joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ebcb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb0
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x644040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx + 8], edi
mov eax, dword [0x658714]
mov ecx, dword [0x64783c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5ebf0c
mov ecx, dword [0x658710]
test ecx, ecx
je 0x5ebdc6
lea ebx, [ebp - 0x14]
mov dword [ebx], 0xffffffff
call dword [0x63e64c]
push ebx
push edi
call ecx
test eax, eax
je 0x5ebd7f
cmp dword [ebp - 0x14], 0
setne byte [esi + 0x5d]
je 0x5ebdca
mov byte [esi + 0x5c], 0
lea eax, [esi + 0x30]
lea ebx, [esi + 0x28]
mov ecx, edi
mov edx, esi
push eax
push ebx
call fcn.005ebf60
add esp, 8
test al, al
jne 0x5ebe58
push 2
call fcn.00563020
add esp, 4
test al, al
je 0x5ebe3d
lea esi, [ebp - 0xbc]
mov ecx, esi
push 2
push 0x242
push str.process_info.cc
call fcn.0040a9f0
lea eax, [ebp - 0xb4]
push 0x21
push str.GetProcessBasicInformation_failed
jmp 0x5ebe2d
push 2
call fcn.00563020
add esp, 4
test al, al
je 0x5ebdc6
call fcn.004ed0f0
lea ebx, [ebp - 0xbc]
mov ecx, ebx
push eax
push 2
push 0x4d
push str.process_info.cc
call fcn.00592570
lea eax, [ebp - 0xb4]
push 0xe
push 0x63436c
push eax
call fcn.005320d0
add esp, 0xc
mov ecx, ebx
call fcn.00592350
mov byte [esi + 0x5d], 0
pcmpeqd xmm0, xmm0
lea ebx, [ebp - 0xbc]
movdqu xmmword [ebx + 0x10], xmm0
movdqu xmmword [ebx], xmm0
mov dword [ebx + 0x20], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebx], 9
sete byte [esi + 0x5c]
jne 0x5ebd26
push 2
call fcn.00563020
add esp, 4
test al, al
je 0x5ebe3d
lea esi, [ebp - 0xbc]
mov ecx, esi
push 2
push 0x234
push str.process_info.cc
call fcn.0040a9f0
lea eax, [ebp - 0xb4]
push 0x32
push str.Reading_x64_process_from_x86_process_not_supported
push eax
call fcn.005320d0
add esp, 0xc
mov ecx, esi
call fcn.00407a90
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00568175
mov eax, ebx
add esp, 0xb0
pop esi
pop edi
pop ebx
pop ebp
ret 4
cmp byte [esi + 0x5c], 0
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov ecx, edi
jne 0x5ebe6f
push esi
push eax
call fcn.005ec690
jmp 0x5ebe76
push esi
push eax
call fcn.005ec080
add esp, 8
test al, al
jne 0x5ebeb6
push 2
call fcn.00563020
add esp, 4
test al, al
je 0x5ebe3d
lea esi, [ebp - 0xbc]
mov ecx, esi
push 2
push 0x24b
push str.process_info.cc
call fcn.0040a9f0
lea eax, [ebp - 0xb4]
push 0x16
push str.ReadProcessData_failed
jmp 0x5ebe2d
movzx edx, byte [esi + 0x5c]
mov ecx, edi
push esi
call fcn.005eb320
add esp, 4
mov bl, 1
test al, al
jne 0x5ebe3f
push 2
call fcn.00563020
add esp, 4
test al, al
je 0x5ebe3d
lea esi, [ebp - 0xbc]
mov ecx, esi
push 2
push 0x250
push str.process_info.cc
call fcn.0040a9f0
lea eax, [ebp - 0xb4]
push 0x15
push str.ReadMemoryInfo_failed
jmp 0x5ebe2d
push 0x658714
call fcn.00564ee8
add esp, 4
cmp dword [0x658714], 0xffffffff
jne 0x5ebcef
push 0
push str.::IsWow64Process
push 0x62479e
call fcn.004eef90
add esp, 0xc
mov dword [0x658710], eax
push 0x658714
call fcn.00564f37
add esp, 4
jmp 0x5ebcef
Function at 0x4084f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
mov edi, dword [esp + 0x1c]
imul edi, edi, 0x30
mov ebx, dword [esp + 0x24]
mov esi, dword [0x6f76fc]
mov eax, ebx
add eax, dword [esp + 0x28]
mov dword [0x6f7710], eax
mov eax, ebx
shr eax, 0x18
mov ebp, dword [eax*4 + 0x6f76d0]
push 0
add esi, edi
mov dword [esi + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [0x6f7718], 0
je 0x4085e0
cmp dword [esi + 4], 0
jne 0x408545
cmp byte [esi + 0xe], 0
je 0x408550
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, ebx
mov dword [esi + 0x10], 0
and eax, 0xffffff
mov dword [esi], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 8], eax
mov byte [esi + 0xd], 0
mov eax, dword [esp + 0x1c]
mov ebp, dword [0x6f7708]
mov edi, dword [0x6f7700]
mov dword [edi + ebp*4], eax
inc dword [0x6f7708]
mov eax, dword [0x6f7708]
cdq
idiv dword [0x6f770c]
mov eax, edx
mov dword [0x6f7708], edx
mov ebx, dword [0x6f7704]
cmp ebx, eax
jne 0x4085b4
push str.Queue_is_full_n
call fcn.00401000
pop ecx
mov eax, dword [0x6f76f4]
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x4085d3
push str.Signal_Sema_Error_n
call fcn.00648ac0
pop ecx
add esp, 8
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
cmp dword [0x6f7714], 0
je 0x408637
mov edx, ebx
mov eax, dword [0x6f76fc]
and edx, 0xffffff
add eax, edi
shl edx, 0xb
mov dword [eax + 0x24], edx
add eax, 0x1c
push eax
mov eax, dword [esp + 0x2c]
shl eax, 0xb
push 0
push eax
push dword [esp + 0x2c]
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov bl, 1
jne 0x40862c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40862c
xor bl, bl
movzx eax, bl
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, ebx
and eax, 0xffffff
shl eax, 0xb
push 0
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 4]
shl eax, 0xb
push 0
push ecx
push eax
push dword [esp + 0x2c]
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4086f0
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
sub esp, 0x10
lea ecx, [esp + 0xc]
lea eax, [esp + 8]
push ecx
lea edx, [esp + 8]
push eax
lea eax, [esp + 8]
push edx
push eax
mov esi, dword [esp + 0x30]
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp dword [esp + 4], 0x800
mov dword [0x6f771c], 0
ja 0x40873f
push str.Using_no_buffered_loading_for_streaming_n
or dword [0x6f771c], 0x20000000
call fcn.00401000
pop ecx
mov eax, dword [esp + 4]
mov dword [0x6f7714], 1
push eax
or dword [0x6f771c], 0x40000000
push 0x800
mov dword [0x6f7718], 0
call fcn.005805d0
pop ecx
pop ecx
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov dword [0x6f76c8], 0
imul eax, eax, 0x30
mov dword [0x6f76cc], esi
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
mov dword [0x6f76fc], eax
push str.cdvd_stream
push str._s:_read_info__p_n
call fcn.00401000
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x6f771c]
or eax, 0x10000001
push 0
push eax
push 3
push 0
push 1
push 0x80000000
push 0x6866c4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [0x6f76c8]
mov dword [ecx*4 + 0x6f76d0], eax
mov eax, dword [0x6f76c8]
cmp dword [eax*4 + 0x6f76d0], 0
je 0x40880f
mov edi, eax
mov esi, 0x6866c4
shl edi, 6
add edi, 0x6f7488
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
inc dword [0x6f76c8]
push 1
push 0
push ebx
push 0
call fcn.004084f0
xor esi, esi
add esp, 0x10
cmp dword [0x6f76cc], 0
mov edi, eax
jle 0x408840
mov eax, eax
lea eax, [eax]
push esi
call fcn.004083d0
inc esi
pop ecx
cmp esi, dword [0x6f76cc]
jl 0x408830
xor esi, esi
cmp dword [0x6f76c8], 0
jle 0x40887a
mov eax, eax
lea eax, [eax]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi*4 + 0x6f76d0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi*4 + 0x6f76d0], 0
inc esi
cmp esi, dword [0x6f76c8]
jl 0x408850
cmp edi, 1
mov dword [0x6f76c8], 0
jne 0x4088a0
mov dword [0x6f7718], 1
push str.Using_async_loading_for_streaming_n
jmp 0x4088c3
and dword [0x6f771c], 0xbfffffff
mov dword [0x6f7714], 0
mov dword [0x6f7718], 1
push str.Using_sync_loading_for_streaming_n
call fcn.00401000
pop ecx
call fcn.004088e0
push ebx
call fcn.005805c0
pop ecx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4088e0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
cmp dword [0x6f76cc], 0
jle 0x40893c
xor ebp, ebp
push 0
push 2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov ecx, dword [0x6f76fc]
mov dword [ecx + ebp + 0x14], eax
mov eax, dword [0x6f76fc]
cmp dword [eax + ebp + 0x14], 0
jne 0x408930
push str.cdvd_stream
push str._s:_failed_to_create_sync_semaphore_n
call fcn.00648ac0
pop ecx
pop ecx
pop ebp
pop ebx
ret
inc ebx
add ebp, 0x30
cmp ebx, dword [0x6f76cc]
jl 0x4088f7
mov eax, dword [0x6f76cc]
inc eax
lea eax, [eax*4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x6f7700], eax
mov eax, dword [0x6f76cc]
inc eax
mov dword [0x6f7704], 0
push str.CdStream
push 5
push 0
push 0
mov dword [0x6f7708], 0
mov dword [0x6f770c], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
test eax, eax
mov dword [0x6f76f4], eax
jne 0x4089a4
push str.cdvd_stream
push str._s:_failed_to_create_stream_semaphore_n
call fcn.00648ac0
pop ecx
pop ecx
pop ebp
pop ebx
ret
push 0x6f76f8
push 4
push 0
push 0x408260
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x6f76f0], eax
jne 0x4089e0
push str.cdvd_stream
push str._s:_failed_to_create_streaming_thread_n
call fcn.00648ac0
pop ecx
pop ecx
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
dec eax
push eax
mov eax, dword [0x6f76f0]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x6f76f0]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ebp
pop ebx
ret
Function at 0x4d1300
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and esp, 0xfffffff8
push 0x691040
call fcn.00401000
lea eax, [esp + 4]
mov dword [0x97f264], 0x3f800000
fld dword [0x97f264]
pop ecx
push eax
fstp dword [0x975424]
mov dword [0x705310], 0
mov byte [0xa10b36], 0
mov dword [0xa0d894], 0
mov byte [0xa10b76], 0
mov dword [0x978d8c], 0
mov dword [0x974b2c], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4d13a0
push str.Performance_counter_available_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x3e8
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0065aa90
push 0x705300
mov dword [0x691010], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x4d13bf
push str.Performance_counter_not_available__using_millesecond_timer_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x691010], 0
call fcn.006030f0
mov dword [0xa10680], eax
mov eax, dword [0x978d8c]
mov ecx, 0xa10b8a
mov dword [0x974b2c], eax
mov eax, dword [0x974b2c]
push eax
mov dword [0xa0d898], 0
call fcn.005f98d0
push str.CTimer_ready_n
call fcn.00401000
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x5d6430
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
mov esi, ecx
push ebp
sub esp, 0x108
cmp byte [esi + 0x56], 0
mov ebp, dword [esp + 0x118]
je 0x5d6521
cmp ebp, 0x4c8
jae 0x5d6521
movzx ebx, byte [esp + 0x11c]
mov eax, dword [ebx*4 + 0x978668]
test eax, eax
je 0x5d6482
push 1
push eax
call dword [0x6f25bc]
mov eax, dword [ebx*4 + 0x978668]
push eax
call dword [0x6f25c0]
cmp ebp, 0x66
jae 0x5d6490
add esi, 0x30c08
push esi
jmp 0x5d64a7
cmp ebp, 0x67
jae 0x5d64a0
lea ecx, [esi + 0x30a00]
push ecx
jmp 0x5d64a7
lea edx, [esi + 0x30b04]
push edx
lea eax, [esp + 8]
push eax
call fcn.00642560
pop ecx
pop ecx
mov eax, ebp
lea ecx, [eax*8]
lea ecx, [ecx + ecx*2]
add ecx, eax
lea eax, [esp + 4]
add ecx, 0x69dc78
push ecx
push eax
call fcn.006425b0
mov eax, dword [0x978550]
lea edx, [esp + 0xc]
pop ecx
pop ecx
push 0
push edx
push eax
call dword [0x6f25c4]
mov dword [ebx*4 + 0x978668], eax
mov eax, dword [ebx*4 + 0x978668]
test eax, eax
je 0x5d6514
push 1
push eax
call dword [0x6f25c8]
mov eax, dword [ebx*4 + 0x978668]
push 1
push eax
call dword [0x6f25d4]
jmp 0x5d6521
call dword [0x6f25d8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x108
pop ebp
pop esi
pop ebx
ret 8

Function at 0x5d6800
Capabilities:
Print debug messages

Disassembly:
mov edx, dword [esp + 8]
push ebx
cmp edx, 0x7f
mov ebx, dword [esp + 8]
jbe 0x5d6813
mov edx, 0x7f
mov eax, ebx
lea eax, [ebx - 0x1c]
test eax, eax
ja 0x5d6823
jmp dword [eax*4 + 0x6a5710]
pop ebx
ret 8
Function at 0x5d6980
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov byte [esp], 0
lea eax, [ebx - 0x1c]
mov esi, ebx
test eax, eax
ja 0x5d69a7
jmp dword [eax*4 + 0x6a5718]
cmp edx, 0x20c
jae 0x5d69f6
movzx eax, byte [esp + 0x44]
cmp byte [eax + 0xa10978], 0
jne 0x5d69d0
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov esi, edx
mov edi, dword [eax*4 + 0x7e45d8]
lea esi, [esi + esi*4]
lea edi, [edi + edi*4]
mov ebp, dword [ecx + esi*4 + 0x15c]
sub ebp, dword [ecx + edi*4 + 0x15c]
add ebp, dword [eax*4 + 0x94b788]
jmp 0x5d6a30
xor esi, esi
movzx eax, byte [0xa10b52]
nop
mov edi, eax
sub edi, esi
dec edi
cmp edx, dword [edi*4 + 0x9751d0]
jne 0x5d6a17
mov ebp, dword [edi*4 + 0xa0d208]
jmp 0x5d6a1d
inc esi
cmp esi, 3
jb 0x5d6a00
cmp esi, 3
jne 0x5d6a30
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
cmp byte [esp], 0
je 0x5d6a70
mov ebx, dword [ebx*4 + 0x9b4854]
test ebx, ebx
je 0x5d6a60
lea edx, [edx + edx*4]
mov eax, dword [ecx + edx*4 + 0x160]
push eax
push ebp
push ebx
call dword [0x6f2620]
add esp, 0x28
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov edi, edx
mov dword [esp + 4], 1
mov dword [esp + 8], ebp
lea edi, [edi + edi*4]
lea edi, [edi*4]
mov dword [esp + 0x18], 1
mov eax, dword [ecx + edi + 0x160]
lea ebp, [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + edi + 0x164]
mov dword [esp + 0x10], eax
mov eax, dword [ebx*4 + 0x94b1a0]
push ebp
push eax
mov dword [esp + 0x1c], 0x10
call dword [0x6f2624]
test eax, eax
jne 0x5d6ae0
call dword [0x6f25d8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov al, 1
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x5d87f0
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push ebp
sub esp, 0x458
mov ebx, dword [esp + 0x468]
push 0
call dword [0x6f2694]
lea eax, [esp + 4]
push eax
push 0x67e9c8
push 1
push 0
push 0x67e9d8
call dword [0x6f2698]
test eax, eax
jl 0x5d8907
lea eax, [esp + 0x24c]
push eax
mov eax, dword [esp + 8]
mov esi, dword [eax]
push 0x67e9e8
push eax
call dword [esi]
test eax, eax
jl 0x5d88fd
lea eax, [esp + 0x250]
push 0x104
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x24c]
lea ecx, [esp + 0x250]
mov ebp, dword [eax]
push 0
push ecx
push eax
call dword [ebp + 0x14]
test eax, eax
jl 0x5d88f0
mov eax, dword [esp + 4]
mov ebp, dword [eax]
push 0x13
push 0
push eax
call dword [ebp + 0x4c]
test eax, eax
jl 0x5d88f0
lea eax, [esp + 0x148]
push ebx
push eax
call fcn.00642560
lea eax, [esp + 0x10]
pop ecx
lea edx, [esp + 0x14c]
pop ecx
push 2
push eax
mov eax, dword [esp + 0xc]
mov ebx, dword [eax]
push 0x104
push edx
push eax
call dword [ebx + 0xc]
test eax, eax
jl 0x5d88f0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x46c]
lea ecx, [esp + 0x148]
push ecx
push eax
call fcn.00642560
pop ecx
pop ecx
add esp, 0x458
mov al, 1
pop ebp
pop esi
pop ebx
ret
mov eax, dword [esp + 0x24c]
mov ebx, dword [eax]
push eax
call dword [ebx + 8]
mov eax, dword [esp + 4]
mov ebx, dword [eax]
push eax
call dword [ebx + 8]
xor al, al
add esp, 0x458
pop ebp
pop esi
pop ebx
ret
Function at 0x600ae0
Capabilities:
Get keyboard layout
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
movzx ebx, ax
and ebx, 0x3ff
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
movzx ebp, ax
push 0
and ebp, 0x3ff
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx esi, ax
and esi, 0x3ff
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
movzx ecx, ax
mov dword [esp + 4], ecx
sar dword [esp + 4], 0xa
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
movzx edi, ax
push 0
sar edi, 0xa
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
sar eax, 0xa
cmp ebx, 7
nop
nop
cmp ebp, 7
nop
nop
cmp esi, 7
jmp 0x600b66
cmp ebx, 0xc
nop
nop
cmp ebp, 0xc
nop
nop
cmp esi, 0xc
jmp 0x600b8a
cmp dword [esp + 4], 3
nop
nop
cmp edi, 3
nop
nop
cmp eax, 3
jmp 0x600ba2
cmp ebp, 7
nop
nop
mov eax, 7
jmp 0x600bf5
mov edx, eax
sub eax, 7
cmp eax, 9
mov dword [0x86967c], ebx
nop
nop
jmp dword [eax*4 + 0x6d690c]
mov dword [0x869680], 1
jmp 0x600c4a
mov dword [0x869680], 2
jmp 0x600c4a
mov dword [0x869680], 4
jmp 0x600c4a
mov dword [0x869680], 0
mov ecx, 0x94b220
call fcn.005850b0
mov ecx, 0x94b220
call fcn.005854f0
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x601770
Capabilities:
Hide graphical window

Disassembly:
push ebx
sub esp, 0x10
push 0
call fcn.0064e0e0
pop ecx
mov ecx, 0x869630
call fcn.004a394d
call fcn.00642ae0
push 0
push 0x16
mov dword [0x974b74], 0
mov ebx, eax
call fcn.00602ee0
mov edx, dword [0x9b48f4]
mov eax, dword [esp + 0x20]
mov dword [0x783ef4], 1
mov dword [0x783ee8], ebx
mov dword [0x783eec], eax
mov eax, dword [edx]
pop ecx
pop ecx
push eax
push 0x15
call fcn.00602ee0
test eax, eax
pop ecx
pop ecx
jne 0x6017d5
xor eax, eax
jmp 0x60181d
mov eax, dword [0x9b48dc]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp]
push eax
mov ecx, dword [0x9b48e0]
push 0
mov dword [esp + 0x14], ecx
mov dword [0x974b74], 1
mov dword [esp + 0xc], 0
mov dword [0x783ef4], 0
call fcn.00602ee0
mov eax, 1
pop ecx
pop ecx
test eax, eax
jne 0x601870
mov dword [0x9b48f0], 1
mov edx, dword [0x9b48f4]
mov eax, dword [edx]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x94b220
push 0
push str.WIN_TTL
call fcn.00584f30
mov ecx, 0x94b220
push eax
push str.WIN_RSZ
call fcn.00584f30
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
add esp, 0x10
pop ebx
ret
mov ecx, 0x869630
call fcn.004a3a13
add esp, 0x10
pop ebx
ret
Function at 0x601e80
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
push str.DDRAW.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x601eb0
push str.Couldnt_LoadLibrary_DDraw_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
push str.DirectDrawCreateEx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
jne 0x601ee0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Couldnt_GetProcAddress_DirectDrawCreateEx_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
lea eax, [esp + 4]
push 0
push 0x67ec9c
push eax
push 0
call ebp
test eax, eax
jge 0x601f10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Couldnt_DirectDrawCreateEx_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 4]
mov ebp, dword [eax]
push eax
call dword [ebp + 8]
push str.D3D8.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
jne 0x601f50
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_D3D8.DLL_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x700
pop ebp
pop edi
pop esi
pop ebx
ret
push str.dpnhpast.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x601f90
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_dpnhpast.dll_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret
push str.D3D9.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x601fd0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_D3D9.DLL_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x801
pop ebp
pop edi
pop esi
pop ebx
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x900
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x602240
Capabilities:
Create directory
Persist via run registry key
Query or enumerate registry value

Disassembly:
push esi
push edi
sub esp, 0x10
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x60230d
mov dword [esp + 8], 0x100
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push 0x783ef8
push eax
mov eax, dword [esp + 0x10]
push 0
push str.Personal
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x602302
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.GTA_Vice_City_User_Files
push 0x783ef8
call fcn.006425b0
pop ecx
pop ecx
push 0
push 0x2000080
push 3
push 0
push 1
push 0x80000000
push 0x783ef8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x6022f0
push 0
push 0x783ef8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x6022f7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
mov eax, 0x783ef8
pop edi
pop esi
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x783ef8
mov esi, str.data
movsd dword es:[edi], dword [esi]
mov eax, 0x783ef8
movsb byte es:[edi], byte [esi]
add esp, 0x10
pop edi
pop esi
ret
Function at 0x61d430
Capabilities:
Delete file

Disassembly:
push ebx
mov dword [0x9753c4], 0
sub esp, 0x108
mov ebx, dword [esp + 0x110]
movsx eax, bl
mov dword [esp], ecx
inc eax
push eax
lea eax, [esp + 8]
push 0x97509c
push str._s_i.b
push eax
call fcn.00648c10
lea eax, [esp + 0x14]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
movsx edx, bl
lea eax, [edx*8]
lea eax, [edx + eax*4]
lea eax, [eax + edx*2]
mov word [eax*4 + 0x8121f8], 0
mov al, 1
add esp, 0x108
pop ebx
ret 4