joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467530
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov dword [esp + 8], 4
push ebx
push esi
mov ebx, dword [esp + 0x11c]
push edi
push ebp
mov edi, ecx
push 0x5c
add edi, 0x574
push ebx
call fcn.004bf700
add esp, 8
mov ebp, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebp, ebp
je 0x4675f9
mov edi, 0x4e19ac
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x20]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x20]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x5c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x24]
lea ebx, [ebp + 1]
push eax
call fcn.004bf700
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x20019
push 0
push ecx
push 0x80000002
call ebp
test eax, eax
jne 0x46764f
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46764f
mov eax, dword [esp + 0x1c]
cmp eax, 4
jne 0x46764f
cmp dword [esp + 0x10], 1
sbb eax, eax
inc eax
jmp 0x467656
mov eax, dword [esp + 0x128]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x110
ret 8
Function at 0x467680
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
push ebx
push esi
push edi
push ebp
mov edi, ecx
push 0x5c
mov ebp, dword [esp + 0x120]
add edi, 0x574
push ebp
call fcn.004bf700
add esp, 8
mov ebx, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
je 0x467741
mov edi, 0x4e19ac
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x18]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x18]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x5c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
lea ebp, [ebx + 1]
push eax
call fcn.004bf700
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46779a
mov eax, dword [esp + 0x128]
mov ebx, dword [esp + 0x124]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ebx
push ecx
push 0
push ebp
push eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call ebp
test eax, eax
jne 0x4677a1
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x4677a1
mov esi, 1
jmp 0x4677c9
mov ebx, dword [esp + 0x124]
mov edi, dword [esp + 0x120]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret 0x10
Function at 0x467930
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
mov dword [esp + 4], 1
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
push ebp
mov edi, ecx
push 0x5c
add edi, 0x574
push ebx
call fcn.004bf700
add esp, 8
mov ebp, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebp, ebp
je 0x4679f9
mov edi, 0x4e19ac
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x5c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x20]
lea ebx, [ebp + 1]
push eax
call fcn.004bf700
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x24]
push 0
push 0xf003f
push 0
push 0x4df418
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x467a45
lea eax, [esp + 0x124]
push 4
mov ecx, dword [esp + 0x14]
push eax
push 4
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x467a4d
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x467a70
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
mov dword [esp + 4], 1
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
push ebp
mov edi, ecx
push 0x5c
add edi, 0x574
push ebx
call fcn.004bf700
add esp, 8
mov ebp, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebp, ebp
je 0x467b39
mov edi, 0x4e19ac
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x5c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x20]
lea ebx, [ebp + 1]
push eax
call fcn.004bf700
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x24]
push 0
push 0xf003f
push 0
push 0x4df418
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x467b85
lea eax, [esp + 0x124]
push 4
mov ecx, dword [esp + 0x14]
push eax
push 4
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x467b8d
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x467bb0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
mov dword [esp + 4], 1
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
push ebp
mov edi, ecx
push 0x5c
add edi, 0x574
push ebx
call fcn.004bf700
add esp, 8
mov ebp, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebp, ebp
je 0x467c79
mov edi, 0x4e19ac
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x5c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x20]
lea ebx, [ebp + 1]
push eax
call fcn.004bf700
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x24]
push 0
push 0xf003f
push 0
push 0x4df418
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x467cd1
mov edx, dword [esp + 0x124]
mov ecx, 0xffffffff
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x10]
push ecx
push edx
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x467cd9
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x467d00
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10c
mov dword [esp + 4], 1
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
push ebp
mov edi, ecx
push 0x5c
add edi, 0x574
push ebx
call fcn.004bf700
add esp, 8
mov ebp, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebp, ebp
je 0x467dc9
mov edi, 0x4e19ac
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x5c
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x20]
lea ebx, [ebp + 1]
push eax
call fcn.004bf700
add esp, 8
mov byte [eax], 0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x24]
push 0
push 0xf003f
push 0
push 0x4df418
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x467e1b
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x10]
push eax
push ecx
push 3
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x467e23
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 0xc
Function at 0x468130
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
mov dword [esp + 8], ecx
push ebx
push esi
xor ebx, ebx
push edi
sub eax, eax
push ebp
lea edi, [ecx + 0x574]
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.DriverInfo
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push 0xf003f
push ebx
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4682ff
lea eax, [esp + 0x11c]
push 0x100
mov ecx, dword [esp + 0x18]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4682ff
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc ebx
mov edi, dword [esp + 0x18]
add edi, 0x574
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.DriverInfo_
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x11c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x1c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4682c4
mov eax, dword [esp + 0x10]
push str.NumberOfModes
push eax
call ebp
mov eax, dword [esp + 0x10]
push str.Modes
push eax
call ebp
mov eax, dword [esp + 0x10]
push str.TextureSizes
push eax
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x11c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x11c]
push 0x100
mov edx, dword [esp + 0x18]
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4681e3
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20c
ret
Function at 0x468436
Capabilities:
Print debug messages

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468615
push eax
mov dword fs:[0], esp
sub esp, 0x31c
push ebx
push esi
push edi
mov esi, ecx
push 0x50
call fcn.0045b6b0
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [ebp - 4], 0
mov edi, eax
mov eax, 0
test edi, edi
je 0x468485
mov eax, dword [0x4e2fdc]
mov ecx, dword [eax + 0x6d4]
push ecx
mov ecx, edi
call fcn.0043b3b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0x48]
mov edx, dword [esi + 0x34]
push ecx
mov ebx, dword [esi + 0x74]
push edx
mov ecx, dword [esi + 0x1c]
push ebx
push ecx
mov ecx, eax
call fcn.0043b4a0
push eax
mov ecx, esi
mov dword [esi + 0x7c], eax
call fcn.004203b0
cmp eax, 1
sbb eax, eax
neg eax
test eax, eax
je 0x4684ed
push str.Runway_Lights_not_loaded._n
lea eax, [ebp - 0x120]
push eax
call fcn.004bd200
add esp, 8
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.viscue.slt
lea eax, [ebp - 0x328]
push str.geometry
push 0x4df954
push eax
call fcn.004bd200
add esp, 0x10
lea eax, [ebp - 0x224]
lea ecx, [ebp - 0x328]
nop
push eax
push ecx
mov ecx, dword [0x4e2fdc]
add ecx, 0x624
call fcn.00429340
push 0xb4
call fcn.0045b6b0
mov dword [ebp - 0x10], eax
add esp, 4
mov edi, eax
mov ecx, 0
mov dword [ebp - 4], 1
test edi, edi
je 0x468562
mov eax, dword [0x4e2fdc]
mov ecx, dword [eax + 0x6d4]
push ecx
mov ecx, edi
call fcn.0043ba10
mov ecx, eax
xor eax, eax
push 0x3f59999a
push 0x3dcccccd
mov dword [ebp - 0x1c], eax
push 0x40400000
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x44]
mov ebx, dword [ebp - 0x14]
push eax
push 0x2d
push edx
mov eax, dword [ebp - 0x18]
push ebx
mov edx, dword [ebp - 0x1c]
push eax
mov ebx, dword [0x4e2fdc]
push edx
lea edx, [ebp - 0x224]
mov eax, dword [ebx + 0x2e0]
mov ebx, dword [esi + 0x48]
push eax
push edx
mov eax, dword [ebx + 0x38]
mov edx, dword [esi + 0x74]
push eax
mov ebx, dword [esi + 0x1c]
push edx
push ebx
call fcn.0043baf0
push eax
mov ecx, esi
mov dword [esi + 0x78], eax
call fcn.004203b0
cmp eax, 1
sbb eax, eax
neg eax
test eax, eax
je 0x4685fe
lea eax, [ebp - 0x224]
lea ecx, [ebp - 0x120]
push eax
push str.Visual_Cue___s__not_loaded._n
push ecx
call fcn.004bd200
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
jmp 0x4684d4
mov eax, 1
jmp 0x4684dc
Function at 0x468636
Capabilities:
Print debug messages

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46870d
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push esi
push edi
mov edi, ecx
call fcn.00480b90
lea eax, [ebp - 0x110]
mov ecx, dword [0x4e2fdc]
push eax
push 0x913
call fcn.004733a0
push 0xcc
call fcn.0045b6b0
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [ebp - 4], 0
mov esi, eax
mov eax, 0
test esi, esi
je 0x46869a
push 1
mov ecx, esi
call fcn.00424bb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
mov edx, dword [edi + 0x34]
push ecx
mov ebx, dword [edi + 0x1c]
push pe_nt_image_headers32
mov ecx, eax
push 0
push 0x40400000
push edx
push ebx
call fcn.00424cc0
push eax
mov ecx, edi
mov dword [edi + 0x80], eax
call fcn.004203b0
cmp eax, 1
sbb eax, eax
neg eax
test eax, eax
je 0x4686fd
push str.Drop_Text_Overlay_not_created._n
lea eax, [ebp - 0x90]
push eax
call fcn.004bd200
add esp, 8
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0xc]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470270
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0xa0
cmp eax, 1
nop
push ebx
push esi
push edi
jne 0x47028a
mov edi, str.TRUE
jmp 0x47028f
mov edi, str.FALSE
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x5c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0xbc]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x5c]
push eax
mov eax, dword [esp + 0xb8]
push 0x50
push ecx
push edx
mov ecx, dword [esp + 0xc0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0xc]
cmp al, 0x59
je 0x4702fe
cmp al, 0x79
je 0x4702fe
cmp al, 0x54
je 0x4702fe
cmp al, 0x74
je 0x4702fe
cmp al, 0x31
je 0x4702fe
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xa0
ret
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xa0
ret

Function at 0x470310
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x80
lea ecx, [esp]
push ebx
mov edx, dword [esp + 0x8c]
push eax
mov eax, dword [esp + 0x8c]
push pe_nt_image_headers32
push ecx
push str.NONE
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 4]
mov ecx, str.NONE
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47036a
or dl, dl
je 0x470366
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47036a
add eax, 2
add ecx, 2
or dl, dl
jne 0x47034a
xor eax, eax
jmp 0x47036f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x470382
fld qword [esp + 0x90]
pop ebx
add esp, 0x80
ret
lea eax, [esp + 4]
push eax
call fcn.004bd7d0
add esp, 4
pop ebx
add esp, 0x80
ret

Function at 0x4703a0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x1cc
push ebx
push esi
push edi
push 0x4e19ac
mov edi, dword [esp + 0x1f4]
push edi
call fcn.004bfc10
add esp, 8
test eax, eax
jne 0x4703f2
lea eax, [esp + 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x110]
push edi
lea eax, [esp + 0x10]
push ecx
push 0x4df954
push eax
call fcn.004bd200
add esp, 0x10
jmp 0x470413
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x1ec]
mov edx, dword [esp + 0x1e8]
push eax
mov eax, dword [esp + 0x1e8]
push ecx
mov ecx, dword [esp + 0x1e8]
push edx
mov edx, dword [esp + 0x1e8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
pop ebx
add esp, 0x1cc
ret
Function at 0x470450
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x1cc
push ebx
push esi
push edi
push 0x4e19ac
mov edi, dword [esp + 0x1ec]
push edi
call fcn.004bfc10
add esp, 8
test eax, eax
jne 0x4704a2
lea eax, [esp + 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x110]
push edi
lea eax, [esp + 0x10]
push ecx
push 0x4df954
push eax
call fcn.004bd200
add esp, 0x10
jmp 0x4704c3
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x1e4]
mov edx, dword [esp + 0x1e0]
push eax
mov eax, dword [esp + 0x1e0]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
pop ebx
add esp, 0x1cc
ret

Function at 0x4704f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x1cc
push ebx
push esi
push edi
push 0x4e19ac
mov edi, dword [esp + 0x1ec]
push edi
call fcn.004bfc10
add esp, 8
test eax, eax
jne 0x470542
lea eax, [esp + 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x110]
push edi
lea eax, [esp + 0x10]
push ecx
push 0x4df954
push eax
call fcn.004bd200
add esp, 0x10
jmp 0x470563
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x1e4]
mov edx, dword [esp + 0x1e0]
push eax
mov eax, dword [esp + 0x1e0]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
add esp, 0x1cc
ret