joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416910
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x94
lea eax, [esp + 8]
push ebx
push esi
mov ebx, ecx
push edi
push ebp
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416b12
mov dword [esp + 0x3c], 0x10
lea eax, [esp + 0x3c]
mov ecx, dword [esp + 0x18]
push eax
push 0x482b88
push 0
push 0
push str.Reconnect
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push 0
push ecx
push 0
mov edx, dword [esp + 0x24]
push 0xf003f
push 0
push str.RoadRash
push 0
push str.IPX_Hosts
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x416b07
xor ebp, ebp
lea eax, [esp + 0x1c]
push 0
lea ecx, [esp + 0x30]
push 0
mov edx, dword [esp + 0x1c]
push 0
mov dword [esp + 0x28], 0x10
push 0
push eax
push ecx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 1
sbb eax, eax
neg eax
test eax, eax
je 0x416afc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
mov edx, dword [esp + 0x14]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416af6
lea eax, [esp + 0x20]
lea ecx, [esp + 0x4c]
mov edx, dword [esp + 0x10]
push eax
mov dword [esp + 0x24], 0x40
push ecx
push 0
push 0
push str.Name
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x8c]
mov eax, dword [esp + 0x10]
push ecx
mov dword [esp + 0x28], 0xa
push edx
push 0
push 0
push 0x467e30
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x96]
mov eax, dword [esp + 0x10]
push ecx
mov dword [esp + 0x2c], 0xe
push edx
push 0
push 0
push str.Node
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x2c]
mov ecx, 0xffffffff
sub eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x40]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00416cb0
mov edx, 0x482b88
lea esi, [esp + 0x2c]
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x416ace
or cl, cl
je 0x416aca
mov cl, byte [edx + 1]
cmp cl, byte [esi + 1]
jne 0x416ace
add edx, 2
add esi, 2
or cl, cl
jne 0x416aae
xor ecx, ecx
jmp 0x416ad3
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x416af6
push 0
push eax
push 0x14e
push 0xfa1
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
lea edx, [esp + 0x3c]
mov ecx, ebx
call fcn.00416b40
inc ebp
jmp 0x416997
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x482b70]
mov ecx, ebx
test eax, eax
setne dl
mov byte [0x482b74], dl
call fcn.00416c20
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x416b40
Capabilities:
Set registry value

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
test esi, esi
je 0x416b93
lea eax, [esi + 0x5a]
lea ecx, [esi + 0x50]
lea edx, [esp + 0x10]
push eax
push ecx
push str._s__s
push edx
call fcn.00455e30
lea ecx, [esp + 0x20]
add esp, 0x10
push ecx
push 0
push 0xc
push 0xfa3
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
cmp esi, 0x482b88
je 0x416bb5
mov edi, 0x482b88
mov ecx, 0x1a
rep movsd dword es:[edi], dword [esi]
jmp 0x416bb5
mov edi, 0x482b88
xor eax, eax
mov ecx, 0x1a
push 0x467614
rep stosd dword es:[edi], eax
push eax
push 0xc
push 0xfa3
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416c0a
mov edi, 0x482b88
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0xc]
push ecx
push 0x482b88
push 1
push 0
push str.Reconnect
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x416cb0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
mov dword [esp + 0x10], ecx
push ebx
push esi
mov ebx, edx
push edi
mov esi, 0xffffffff
push ebp
push 0x6c
call fcn.00455db0
mov dword [esp + 0x18], eax
add esp, 4
test eax, eax
je 0x416e6d
mov ecx, dword [0x482b70]
mov dword [eax + 0x68], ecx
mov cl, byte [esp + 0x28]
mov dword [0x482b70], eax
test cl, cl
je 0x416e25
lea eax, [esp + 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call edi
test eax, eax
jne 0x416e25
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.IPX_Hosts
push ecx
call edi
test eax, eax
jne 0x416e18
xor ebp, ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
mov eax, ebp
inc ebp
push str.Entry_04d
push ebx
call fcn.00455e30
lea ecx, [esp + 0x1c]
mov eax, dword [esp + 0x24]
add esp, 0xc
push ecx
push 0xf003f
push 0
push ebx
push eax
call edi
test eax, eax
jne 0x416d73
mov eax, dword [esp + 0x10]
push eax
call esi
jmp 0x416d40
lea eax, [esp + 0x10]
push 0
push eax
push 0
mov ecx, dword [esp + 0x24]
push 0xf003f
push 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push str.RoadRash
push 0
push ebx
push ecx
call ebp
test eax, eax
jne 0x416e0f
lea edx, [ebx + 0x10]
mov ecx, 0xffffffff
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x10]
push ecx
push edx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0
push str.Name
push eax
call ebp
lea edx, [ebx + 0x50]
mov ecx, 0xffffffff
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x10]
push ecx
push edx
push 1
push 0
push 0x467e30
push eax
call ebp
lea edx, [ebx + 0x5a]
mov ecx, 0xffffffff
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov ecx, dword [esp + 0x18]
push 1
push 0
push str.Node
push ecx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
jmp 0x416e1e
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
push eax
call esi
mov edi, dword [esp + 0x14]
mov esi, ebx
mov ecx, 0x1a
mov edx, 1
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x20]
add ebx, 0x10
mov byte [0x482b74], 1
call fcn.00416c20
mov eax, dword [esp + 0x20]
push ebx
push 0
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x143
push 0xfa1
push eax
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x4175e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call fcn.00417590
mov ebx, eax
test ebx, ebx
je 0x417708
mov esi, 0x482b88
mov edi, ebx
mov ecx, 0x1a
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x417708
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
push 0xf003f
push 0
push str.IPX_Hosts
push ecx
call esi
test eax, eax
jne 0x4176fb
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ecx
call esi
test eax, eax
jne 0x4176ec
mov edi, 0x482b98
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0xc]
push ecx
push 0x482b98
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov edi, 0x482bd8
push 0
push str.Name
push eax
call esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x482bd8
mov ecx, dword [esp + 0x14]
push 1
push 0
mov edi, 0x482be2
push 0x467e30
push ecx
call esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0xc]
push ecx
push 0x482be2
push 1
push 0
push str.Node
push eax
call esi
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
jmp 0x4176f2
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push eax
call esi
jmp 0x417701
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x417710
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x48
mov dword [esp], ecx
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, edx
push 0xfa1
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
mov esi, dword [0x482b70]
cmp esi, edi
je 0x41789b
mov ecx, ebp
lea edx, [esi + 0x10]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x417760
or al, al
je 0x41775c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x417760
add ecx, 2
add edx, 2
or al, al
jne 0x417740
xor eax, eax
jmp 0x417765
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41777a
mov edi, esi
mov esi, dword [esi + 0x68]
test esi, esi
jne 0x41773b
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
push ebp
push 0xffffffffffffffff
push 0x14c
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, eax
test edi, edi
mov eax, dword [esi + 0x68]
je 0x417797
mov dword [edi + 0x68], eax
jmp 0x41779c
mov dword [0x482b70], eax
cmp ebp, 0xffffffff
je 0x417892
push 0
push ebp
push 0x144
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp ebp, eax
jge 0x4177c9
push 0
push ebp
push 0x14e
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4177ff
push 0
test ebp, ebp
je 0x4177df
dec ebp
push ebp
push 0x14e
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4177ff
push 0
push 0x14b
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov byte [0x482b74], 0
call fcn.00416c20
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push 0x3f
push 0xd
push 0xfa1
push ecx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
lea ecx, [esp + 0x18]
call fcn.00417590
mov edx, eax
mov ecx, dword [esp + 0x10]
call fcn.00416b40
lea ecx, [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ecx
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call edi
test eax, eax
jne 0x417892
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
push 0xf003f
push 0
push str.IPX_Hosts
push ecx
call edi
test eax, eax
jne 0x417885
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
jmp 0x41788b
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push eax
call edi
push esi
call fcn.00455d90
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x48
ret
Function at 0x41d970
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
lea eax, [edx - 7]
mov edi, edx
cmp eax, 0x14
ja case.0x41d987.18
xor ecx, ecx
mov cl, byte [eax + 0x41db68]
jmp dword [ecx*4 + 0x41db38]
call fcn.00455eb0
cdq
mov ecx, 6
idiv ecx
inc edx
mov ecx, esi
push edx
mov edx, edi
call fcn.0041d7d0
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Credits
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Main
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Postcard
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Chars_ManoMano
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Street
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Olleys
pop edi
pop esi
pop ebx
ret 4
mov eax, dword [esp + 0x10]
sub eax, 0x80
cmp eax, 0xe
ja case.default.0x41da00
jmp dword [eax*4 + 0x41db80]
mov eax, str.Bikes_Rat_Banzai
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Rat_Corsair
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Rat_Kamikaze
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Rat_Perro
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Rat_Killer
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Sport_Diablo
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Sport_Kamikaze
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Sport_Stiletto
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Sport_DMG
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Sport_Perro
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Super_Banzai
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Super_Diablo
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Super_Stiletto
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Super_Corsair
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Bikes_Super_Kamikaze
pop edi
pop esi
pop ebx
ret 4
mov eax, str.Panzer
pop edi
pop esi
pop ebx
ret 4
cmp esi, 0x19
jne 0x41dacd
mov al, 1
mov cl, byte [0x4b8a11]
dec cl
shl al, cl
mov byte [0x485ce4], al
call fcn.00455eb0
cdq
xor eax, edx
sub eax, edx
and eax, 7
xor eax, edx
sub eax, edx
mov cl, al
mov bl, al
xor edx, edx
mov dl, byte [0x485ce4]
mov eax, 1
shl eax, cl
test eax, edx
jne 0x41dacd
mov al, 1
shl al, cl
mov cl, dl
or cl, al
mov byte [0x485ce4], cl
mov ecx, ebx
call fcn.00420bb0
movsx ecx, al
push ecx
mov cl, bl
inc cl
call fcn.0041bf90
push eax
push str.Chars__s__c
push 0x485cf0
call fcn.00455e30
add esp, 0x10
mov eax, 0x485cf0
pop edi
pop esi
pop ebx
ret 4
Function at 0x41e880
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x144
mov dword [esp + 4], edx
push ebx
push esi
push edi
push ebp
mov esi, ecx
xor edi, edi
push edi
mov eax, edi
inc edi
push 0x4b7f30
lea ecx, [esp + 0x58]
push str._s_Image_03d.BMP
push ecx
call fcn.00455e30
lea eax, [esp + 0x60]
add esp, 0x10
push 0
push eax
call fcn.00461640
add esp, 8
test eax, eax
je 0x41e892
lea eax, [esp + 0x50]
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov edi, eax
je 0x41ea0b
mov eax, dword [esp + 0x15c]
mov ebp, 0
cmp eax, 1
mov eax, dword [esp + 0x158]
adc ebp, 0xffffffff
imul eax, dword [esp + 0x14]
imul eax, esi
cdq
and ebp, 0x400
and edx, 7
add eax, edx
sar eax, 3
lea ecx, [ebp + 0x36]
mov ebx, eax
mov dword [esp + 0x22], ecx
mov word [esp + 0x20], 0
lea eax, [ebx + ecx]
push 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
mov dword [esp + 0x1e], eax
push ecx
mov word [esp + 0x26], 0
mov word [esp + 0x20], 0x4d42
push 0xe
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41ea04
mov cx, word [esp + 0x158]
mov eax, dword [esp + 0x14]
mov word [esp + 0x36], cx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 0x28
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x30], eax
push 0
mov dword [esp + 0x50], 0
mov word [esp + 0x38], 1
mov eax, 1
lea edx, [esp + 0x2c]
shl eax, cl
lea ecx, [esp + 0x14]
mov dword [esp + 0x4c], eax
push ecx
push 0x28
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41ea04
test ebp, ebp
je 0x41e9ed
lea eax, [esp + 0x10]
push 0
mov ecx, dword [esp + 0x160]
push eax
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41ea04
lea eax, [esp + 0x10]
push 0
mov ecx, dword [esp + 0x164]
push eax
push ebx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x144
ret 0xc

Function at 0x41f630
Capabilities:
Print debug messages

Disassembly:
push ebx
mov eax, dword [0x4753b0]
cmp eax, 2
jne 0x41f65c
xor eax, eax
xor ecx, ecx
mov cl, byte [0x4b8a11]
mov byte [0x4b8a12], al
mov byte [0x4b8a13], al
mov ax, word [ecx*2 + 0x469000]
mov dword [0x4b8a18], eax
movsx eax, byte [0x467a6c]
xor ecx, ecx
mov cl, byte [0x4b8a12]
lea edx, [eax + eax*4]
xor eax, eax
mov bl, byte [edx + ecx + 0x4641c8]
mov al, bl
mov byte [0x4b8a14], bl
push eax
push ecx
push str.level__d_bike__d_n
push 0x4c5b50
call fcn.00455e30
add esp, 0x10
push 0x4c5b50
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.004078f0
pop ebx
ret
Function at 0x424080
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 4
cmp eax, dword [0x4c8008]
push ebx
push esi
jne 0x42412d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 8]
mov dword [0x475370], eax
push edx
mov dword [0x475374], ecx
push 0xf003f
push 0
push str.SOFTWAREElectronic_ArtsRoadRash_95
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424107
mov eax, dword [esp + 8]
push 4
push 0x475370
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 3
push 0
push str.Group
push eax
call esi
mov ecx, dword [esp + 8]
push 4
push 0x475374
push 3
push 0
push str.Track
push ecx
call esi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4961f8]
test eax, eax
je 0x424123
mov ecx, dword [eax + 0x24]
test ch, 4
je 0x424123
and ecx, 0x20f00
call fcn.004208d0
xor eax, eax
pop esi
pop ebx
add esp, 4
ret 0xc
mov eax, 1
pop esi
pop ebx
add esp, 4
ret 0xc

Function at 0x424a00
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov eax, dword [ecx + 0x10]
push edi
push ebp
mov esi, ecx
cmp eax, 0xcc
je 0x424a26
mov eax, dword [esi + 0x17c]
call dword [eax]
mov dword [esi + 0x78], 0
mov dword [esi + 0x10], 0xcc
xor ebx, ebx
mov eax, dword [esi + 0x17c]
mov cl, byte [eax + 8]
test cl, cl
je 0x424a91
lea edi, [esi + 0x78]
mov ecx, dword [edi]
mov eax, dword [esi + 0x60]
cmp eax, ecx
jbe 0x424a78
mov eax, dword [esi + 8]
test eax, eax
je 0x424a5c
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 8]
mov dword [ecx + 8], eax
mov ecx, esi
mov ebp, dword [esi + 8]
call dword [ebp]
mov ebp, dword [edi]
push ebx
push edi
mov eax, dword [esi + 0x180]
xor edx, edx
mov ecx, esi
call dword [eax + 4]
cmp dword [edi], ebp
jne 0x424a38
xor al, al
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x17c]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [esi + 0x17c]
mov ecx, esi
call dword [eax]
mov dword [edi], ebx
jmp 0x424a28
mov al, byte [esi + 0x41]
pop ebp
pop edi
cmp al, 1
sbb eax, eax
add eax, 0xce
mov dword [esi + 0x10], eax
mov al, 1
pop esi
pop ebx
ret
Function at 0x42f000
Capabilities:
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
push 0
push 0x8000000
push 4
push 0
push 0
push 0x40000000
push 0x4b8900
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov ebx, eax
je 0x42f0fc
mov edi, 0x497090
xor eax, eax
mov ecx, 0x28
rep stosd dword es:[edi], eax
mov esi, 0x4b8a10
mov edi, 0x497098
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
movsx eax, byte [0x467a6c]
lea ecx, [eax + eax*2]
mov edi, 0x4970b8
mov esi, 0xa
lea eax, [ecx*4 + 0x4c6b40]
mov edx, eax
mov ecx, 3
mov ebp, dword [edx]
add edx, 4
mov dword [edi], ebp
add edi, 4
dec ecx
jne 0x42f070
add eax, 0x204
dec esi
jne 0x42f069
mov ecx, 0x497094
mov edx, 0x9c
mov dword [0x497094], 0xcafedead
call fcn.0042efc0
push 0
mov dword [0x497090], eax
lea eax, [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push 0xa0
push 0x497090
push ebx
call ebp
test eax, eax
jne 0x42f0ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00457b50
add esp, 4
push eax
push 0x4b8900
mov eax, dword [0x475378]
mov ecx, dword [eax + 0x5bc]
push ecx
push 0
call fcn.00443120
add esp, 0x10
jmp 0x42f0f5
mov byte [0x4753ac], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x42f110
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
push 0
push 0x8000000
push 3
push 0
push 0
push connect
push 0x4b8900
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov ebx, eax
je 0x42f25e
lea eax, [esp + 0x10]
push 0
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0xa0
push 0x497090
push ebx
call ebp
test eax, eax
jne 0x42f18d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00457b50
add esp, 4
push eax
push 0x4b8900
mov eax, dword [0x475378]
mov ecx, dword [eax + 0x5c0]
push ecx
push 0
call fcn.00443120
add esp, 0x10
jmp 0x42f257
mov eax, dword [0x497094]
cmp eax, 0xcafedead
je 0x42f1b9
push 0x4b8900
mov eax, dword [0x475378]
mov ecx, dword [eax + 0x5c4]
push ecx
push 0
call fcn.00443120
add esp, 0xc
jmp 0x42f257
mov ecx, 0x497094
mov edx, 0x9c
call fcn.0042efc0
cmp eax, dword [0x497090]
je 0x42f1ed
push 0x4b8900
mov eax, dword [0x475378]
mov ecx, dword [eax + 0x5c8]
push ecx
push 0
call fcn.00443120
add esp, 0xc
jmp 0x42f257
mov esi, 0x497098
call fcn.004078f0
mov edi, 0x4b8a10
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x4b8a11]
mov esi, 0x4970b8
mov edi, 0xa
call fcn.00415fc0
mov byte [0x467a6c], al
movsx eax, al
lea ecx, [eax + eax*2]
lea eax, [ecx*4 + 0x4c6b40]
mov edx, eax
mov ecx, 3
mov ebp, dword [esi]
add esi, 4
mov dword [edx], ebp
add edx, 4
dec ecx
jne 0x42f231
add eax, 0x204
dec edi
jne 0x42f22a
mov ecx, 2
call fcn.00444fb0
mov byte [0x4753ac], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x42f340
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x100
push ebx
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov edi, eax
push 7
push 0x497248
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0xd
push edi
call esi
push 7
push 0x497240
push 0xe
push edi
call esi
mov ecx, edi
call fcn.0042f410
mov ebx, eax
test ebx, ebx
jne 0x42f3fa
and di, 0x3ff
or di, 0x400
and edi, 0xffff
mov ecx, edi
call fcn.0042f410
mov ebx, eax
test ebx, ebx
jne 0x42f3fa
mov ecx, 0x409
call fcn.0042f410
mov ebx, eax
test ebx, ebx
jne 0x42f3b3
mov ecx, 6
xor ebp, ebp
jmp 0x42f3bd
mov ecx, 7
mov ebp, 1
call fcn.0042f270
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.0042f270
push eax
call fcn.00443120
add esp, 8
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x42f410
Capabilities:
Get geographical location

Disassembly:
sub esp, 8
lea eax, [esp]
push ebx
push ebp
push 7
push eax
push 3
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea edx, [esp + 8]
push str..dll
mov ecx, str.Text_
call fcn.00443380
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ebp
pop ebp
pop ebx
add esp, 8
ret

Function at 0x42fb50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, ecx
push ebp
xor edi, edi
mov ebx, 0x497408
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [edi + 0x31]
mov ecx, dword [str.ChatFx]
lea edx, [esp + 0x10]
inc edi
push edx
mov byte [ecx + 5], al
push ebx
mov ecx, dword [str.ChatFx]
push 0
add ebx, 0x3c
mov dword [esp + 0x1c], 0x3c
push 0
push ecx
push esi
call ebp
cmp ebx, 0x4975e8
jb 0x42fb66
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret