joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4062f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push 0x1390
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x406318
push str.Global_Alloc_Error
push 0x13b41c4
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop ebx
ret
push esi
push edi
mov ecx, 0xfa
mov esi, 0x7dd7a8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x3e8]
mov ecx, 0x3e8
mov esi, 0x7f99a8
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ecx, [ebx + 0x1388]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, dword [0x4880d0]
test eax, eax
je 0x40639a
push ebp
xor esi, esi
call fcn.004446cb
and eax, 0x800000ff
jns 0x406366
dec eax
or eax, 0xffffff00
inc eax
mov edx, ebx
mov edi, 0x1388
xor ecx, ecx
mov cl, byte [edx]
mov ebp, ecx
and ebp, 0xff
xor cl, al
xor ebp, 0xd3
xor cl, 0xf4
add esi, ebp
mov byte [edx], cl
inc edx
dec edi
jne 0x40636d
xor al, 0xb1
xor esi, 0x4bc57d21
mov byte [edx], al
mov dword [edx + 4], esi
pop ebp
mov edx, dword [esp + 0x10]
push 0x1390
push ebx
push edx
call fcn.00405ba0
add esp, 0xc
test eax, eax
pop edi
pop esi
push ebx
jne 0x4063be
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
pop ebx
ret

Function at 0x4063d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push 0xfa8
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x4063f8
push str.Global_Alloc_Error
push 0x13b41c4
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop ebx
ret
push esi
mov esi, dword [0x13b5180]
push edi
mov ecx, 0x3e8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ecx, [ebx + 0xfa0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, dword [0x4880d0]
test eax, eax
je 0x406469
push ebp
xor esi, esi
call fcn.004446cb
and eax, 0x800000ff
jns 0x406435
dec eax
or eax, 0xffffff00
inc eax
mov edx, ebx
mov edi, 0xfa0
xor ecx, ecx
mov cl, byte [edx]
mov ebp, ecx
and ebp, 0xff
xor cl, al
xor ebp, 0xd3
xor cl, 0xf4
add esi, ebp
mov byte [edx], cl
inc edx
dec edi
jne 0x40643c
xor al, 0xb1
xor esi, 0x4bc57d21
mov byte [edx], al
mov dword [edx + 4], esi
pop ebp
mov edx, dword [esp + 0x10]
push 0xfa8
push ebx
push edx
call fcn.00405ba0
add esp, 0xc
test eax, eax
pop edi
pop esi
push ebx
jne 0x40648d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
pop ebx
ret
Function at 0x4064a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push ecx
call fcn.00405370
add esp, 8
test eax, eax
jne 0x4064b7
ret
cmp dword [esp + 4], 0x1390
je 0x4064d4
push str.Not_Flag_file.
push 0x13b41c4
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
ret
mov ecx, dword [0x4880d0]
test ecx, ecx
push esi
push edi
je 0x40650f
push ebx
mov bl, byte [eax + 0x1388]
xor esi, esi
mov edx, eax
xor bl, 0xb1
mov edi, 0x1388
mov cl, byte [edx]
xor cl, bl
xor cl, 0xf4
mov byte [edx], cl
and ecx, 0xff
xor ecx, 0xd3
add esi, ecx
inc edx
dec edi
jne 0x4064f3
pop ebx
mov esi, eax
mov ecx, 0xfa
mov edi, 0x7dd7a8
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x3e8]
mov ecx, 0x3e8
mov edi, 0x7f99a8
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, 1
pop esi
ret

Function at 0x406540
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push ecx
call fcn.00405370
add esp, 8
test eax, eax
jne 0x406557
ret
cmp dword [esp + 4], 0xfa8
je 0x406574
push str.Not_System_Flag_file.
push 0x13b41c4
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
ret
mov ecx, dword [0x4880d0]
test ecx, ecx
push esi
push edi
je 0x4065af
push ebx
mov bl, byte [eax + 0xfa0]
xor esi, esi
mov edx, eax
xor bl, 0xb1
mov edi, 0xfa0
mov cl, byte [edx]
xor cl, bl
xor cl, 0xf4
mov byte [edx], cl
and ecx, 0xff
xor ecx, 0xd3
add esi, ecx
inc edx
dec edi
jne 0x406593
pop ebx
mov edi, dword [0x13b5180]
mov esi, eax
mov ecx, 0x3e8
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, 1
pop esi
ret

Function at 0x4065d0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
mov cl, byte [eax]
sub esp, 0x158
push esi
mov esi, dword [esp + 0x164]
or cl, byte [esi]
jne 0x4065f2
xor eax, eax
pop esi
add esp, 0x158
ret
push edi
push eax
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x5c]
push esi
push eax
call fcn.004139c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 8
push 0x48226c
lea ecx, [esp + 0x60]
push ecx
call esi
mov edx, dword [esp + 0x16c]
push edx
lea eax, [esp + 0x60]
push eax
call esi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 8], ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x7c]
push ecx
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x158
ret
Function at 0x407bb0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 0x3a
push 0xbcc9f4
call fcn.00444fd0
mov esi, dword [esp + 0x128]
mov edi, dword [esp + 0x124]
mov ebx, dword [esp + 0x120]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 8
test eax, eax
je 0x407bf6
push 0xbcc9f4
push esi
push edi
push ebx
call ebp
cmp eax, esi
jne 0x407c31
mov al, byte [0x13b4720]
test al, al
je 0x407c2f
push 0x13b4720
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push 0xbcc9f4
push ecx
call fcn.004139c0
add esp, 8
lea edx, [esp + 0x10]
push edx
push esi
push edi
push ebx
call ebp
cmp eax, esi
jne 0x407c31
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x407c40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 0x3a
push 0xbcc9f4
call fcn.00444fd0
mov edi, dword [esp + 0x12c]
mov esi, dword [esp + 0x128]
mov ebx, dword [esp + 0x124]
mov ebp, dword [esp + 0x120]
add esp, 8
test eax, eax
je 0x407c91
push 0xbcc9f4
push edi
push esi
push 0x4b3e14
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x407cd9
mov al, byte [0x13b4720]
test al, al
je 0x407cd4
push 0x13b4720
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push 0xbcc9f4
push ecx
call fcn.004139c0
add esp, 8
lea edx, [esp + 0x10]
push edx
push edi
push esi
push 0x4b3e14
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x407cd9
mov byte [esi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x407d70
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push 0x80
push 3
push ebp
push 1
push DirectSoundCreate
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x407e14
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x407e0d
mov ecx, dword [0x7e17c0]
not ecx
cmp esi, ecx
je 0x407dc4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x407e0d
push 0
lea edx, [esp + 0x18]
push edx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407e06
sub esi, dword [0x7dd770]
push esi
push ebx
call fcn.0044fad0
mov ecx, dword [0x7e27c8]
add esp, 8
cmp ecx, eax
jne 0x407e06
mov ebp, 1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x408c40
Capabilities:
Get disk information

Disassembly:
sub esp, 0x244
push ebx
push ebp
mov ebp, dword [esp + 0x250]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov bl, 0x41
movsx esi, bl
push esi
lea eax, [esp + 0x14]
push str._c:_
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x408ca5
push ebp
push esi
lea edx, [esp + 0x18]
push str._c:_s
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x408cb9
inc bl
cmp bl, 0x5a
jle 0x408c59
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x244
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x244
ret

Function at 0x408cd0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
push esi
push edi
push 0x7dcd48
call fcn.00414200
mov al, byte [0x13b4418]
xor ebx, ebx
add esp, 4
cmp al, bl
je 0x408d6e
push 0x13b4418
lea eax, [esp + 0x1c]
push 0x482554
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x24]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408d6e
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x13b4518
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.InstPath
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408d63
mov eax, dword [esp + 0xc]
push eax
jmp 0x408d68
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4b3e14
push 0x13b4518
call fcn.004139c0
add esp, 8
push 0x13b461c
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x4b3e14
push 0x13b461c
call fcn.004139c0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 8
push str.autoexec.scn
push 0x13b4824
call edi
push 0x13b4824
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
js 0x408dd4
cmp byte [eax + 0x13b4824], 0x5c
mov byte [eax + 0x13b4824], bl
je 0x408dd4
dec eax
jns 0x408dc2
cmp byte [0x13b4824], bl
je 0x408dee
push 0x4b3e14
push 0x13b4824
call fcn.004139c0
add esp, 8
push 0x104
push 0x13b4930
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call fcn.004505a0
push 0x4b3e14
push 0x13b4930
call fcn.004139c0
add esp, 8
push 0x13b4a34
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x4b3e14
push 0x13b4a34
call fcn.004139c0
push 0x4b3e14
push 0x13b4b38
call fcn.004139c0
add esp, 0x10
push str.20011002
push 0x498a53
call edi
push 0x5c
push 0xbcc9f4
call fcn.00444f90
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x408ea4
mov eax, dword [0x13b4d40]
mov edx, eax
shl edx, 6
add edx, eax
push 0xbcc9f4
lea eax, [edx*4 + 0xbccf04]
push eax
call edi
mov eax, dword [0x13b4d40]
mov ecx, eax
shl ecx, 6
add ecx, eax
shl ecx, 2
sub ecx, 0xbcc9f4
mov byte [ecx + esi + 0xbccf05], bl
inc dword [0x13b4d40]
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x40a2d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x21c
push ebx
mov ebx, dword [esp + 0x22c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40a335
mov edi, dword [esp + 0x22c]
mov eax, dword [edi + 4]
test eax, eax
lea esi, [edi + 4]
je 0x40a309
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], 0
push esi
push 0x47be1c
push 1
push 0
push 0x47bf8c
mov dword [edi + 8], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x40a341
mov dword [esi], 0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x21c
ret
push 0x104
lea edx, [esp + 0x24]
push edx
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [0x4880f4], 3
je 0x40a374
mov eax, dword [esi]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x24]
push edx
push eax
call dword [ecx + 0x34]
test eax, eax
jl 0x40a335
mov ecx, dword [esi]
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00409d10
add esp, 8
test eax, eax
je 0x40a335
push ebx
lea edx, [edi + 0x30]
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi]
mov ebx, dword [esp + 0x230]
lea edx, [esp + 0x10]
push edx
push 0x47beec
mov dword [edi + 0x28], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x47bebc
push eax
call dword [ecx]
mov esi, dword [esi]
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x47be3c
push esi
call dword [eax]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
push str.Video_Renderer
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push eax
call dword [edx + 8]
test esi, esi
jl 0x40a442
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x47bf1c
push eax
call dword [ecx]
mov esi, eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jl 0x40a442
mov ecx, dword [0x4880f0]
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x74]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push ebx
push eax
call dword [edx + 0x7c]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 0x44000000
push eax
call dword [ecx + 0x24]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push edi
push 0x40d
push ebx
push eax
call dword [edx + 0x34]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [edi], 1
mov eax, dword [0x4880f8]
mov dword [edi + 0x2c], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x21c
ret
Function at 0x40bf00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40bfd5
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.0040bab0
add esp, 8
test eax, eax
je 0x40bfd5
push edi
lea eax, [esi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [esp + 0x10]
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
push 0x47beec
mov dword [esi + 0xa4], edi
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x47bebc
push eax
call dword [ecx]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x74]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
push edi
push eax
call dword [edx + 0x7c]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push 0x44000000
push eax
call dword [ecx + 0x24]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push esi
push 0x40f
push edi
push eax
call dword [edx + 0x34]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi], 1
mov eax, dword [0x4880f8]
mov dword [esi + 0xa8], eax
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x40c7a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 4]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
dec eax
cmp edi, eax
ja 0x40c8c9
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + edi*4]
mov esi, dword [eax + edi*4 + 4]
xor edx, edx
mov ebp, 0x1e
mov eax, edi
div ebp
and ecx, 0x3fffffff
and esi, 0x3fffffff
sub esi, ecx
mov eax, edx
shl eax, 4
lea ebp, [eax + ebx]
cmp dword [ebp + 0x64], edi
mov dword [esp + 0x18], edx
jne 0x40c7fd
lea eax, [edx + 7]
shl eax, 4
cmp dword [eax + ebx], 0
jne 0x40c8c9
test esi, esi
je 0x40c8af
push 0
push 0
push ecx
mov ecx, dword [ebx + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebx + 0x5c]
mov ecx, dword [ebx + 0x20]
push 0
lea edx, [esp + 0x14]
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40c834
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [ebx + 0x5c]
mov eax, dword [ebp + 0x68]
push esi
push edx
push eax
call fcn.0044fba0
add esp, 0xc
test eax, eax
jne 0x40c863
mov edi, dword [ebp + 0x68]
mov ecx, esi
mov esi, dword [ebx + 0x5c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add eax, 7
shl eax, 4
mov dword [eax + ebx], 1
mov ecx, dword [ebp + 0x68]
cmp dword [ecx], 0x3449414d
jne 0x40c897
mov dword [ebp + 0x6c], 1
mov dword [ebp + 0x64], edi
mov dword [ebx + 0x60], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
mov dword [ebp + 0x6c], 0
mov dword [ebp + 0x64], edi
mov dword [ebx + 0x60], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
add edx, 7
mov dword [ebp + 0x6c], 0
shl edx, 4
mov dword [edx + ebx], 0
mov dword [ebp + 0x64], edi
mov dword [ebx + 0x60], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x40c8e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor eax, eax
push eax
push eax
push eax
push eax
mov ecx, 0x92
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x30]
push DirectSoundCreate
push eax
call fcn.004050b0
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 0x20], eax
jne 0x40c91e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x20
push esi
push eax
call ebx
test eax, eax
je 0x40c9e9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x40c9ba
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esi + 0x14]
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [esi + 0x20]
push ecx
push eax
push edx
mov dword [esi + 0x24], eax
call ebx
test eax, eax
je 0x40c9e9
mov ebp, dword [esi + 0x14]
cmp ebp, 0x400
jbe 0x40c976
mov ebp, 0x400
xor ecx, ecx
test ebp, ebp
jle 0x40c994
mov eax, dword [esi + 0x24]
lea edi, [eax + ecx]
mov al, byte [edi]
mov dl, al
shl dl, 7
shr al, 1
or dl, al
inc ecx
cmp ecx, ebp
mov byte [edi], dl
jl 0x40c97c
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x24]
push eax
mov eax, dword [esp + 0x28]
or ecx, 1
push ecx
push edx
push eax
lea ecx, [esi + 0x28]
push ecx
call fcn.004531d0
add esp, 0x14
test eax, eax
je 0x40c9e9
mov edx, dword [esi + 4]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea edi, [edx*4 + 4]
push edi
push 0
call ebp
test eax, eax
mov dword [esi + 0x2c], eax
je 0x40c9e9
mov edx, dword [esi + 0x20]
push 0
lea ecx, [esp + 0x20]
push ecx
push edi
push eax
push edx
call ebx
test eax, eax
jne 0x40c9fc
push esi
call fcn.0040cb50
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esi + 8]
xor edx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
fild qword [esp + 0x10]
mov eax, dword [esi + 4]
cmp eax, edx
fdivr qword [0x47b508]
fstp qword [esi + 0x38]
jbe 0x40ca40
mov ecx, dword [esi + 0x2c]
mov edi, eax
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
and eax, 0x3fffffff
and ebx, 0x3fffffff
sub eax, ebx
cmp edx, eax
jae 0x40ca3a
mov edx, eax
add ecx, 4
dec edi
jne 0x40ca22
push edx
push 0
call ebp
mov dword [esi + 0x5c], eax
xor ebx, ebx
lea edi, [esi + 0x70]
push 0x80000
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
mov dword [edi - 8], eax
push esi
mov dword [edi], 0
call fcn.0040c7a0
add esp, 8
test eax, eax
je 0x40c9f2
inc ebx
add edi, 0x10
cmp ebx, 0x1e
jb 0x40ca4d
mov ecx, dword [0x487f34]
pop edi
mov dword [esi + 0x58], ecx
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x40d020
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x40d067
mov ecx, dword [esi + 0x10]
cmp ecx, 3
je 0x40d038
cmp ecx, 2
jne 0x40d046
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x10], 1
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 0x10], 0
pop esi
ret

Function at 0x40d070
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x40d0b7
mov ecx, dword [esi + 0x10]
cmp ecx, 3
je 0x40d088
cmp ecx, 2
jne 0x40d096
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esi + 0x10], 1
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [esi + 8]
push edx
push 0
push esi
push 0x40cfe0
push 0
push 0
mov dword [esi + 0x10], 1
call fcn.004452ce
add esp, 0x18
test eax, eax
mov dword [esi], eax
jne 0x40d0de
pop esi
ret
mov ecx, dword [esi + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
pop esi
ret
Function at 0x40fd40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push esi
push edi
push 0x13b4418
lea eax, [esp + 0x18]
push str._sSystem
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x20]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40fedb
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
push eax
push 0x13b43d8
lea ecx, [esp + 0x18]
push ecx
push 0
push str.gbFullScreenFlag
mov edi, 4
push edx
mov dword [esp + 0x28], 3
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40fdcc
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40fedb
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x487f6c
lea edx, [esp + 0x18]
push edx
push 0
push str.gnWindowLeft
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40fe01
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40fedb
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0x487f70
lea eax, [esp + 0x18]
push eax
push 0
push str.gnWindowTop
push ecx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40fe36
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40fedb
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0x487f34
lea ecx, [esp + 0x18]
push ecx
push 0
push str.gdwWindowWidth
push edx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40fe68
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40fedb
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x487f38
lea edx, [esp + 0x18]
push edx
push 0
push str.gdwWindowHeight
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40fe9a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40fedb
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0x487f44
lea eax, [esp + 0x18]
push eax
push 0
push str.gdwWindowBpp
push ecx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40fecc
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40fedb
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x40fef6
push str.Registry_Read_Error.
push 0x13b41c4
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
xor eax, eax
pop esi
add esp, 0x110
ret
mov eax, 1
pop edi
mov dword [0x13b516c], eax
pop esi
add esp, 0x110
ret