, eax
mov eax, edx
and eax, 0xff0000ff
or edi, eax
movzx eax, dl
imul eax, esi
and edi, 0xffffff00
mov esi, dword [ebp - 8]
movss xmm2, dword [esi + 0xc]
movss xmm0, dword [esi]
shr eax, 8
or edi, eax
mov ecx, edi
call fcn.0043f6e0
movss xmm2, dword [esi + 0xc]
mov ecx, edi
mulss xmm2, dword [0x4fc3d4]
movss xmm1, dword [ebp - 4]
movss xmm0, dword [esi]
call fcn.0043f6e0
add esi, 0x10
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], esi
jne 0x4bf340
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4bfa80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ff074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xa92828
push 0x4fbb04
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4bfaef
push 0
lea eax, [ebp - 0x108]
push eax
push 2
push 0x50014c
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
Function at 0x4bfb10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4ff074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, ebx
push edi
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4bfb30
push 0xa92828
push 0x4fbb04
lea eax, [ebp - 0x108]
sub esi, ecx
push 0x80
push eax
sar esi, 1
call fcn.0042cda0
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0x80
push 4
push 0
push 2
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4bfbb3
push 0
lea eax, [ebp - 0x10c]
movzx ecx, si
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
add ecx, ecx
push eax
push ecx
push ebx
push edi
call esi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
push 0x50006c
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
Function at 0x4c0b10
Capabilities:
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4ff074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push eax
push 1
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.Cue_Club_2
lea eax, [ebp - 0x104]
push eax
push str._s_s
push 0x80
push 0xa92828
call fcn.0042cda0
add esp, 0x14
push 0xa92828
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 0x10
je 0x4c0b7d
push 0
push 0xa92828
call ebx
call fcn.004bfa80
mov ecx, str.Cue_Club_2
call fcn.004bfb10
mov ecx, 0xa92828
call fcn.004bfb10
mov esi, str.shots
mov edi, 9
push esi
push 0xa92828
push str._s_s
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.0042cda0
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x4c0bdc
push 0
lea eax, [ebp - 0x104]
push eax
call ebx
add esi, 0x40
sub edi, 1
jne 0x4c0ba0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d66b5
mov esp, ebp
pop ebp
ret

Function at 0x4c0dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4ff074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push 0xb209c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c0efd
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0xb20900
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c0ed2
cmp byte [0x7ea8b0], 0xff
jne 0x4c0e90
mov edx, dword [ebp - 0x22]
xor cl, cl
mov si, word [ebp - 0x24]
nop
movzx eax, cl
lea eax, [eax + eax*2]
add eax, eax
cmp si, word [eax + 0x5587f0]
jne 0x4c0e5a
cmp dx, word [eax + 0x5587f2]
je 0x4c0e63
inc cl
cmp cl, 0xa
jb 0x4c0e40
jmp 0x4c0e6e
mov byte [0x7ea8b0], cl
cmp cl, 0xff
jne 0x4c0e90
mov ecx, str.Installation_error
call fcn.004bfb10
mov byte [0xa88c22], 5
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
call fcn.0045a580
push 1
push dword [0xa91984]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0xa91984]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0xa88e4c]
mov byte [eax + 1], 0x2f
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, str.Installation_error
call fcn.004bfb10
mov byte [0xa88c22], 4
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
mov ecx, str.Installation_error
call fcn.004bfb10
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
mov byte [0xa88c22], 3
pop esi
call fcn.004d66b5
mov esp, ebp
pop ebp
ret
Function at 0x4d3a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
cmp edi, 8
jl 0x4d3aff
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
shl edx, 8
or edx, eax
xor ecx, edx
mov eax, ecx
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x4ebef0]
xor edx, dword [eax*4 + 0x4ebaf0]
mov eax, ecx
shr eax, 0x18
xor edx, dword [eax*4 + 0x4ec2f0]
movzx eax, byte [esi + 6]
xor edx, dword [eax*4 + 0x4eaaf0]
movzx eax, byte [esi + 5]
xor edx, dword [eax*4 + 0x4eaef0]
movzx eax, byte [esi + 7]
xor edx, dword [eax*4 + 0x4ea6f0]
movzx eax, byte [esi + 4]
add esi, 8
xor edx, dword [eax*4 + 0x4eb2f0]
movzx eax, cl
xor edx, dword [eax*4 + 0x4eb6f0]
mov ecx, edx
sub ebx, 1
jne 0x4d3a70
pop ebx
test edi, edi
je 0x4d3b1f
movzx eax, byte [esi]
lea esi, [esi + 1]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
xor edx, eax
xor ecx, dword [edx*4 + 0x4ea6f0]
sub edi, 1
jne 0x4d3b03
pop edi
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x402a3d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x446790]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402ad1
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a8e
cmp dword [ebp + 0x10], ebx
jne 0x402ac5
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a3d
test eax, eax
jne 0x402aa0
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a75
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00405ea3
cmp eax, ebx
je 0x402ad8
push ebx
push dword [0x446790]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ad1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x446790], ebx
jne 0x402ace
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ace
jmp 0x402ad1