joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d584
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x49d615
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xa
push ebx
mov eax, dword [ebp - 4]
call fcn.004058fc
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov esi, eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push esi
call sub.kernel32.dll_LockResource
lea edx, [ebp - 8]
mov ecx, ebx
xchg edx, eax
call fcn.0040555c
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.004054c0
push esi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d61c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405490
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, reloc.msvcrt.dll_wcstol
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x405b50
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
cmp dword [0x621274], 0
jle 0x405bac
xor ebp, ebp
push 0
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov ecx, dword [0x6212a4]
mov dword [ecx + ebp + 0x14], eax
mov eax, dword [0x6212a4]
cmp dword [eax + ebp + 0x14], 0
jne 0x405ba0
push str.cdvd_stream
push str._s:_failed_to_create_sync_semaphore_n
call fcn.0059e460
pop ecx
pop ecx
pop ebp
pop ebx
ret
inc ebx
add ebp, 0x30
cmp ebx, dword [0x621274]
jl 0x405b67
mov eax, dword [0x621274]
inc eax
lea eax, [eax*4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x6212a8], eax
mov eax, dword [0x621274]
inc eax
mov dword [0x6212ac], 0
push str.CdStream
push 5
push 0
push 0
mov dword [0x6212b0], 0
mov dword [0x6212b4], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
test eax, eax
mov dword [0x62129c], eax
jne 0x405c14
push str.cdvd_stream
push str._s:_failed_to_create_stream_semaphore_n
call fcn.0059e460
pop ecx
pop ecx
pop ebp
pop ebx
ret
push 0x6212a0
push 4
push 0
push 0x406140
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x621298], eax
jne 0x405c50
push str.cdvd_stream
push str._s:_failed_to_create_streaming_thread_n
call fcn.0059e460
pop ecx
pop ecx
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
dec eax
push eax
mov eax, dword [0x621298]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x621298]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ebp
pop ebx
ret

Function at 0x405c80
Capabilities:
Get disk size

Disassembly:
push ebx
push ebp
sub esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 8]
push eax
lea eax, [esp + 8]
push ecx
push eax
mov ebx, dword [esp + 0x2c]
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp dword [esp + 4], 0x800
mov dword [0x6212c4], 0
ja 0x405cce
push str.Using_no_buffered_loading_for_streaming_n
or dword [0x6212c4], 0x20000000
call fcn.00405db0
pop ecx
mov eax, dword [esp + 4]
mov dword [0x6212bc], 1
push eax
or dword [0x6212c4], 0x40000000
push 0x800
mov dword [0x6212c0], 0
call fcn.00526fd0
pop ecx
pop ecx
push 0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov dword [0x621270], 0
imul eax, eax, 0x30
mov dword [0x621274], ebx
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
mov dword [0x6212a4], eax
push str.cdvd_stream
push str._s:_read_info__p_n
call fcn.00405db0
add esp, 0xc
push 0x5ec0d0
call fcn.00406270
pop ecx
push 1
push 0
push ebp
push 0
call fcn.00405e40
add esp, 0x10
mov ebx, eax
call fcn.00406300
cmp ebx, 1
jne 0x405d74
mov dword [0x6212c0], 1
push str.Using_async_loading_for_streaming_n
jmp 0x405d97
and dword [0x6212c4], 0xbfffffff
mov dword [0x6212bc], 0
mov dword [0x6212c0], 1
push str.Using_sync_loading_for_streaming_n
call fcn.00405db0
pop ecx
call fcn.00405b50
push ebp
call fcn.00527000
pop ecx
add esp, 0x10
pop ebp
pop ebx
ret
Function at 0x405e40
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
mov edi, dword [esp + 0x1c]
imul edi, edi, 0x30
mov ebx, dword [esp + 0x24]
mov esi, dword [0x6212a4]
mov eax, ebx
add eax, dword [esp + 0x28]
mov dword [0x6212b8], eax
mov eax, ebx
shr eax, 0x18
mov ebp, dword [eax*4 + 0x621278]
push 0
add esi, edi
mov dword [esi + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x6212c0], 0
je 0x405f00
cmp dword [esi + 4], 0
jne 0x405e91
cmp byte [esi + 0xe], 0
je 0x405ea0
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, ebx
mov dword [esi + 0x10], 0
and eax, 0xffffff
mov dword [esi], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 8], eax
mov byte [esi + 0xd], 0
push dword [esp + 0x1c]
push 0x6212a8
call fcn.004060b0
mov eax, dword [0x62129c]
pop ecx
pop ecx
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x405ef1
push str.Signal_Sema_Error_n
call fcn.0059e460
pop ecx
add esp, 8
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
cmp dword [0x6212bc], 0
je 0x405f57
mov edx, ebx
mov eax, dword [0x6212a4]
and edx, 0xffffff
add eax, edi
shl edx, 0xb
mov dword [eax + 0x24], edx
add eax, 0x1c
push eax
mov eax, dword [esp + 0x2c]
shl eax, 0xb
push 0
push eax
push dword [esp + 0x2c]
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov bl, 1
jne 0x405f4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x405f4c
xor bl, bl
movzx eax, bl
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, ebx
and eax, 0xffffff
shl eax, 0xb
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 4]
shl eax, 0xb
push 0
push ecx
push eax
push dword [esp + 0x2c]
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4386c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, ecx
push esi
mov esi, 0x5ee788
push edi
lea edi, [edx + 8]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [edx + 4], 0
mov eax, dword [edx + 4]
mov dword [edx], eax
mov dword [edx + 0x10], 0
xor eax, eax
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
mov dword [edx + 0x28], 0
mov word [edx + 0x2c], 0
mov dword [edx + 0x7c], 0
mov byte [edx + 0x78], 0
mov byte [edx + 0x79], 0
mov byte [edx + 0x7a], 0
movzx ecx, ax
add eax, 6
cmp ax, 0x12
mov dword [edx + ecx*4 + 0x30], 0
mov dword [edx + ecx*4 + 0x34], 0
mov dword [edx + ecx*4 + 0x38], 0
mov dword [edx + ecx*4 + 0x3c], 0
mov dword [edx + ecx*4 + 0x40], 0
mov dword [edx + ecx*4 + 0x44], 0
jb 0x438728
mov word [edx + 0x80], 0
mov byte [edx + 0x82], 0
mov byte [edx + 0x83], 1
mov byte [edx + 0x84], 0
mov byte [edx + 0x85], 0
pop edi
pop esi
ret
Function at 0x452f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x68]
lea edx, [esp + 0x5c]
mov dword [esp + 8], eax
lea eax, [esp + 0x34]
mov dword [esp + 0xc], 0xc47a0000
push 0
push 0
push 1
push 0
push 0
push 0
push 1
push edx
push eax
lea eax, [esp + 0x28]
push dword [0x5efbcc]
push eax
call fcn.004b0de0
mov eax, dword [esp + 0x98]
add esp, 0x2c
fld dword [0x5efbf4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
fadd dword [esp + 0x3c]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x18], 0xc47a0000
push 0
push 0
push 1
push 0
push 0
push 0
push 1
push ecx
push eax
lea eax, [esp + 0x34]
fstp dword [esp + 0x30]
push dword [0x5efbcc]
push eax
call fcn.004b0de0
mov eax, dword [esp + 0xa0]
add esp, 0x2c
fld dword [0x5efbf4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x78]
fadd dword [esp + 0x3c]
lea edx, [esp + 0x5c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x24], 0xc47a0000
push 0
push 0
push 1
push 0
push 0
push 0
push 1
push edx
push eax
lea eax, [esp + 0x40]
fstp dword [esp + 0x3c]
push dword [0x5efbcc]
push eax
call fcn.004b0de0
mov eax, dword [esp + 0xa8]
add esp, 0x2c
fld dword [0x5efbf4]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x80]
fadd dword [esp + 0x3c]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 0xc47a0000
push 0
push 0
push 1
push 0
push 0
push 0
push 1
push ecx
push eax
lea eax, [esp + 0x4c]
fstp dword [esp + 0x48]
push dword [0x5efbcc]
push eax
call fcn.004b0de0
fld dword [0x5efbf4]
fadd dword [esp + 0x68]
movzx eax, word [0x5efbf0]
add esp, 0x2c
fstp dword [esp + 0x30]
push eax
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.004534e0
movzx eax, word [0x5efbf0]
add esp, 0x20
push eax
push eax
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.004534e0
movzx eax, word [0x5efbf0]
add esp, 0x20
push eax
push eax
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
push dword [esp + 0x38]
call fcn.004534e0
movzx eax, word [0x5efbf0]
add esp, 0x20
push eax
push eax
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.004534e0
add esp, 0x20
add esp, 0x60
ret
Function at 0x4ace60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and esp, 0xfffffff8
push str.Initialising_CTimer..._n
call fcn.00405db0
lea eax, [esp + 4]
mov dword [0x8f2c20], 0x3f800000
fld dword [0x8f2c20]
pop ecx
push eax
fstp dword [0x8e2cb4]
mov dword [0x62a320], 0
mov byte [0x95cd7c], 0
mov dword [0x9412e8], 0
mov byte [0x95cdb1], 0
mov dword [0x8f29e4], 0
mov dword [0x885b48], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4acf00
push str.Performance_counter_available_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x3e8
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.005b65e0
push 0x62a310
mov dword [0x5f7610], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x4acf1f
push str.Performance_counter_not_available__using_millesecond_timer_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x5f7610], 0
call fcn.00584890
mov dword [0x9434f4], eax
mov eax, dword [0x8f29e4]
mov ecx, 0x95cdbe
mov dword [0x885b48], eax
mov eax, dword [0x885b48]
push eax
mov dword [0x9412ec], 0
call fcn.0057ccd0
push str.CTimer_ready_n
call fcn.00405db0
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5656f0
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp dword [0x604800], ebx
push esi
push edi
push ebp
jne 0x565707
pop ebp
mov al, 1
pop edi
pop esi
pop ebx
ret
mov dword [0x604800], ebx
call fcn.00565680
cmp dword [0x604800], 0xffffffff
je 0x5658f2
mov ebp, ebx
mov ebx, 0x730118
imul ebp, ebp, 0x54
mov ecx, 0xf
mov edi, str.Dolby_Surround
add ebx, ebp
add ebx, 4
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
movzx edx, byte [esi - 1]
movzx eax, byte [edi - 1]
sub edx, eax
test edx, edx
jne 0x565756
mov dword [0x8f395c], 0x18
jmp 0x565760
mov dword [0x8f395c], 0x1c
mov eax, dword [ebp + 0x730118]
push 0x8f395c
push str.Maximum_supported_samples
push eax
call dword [0x61d5a4]
mov eax, dword [ebp + 0x730118]
push eax
call dword [0x61d5a8]
test eax, eax
je 0x5657a8
or dword [0x604800], 0xffffffff
call dword [0x61d5ac]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.00565680
xor al, al
pop ebp
pop edi
pop esi
pop ebx
ret
mov ecx, 0x19
mov eax, dword [ebp + 0x730118]
mov esi, ebx
mov edi, str.Creative_Labs_EAX_3__TM_
mov dword [0x942fb8], eax
repe cmpsb byte [esi], byte es:[edi]
movzx ecx, byte [esi - 1]
movzx eax, byte [edi - 1]
sub ecx, eax
test ecx, ecx
jne 0x5657e5
mov dword [0x95cb3c], 1
mov dword [0x94304c], 1
jmp 0x56580e
mov eax, dword [0x942fb8]
mov dword [0x94304c], 0
push eax
call dword [0x61d5b0]
cmp eax, 0xffffffff
je 0x565807
mov eax, 1
jmp 0x565809
xor eax, eax
mov dword [0x95cb3c], eax
cmp dword [0x94304c], 0
je 0x565840
push str.DOING_SPECIAL_EAX_3_STUFF_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x942fb8]
push 0x60482c
push str.EAX_all_parameters
push eax
call dword [0x61d5a4]
jmp 0x56587a
cmp dword [0x95cb3c], 0
je 0x56587a
mov eax, dword [0x942fb8]
push 8
push eax
call dword [0x61d5b4]
mov ecx, 0x1f
mov edi, str.Miles_Fast_2D_Positional_Audio
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
movzx edx, byte [esi - 1]
movzx eax, byte [edi - 1]
sub edx, eax
test edx, edx
jne 0x56587a
mov byte [0x95cd6b], 1
mov eax, dword [0x942fb8]
push 0x8f395c
push str.Maximum_supported_samples
push eax
call dword [0x61d5b8]
cmp dword [0x8f395c], 0x1c
jbe 0x5658a3
mov dword [0x8f395c], 0x1c
mov eax, dword [0x8e2a88]
mov ecx, 0x7341e0
push eax
call fcn.00565900
xor esi, esi
jmp 0x5658e3
mov eax, dword [0x942fb8]
push eax
call dword [0x61d5bc]
mov dword [esi*4 + 0x87c648], eax
mov eax, dword [esi*4 + 0x87c648]
test eax, eax
je 0x5658e2
push dword [0x6049a4]
push eax
call dword [0x61d5c0]
inc esi
cmp esi, dword [0x8f395c]
jb 0x5658b7
pop ebp
mov al, 1
pop edi
pop esi
pop ebx
ret
xor al, al
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x565900
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, edx
mov dword [esp + 4], ecx
cmp eax, 2
ja case.default.0x565912
jmp dword [eax*4 + 0x604b50]
mov dword [0x8e2a88], 0
jmp 0x565946
mov dword [0x8e2a88], 1
jmp 0x565946
mov dword [0x8e2a88], 3
jmp 0x565946
add esp, 8
ret 4
cmp dword [0x942fb8], 0
je 0x565962
mov eax, dword [0x942fb8]
mov edx, dword [0x8e2a88]
push edx
push eax
call dword [0x61d5c4]
add esp, 8
ret 4
Function at 0x565a10
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push ebp
sub esp, 0x458
mov ebx, dword [esp + 0x468]
push 0
call dword [0x61d67c]
lea eax, [esp + 4]
push eax
push 0x5e58a8
push 1
push 0
push 0x5e58b8
call dword [0x61d680]
test eax, eax
jl 0x565b27
lea eax, [esp + 0x24c]
push eax
mov eax, dword [esp + 8]
mov esi, dword [eax]
push 0x5e58c8
push eax
call dword [esi]
test eax, eax
jl 0x565b1d
lea eax, [esp + 0x250]
push 0x104
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x24c]
lea ecx, [esp + 0x250]
mov ebp, dword [eax]
push 0
push ecx
push eax
call dword [ebp + 0x14]
test eax, eax
jl 0x565b10
mov eax, dword [esp + 4]
mov ebp, dword [eax]
push 0x13
push 0
push eax
call dword [ebp + 0x4c]
test eax, eax
jl 0x565b10
lea eax, [esp + 0x148]
push ebx
push eax
call fcn.005a0920
lea eax, [esp + 0x10]
pop ecx
lea edx, [esp + 0x14c]
pop ecx
push 2
push eax
mov eax, dword [esp + 0xc]
mov ebx, dword [eax]
push 0x104
push edx
push eax
call dword [ebx + 0xc]
test eax, eax
jl 0x565b10
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x46c]
lea ecx, [esp + 0x148]
push ecx
push eax
call fcn.005a0920
pop ecx
pop ecx
add esp, 0x458
mov al, 1
pop ebp
pop esi
pop ebx
ret
mov eax, dword [esp + 0x24c]
mov ebx, dword [eax]
push eax
call dword [ebx + 8]
mov eax, dword [esp + 4]
mov ebx, dword [eax]
push eax
call dword [ebx + 8]
xor al, al
add esp, 0x458
pop ebp
pop esi
pop ebx
ret
Function at 0x567630
Capabilities:
Print debug messages

Disassembly:
push ebx
sub esp, 8
mov ebx, dword [esp + 0x10]
mov dword [esp + 4], ecx
lea eax, [ebx - 0x1c]
xor cl, cl
test eax, eax
mov edx, ebx
ja 0x567650
jmp dword [eax*4 + 0x604b68]
cmp dword [0x95cb3c], 0
je 0x56768b
cmp byte [esp + 0x14], 0
je 0x567673
test cl, cl
jne 0x56768b
mov eax, dword [ebx*4 + 0x87c648]
push dword [0x8f2c54]
jmp 0x567684
test cl, cl
jne 0x56768b
mov eax, dword [ebx*4 + 0x87c648]
push dword [0x6049a4]
push eax
call dword [0x61d5c0]
add esp, 8
pop ebx
ret 8

Function at 0x5676a0
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0x28
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x40]
mov byte [esp], 0
lea eax, [ebp - 0x1c]
mov esi, ecx
test eax, eax
mov edi, ebp
ja 0x5676c9
jmp dword [eax*4 + 0x604b6c]
cmp ebx, 0x1cb
jae 0x567720
mov al, byte [esp + 0x44]
mov ecx, esi
push eax
call fcn.00567130
test al, al
jne 0x5676f0
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
movzx eax, byte [esp + 0x44]
mov ecx, ebx
lea ecx, [ecx + ecx*4]
mov edi, dword [eax*4 + 0x6fab70]
mov edx, dword [esi + ecx*4 + 0x158]
lea edi, [edi + edi*4]
sub edx, dword [esi + edi*4 + 0x158]
add edx, dword [eax*4 + 0x87c7d8]
jmp 0x567760
xor ecx, ecx
movzx eax, byte [0x95cd96]
lea eax, [eax]
mov edi, eax
sub edi, ecx
dec edi
cmp ebx, dword [edi*4 + 0x8e2a44]
jne 0x567747
mov edx, dword [edi*4 + 0x94074c]
jmp 0x56774d
inc ecx
cmp ecx, 3
jb 0x567730
cmp ecx, 3
jne 0x567760
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
cmp byte [esp], 0
je 0x5677a0
mov ebp, dword [ebp*4 + 0x8f42e0]
test ebp, ebp
je 0x567790
lea ebx, [ebx + ebx*4]
mov eax, dword [esi + ebx*4 + 0x15c]
push eax
push edx
push ebp
call dword [0x61d618]
add esp, 0x28
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov edi, ebx
mov dword [esp + 4], 1
mov dword [esp + 8], edx
lea edi, [edi + edi*4]
lea edi, [edi*4]
mov dword [esp + 0x18], 1
mov eax, dword [esi + edi + 0x15c]
lea ecx, [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esi + edi + 0x160]
mov dword [esp + 0x10], eax
mov eax, dword [ebp*4 + 0x87c648]
push ecx
push eax
mov dword [esp + 0x1c], 0x10
call dword [0x61d61c]
test eax, eax
jne 0x567810
call dword [0x61d5ac]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov al, 1
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x567c50
Capabilities:
Print debug messages

Disassembly:
push ebx
push ebp
mov ebp, ecx
sub esp, 0x108
cmp byte [ebp + 0x56], 0
je 0x567d20
cmp byte [esp + 0x114], 0xc4
jae 0x567d20
movzx ebx, byte [esp + 0x118]
mov eax, dword [ebx*4 + 0x709c50]
test eax, eax
je 0x567c9c
push 1
push eax
call dword [0x61d5fc]
mov eax, dword [ebx*4 + 0x709c50]
push eax
call dword [0x61d5d0]
lea eax, [esp + 4]
add ebp, 6
push ebp
push eax
call fcn.005a0920
movzx eax, byte [esp + 0x11c]
pop ecx
pop ecx
lea ecx, [eax*8]
lea ecx, [ecx + ecx*2]
add ecx, eax
lea eax, [esp + 4]
add ecx, 0x6034dc
push ecx
push eax
call fcn.005a0970
mov eax, dword [0x8f1a24]
lea edx, [esp + 0xc]
pop ecx
pop ecx
push 0
push edx
push eax
call dword [0x61d5c8]
mov dword [ebx*4 + 0x709c50], eax
mov eax, dword [ebx*4 + 0x709c50]
test eax, eax
je 0x567d13
push 1
push eax
call dword [0x61d65c]
mov eax, dword [ebx*4 + 0x709c50]
push 1
push eax
call dword [0x61d660]
jmp 0x567d20
call dword [0x61d5ac]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x108
pop ebp
pop ebx
ret 8
Function at 0x580b70
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push 0
push 0x2000080
push 3
push 0
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x580ba0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x580ba7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
ret

Function at 0x580bb0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push esi
push edi
sub esp, 0x10
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x580c4b
mov dword [esp + 8], 0x100
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push 0x6510d8
push eax
mov eax, dword [esp + 0x10]
push 0
push str.Personal
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x580c40
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.GTA3_User_Files
push 0x6510d8
call fcn.005a0970
pop ecx
pop ecx
push 0x6510d8
call fcn.00580b70
pop ecx
mov eax, 0x6510d8
add esp, 0x10
pop edi
pop esi
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x6510d8
mov esi, str.data
movsd dword es:[edi], dword [esi]
mov eax, 0x6510d8
movsb byte es:[edi], byte [esi]
add esp, 0x10
pop edi
pop esi
ret
Function at 0x580fa0
Capabilities:
Print debug messages

Disassembly:
push ebx
push ebp
sub esp, 8
push str.DDRAW.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x580fd0
push str.Couldnt_LoadLibrary_DDraw_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop ebx
ret
push str.DirectDrawCreateEx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
jne 0x581000
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Couldnt_GetProcAddress_DirectDrawCreateEx_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop ebx
ret
lea eax, [esp + 4]
push 0
push 0x5e5978
push eax
push 0
call ebp
test eax, eax
jge 0x581030
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Couldnt_DirectDrawCreateEx_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop ebx
ret
mov eax, dword [esp + 4]
mov ebp, dword [eax]
push eax
call dword [ebp + 8]
push str.D3D8.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
jne 0x581068
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_D3D8.DLL_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x700
pop ebp
pop ebx
ret
push str.dpnhpast.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x581094
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_dpnhpast.dll_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x800
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x801
add esp, 8
pop ebp
pop ebx
ret