joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4650
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b012f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, 1
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], 0x6c1f4c
mov dword [esp + 0x14], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
push fcn.0041ff00
push 0x41fef0
push 5
mov byte [esp + 0x20], al
push 0x10
lea eax, [esi + 0x48]
push eax
call fcn.005ce6bb
push fcn.0041ff00
push 0x41fef0
push 5
push 0x10
lea ecx, [esi + 0x98]
push ecx
mov byte [esp + 0x28], 2
call fcn.005ce6bb
push fcn.0041ff00
push 0x41fef0
push 5
push 0x10
lea edx, [esi + 0xe8]
push edx
mov byte [esp + 0x28], 3
call fcn.005ce6bb
lea ecx, [esi + 0x138]
mov byte [esp + 0x14], 4
call fcn.00527000
lea ecx, [esi + 0x710]
mov byte [esp + 0x14], 5
call fcn.00527000
lea ecx, [esi + 0xce8]
mov byte [esp + 0x14], 6
call fcn.00527000
lea ecx, [esi + 0x12c0]
mov byte [esp + 0x14], 7
call fcn.00527000
lea ecx, [esi + 0x1898]
mov byte [esp + 0x14], 8
call fcn.0052b880
or eax, 0xffffffff
mov byte [esp + 0x14], 9
mov dword [esi + 4], 0xf0
mov dword [esi + 8], 0xe1
mov dword [esi + 0xc], 0x1f9
mov dword [esi + 0x10], 0xf7
mov dword [esi + 0x2af4], eax
mov dword [esi + 0x2af8], eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2afc], edi
mov dword [esi + 0x2b00], edi
mov dword [esi + 0x2b04], edi
mov ecx, dword [0x22019b0]
cmp ecx, edi
je 0x4b47db
mov eax, dword [0x22019b4]
sub eax, ecx
sar eax, 2
cmp eax, edi
je 0x4b47db
mov dword [esi + 0x2b00], edi
mov eax, dword [0x22019b0]
mov ecx, dword [0x22019b4]
cmp eax, ecx
je 0x4b47db
mov edx, dword [esp + 8]
push edx
push edi
push edi
push ecx
push eax
call fcn.004b41d0
add esp, 0x14
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4b5550
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6b024a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
push edi
mov edi, 1
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
mov dword [esi], 0x6c1fac
mov dword [esp + 0x1c], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x34], ebp
mov dword [esi + 0x38], ebp
lea ecx, [esi + 0x3c]
mov byte [esp + 0x1c], 1
call fcn.00527000
lea ecx, [esi + 0x614]
mov byte [esp + 0x1c], 2
call fcn.00527000
lea ecx, [esi + 0xbec]
mov byte [esp + 0x1c], 3
call fcn.00527000
mov eax, dword [0x70859c]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x64
mov dword [esi + 4], eax
mov eax, dword [0x7085a0]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x37
push 0x128
mov byte [esp + 0x20], 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0xe1
mov dword [esi + 0x10], 0x77
mov dword [esi + 0x11c8], ebp
call fcn.005cc96d
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x4b5652
lea eax, [ebx + 8]
push eax
mov dword [ebx], ebp
mov dword [ebx + 4], ebp
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x1c], ebp
mov ecx, 0x41
xor eax, eax
lea edi, [ebx + 0x20]
rep stosd dword es:[edi], eax
mov dword [ebx + 0x124], ebp
mov edi, 1
jmp 0x4b5654
xor ebx, ebx
mov dword [esi + 0x11c4], ebx
push 0x40
mov dword [ebx], 0x14
mov ecx, dword [esi + 0x11c4]
push 0xd2
mov dword [ecx + 4], 0x64
mov edx, dword [esi + 0x11c4]
push 0x35
push 0x75
add edx, 8
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esi + 0x11c4]
add eax, 0x18
mov dword [eax], 0x75
mov dword [eax + 4], 0x35
mov eax, dword [0x719a3c]
push edi
push eax
mov ecx, 0x2203adc
call fcn.005323d0
push edi
mov ecx, 0x2203adc
call fcn.005325b0
mov ecx, 0x2203adc
call fcn.005347d0
mov dword [0x864e00], ebp
mov dword [0x719a58], edi
mov ecx, dword [esi + 0x11c4]
mov dword [ecx + 0x124], edi
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4b7690
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6b0473
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x6c20e4
mov dword [esp + 0x18], 6
call fcn.004b7170
lea ecx, [esi + 0xcd0]
mov byte [esp + 0x18], 5
call fcn.00527170
lea ecx, [esi + 0x6f8]
mov byte [esp + 0x18], 4
call fcn.00527170
lea ecx, [esi + 0x120]
mov byte [esp + 0x18], 3
call fcn.00527170
lea ecx, [esi + 0x64]
mov byte [esp + 0x18], 2
call fcn.00423110
lea edi, [esi + 0x40]
mov ecx, edi
mov dword [edi], 0x6c20e0
call fcn.004ce920
add edi, 4
mov ecx, edi
call fcn.004ce800
mov eax, dword [edi + 4]
push eax
call fcn.005cc620
xor ebx, ebx
mov dword [edi + 4], ebx
mov eax, dword [esi + 0x30]
add esp, 4
cmp eax, ebx
mov byte [esp + 0x18], bl
je 0x4b773e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x4b774e
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x34], ebx
mov ecx, dword [esp + 0x10]
pop edi
mov dword [esi], 0x6bcc18
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4be880
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6b095c
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [ebx + 0x130], eax
mov eax, dword [0x708598]
mov esi, 1
cmp eax, esi
mov dword [0x8655d4], 0
je 0x4be8e2
push 0x80
push 0x100
push str.time_pop.tga
push str.data_interface
lea ecx, [ebx + 0xfc]
call fcn.005497a0
push 0x7191e0
push 0x104
lea eax, [esp + 0x14]
push eax
push 0x6bb5d5
push 0x6c2498
push str.INTERFACE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4be949
push edi
mov edi, str.TRUE
lea esi, [esp + 0x10]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x4be976
push 0x1e94
call fcn.005cc96d
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x118], 0
je 0x4be96e
mov ecx, eax
call fcn.004c8bd0
jmp 0x4be970
push 0x1e94
call fcn.005cc96d
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x118], esi
je 0x4be96e
mov ecx, eax
call fcn.004c8bd0
jmp 0x4be970
xor eax, eax
mov dword [ebx + 0xdc], eax
mov ecx, dword [esp + 0x110]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x4c49d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0x8655e8
call fcn.004cbd20
test eax, eax
je 0x4c49e5
xor eax, eax
pop ebx
ret
mov eax, dword [ebx + 0xbd4]
test eax, eax
je 0x4c4a2d
cmp dword [ebx + 0x10], 2
jge 0x4c4a2d
mov ecx, dword [0x2203688]
push 0x1c
call fcn.004268b0
test al, al
je 0x4c4a2d
push 0xd
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x447a0000
push 0x22094c8
push 0x20
push 0
mov ecx, 0x22071e0
call fcn.0053b0e0
mov eax, 1
pop ebx
ret
mov eax, dword [0x70859c]
cdq
sub eax, edx
push esi
mov esi, eax
mov eax, dword [0x7085a0]
cdq
sub eax, edx
push edi
mov edi, eax
mov eax, dword [ebx + 0x10]
sar esi, 1
sar edi, 1
sub esi, 0x80
sub edi, 0x80
cmp eax, 7
ja case.0x4c4a5b.4
jmp dword [eax*4 + 0x4c4ac0]
push edi
push esi
lea ecx, [ebx + 0x24]
call fcn.00527450
test eax, eax
je case.0x4c4a5b.4
pop edi
pop esi
mov eax, 1
pop ebx
ret
push edi
push esi
lea ecx, [ebx + 0x24]
call fcn.00527450
test eax, eax
je 0x4c4a9e
pop edi
pop esi
mov eax, 1
pop ebx
ret
push edi
push esi
lea ecx, [ebx + 0x24]
call fcn.00527450
test eax, eax
jne 0x4c4a70
push edi
push esi
lea ecx, [ebx + 0x5fc]
call fcn.00527450
test eax, eax
je case.0x4c4a5b.4
pop edi
pop esi
mov eax, 2
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4c6960
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6b0e1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], 0x6c2948
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
push fcn.0041ff00
push 0x41fef0
push 3
push 0x10
lea eax, [esi + 0xa8]
push eax
mov byte [esp + 0x28], 8
call fcn.005ce6bb
mov dword [esi + 0xdc], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
lea ecx, [esi + 0xfc]
mov byte [esp + 0x14], 0xb
call fcn.00527000
mov byte [esp + 0x14], 0xc
lea ecx, [esi + 0x6d4]
call fcn.00527000
lea ecx, [esi + 0xcb4]
mov byte [esp + 0x14], 0xd
call fcn.00527000
lea ecx, [esi + 0x128c]
mov byte [esp + 0x14], 0xe
call fcn.00527000
lea ecx, [esi + 0x1864]
mov byte [esp + 0x14], 0xf
call fcn.00527000
lea ecx, [esi + 0x1e3c]
mov byte [esp + 0x14], 0x10
call fcn.00527000
mov dword [esi + 0x20], 1
mov ecx, dword [0x70859c]
add ecx, 0xffffff00
mov dword [esi + 4], ecx
mov ecx, esi
mov byte [esp + 0x14], 0x11
mov dword [esi + 8], 0x80
mov dword [esi + 0xc], 0xb9
mov dword [esi + 0x10], 0x96
mov dword [esi + 0xcac], 0x3f800000
mov dword [esi + 0xcb0], edi
mov dword [esi + 0xe8], 1
call fcn.004c5bf0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov ecx, esi
call fcn.00526820
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4c6eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x18
push edi
mov edi, ecx
mov eax, dword [edi + 0xbc]
mov ecx, dword [eax]
cmp ecx, eax
mov dword [edi + 0xc4], ecx
je 0x4c7066
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
xor ebp, ebp
jmp 0x4c6ee0
mov eax, dword [edi + 0xc4]
mov esi, dword [eax + 8]
cmp esi, ebp
je 0x4c7045
call ebx
cmp eax, dword [esi + 0x18]
jae 0x4c6feb
fild dword [edi + 4]
mov eax, dword [edi + 0x9c]
mov edx, dword [edi + 0x98]
lea ecx, [edi + 0x90]
fiadd dword [esi]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, eax
mov eax, dword [esp + 0x14]
push edx
push eax
sub esp, 8
fstp dword [esp + 0x34]
fild dword [esi + 4]
fiadd dword [edi + 8]
fstp dword [esp + 0x2c]
fld dword [esp + 0x20]
fmul dword [0x6bc860]
fsubr dword [esp + 0x2c]
fstp dword [esp + 4]
fld dword [esp + 0x24]
fmul dword [0x6bc860]
fsubr dword [esp + 0x34]
fstp dword [esp]
call fcn.0054a120
fld dword [edi + 0xa8]
lea ecx, [edi + 0xa0]
fmul dword [esi + 0xc]
fstp dword [esp + 0x20]
fld dword [ecx + 0xc]
mov eax, dword [esp + 0x20]
fmul dword [esi + 0xc]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
mov edx, dword [esp + 0x18]
fmul dword [0x6bc860]
push edx
push eax
sub esp, 8
fsubr dword [esp + 0x2c]
fstp dword [esp + 4]
fld dword [esp + 0x30]
fmul dword [0x6bc860]
fsubr dword [esp + 0x34]
fstp dword [esp]
call fcn.0054a120
call ebx
sub eax, dword [esi + 0x14]
test eax, eax
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
jge 0x4c6fc5
fadd dword [0x6bb60c]
fmul dword [0x6c2970]
fadd dword [esi + 0xc]
fstp dword [esi + 0xc]
call ebx
fld dword [esi + 0xc]
mov dword [esi + 0x14], eax
fcomp dword [0x6bc4dc]
fnstsw ax
test ah, 1
jne 0x4c7045
mov dword [esi + 0xc], ebp
jmp 0x4c7045
mov ecx, dword [edi + 0xc4]
mov eax, dword [ecx + 8]
cmp eax, ebp
je 0x4c700a
push eax
call fcn.005cc620
mov edx, dword [edi + 0xc4]
add esp, 4
mov dword [edx + 8], ebp
mov eax, dword [edi + 0xc4]
cmp eax, dword [edi + 0xbc]
mov esi, dword [eax]
je 0x4c703f
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push eax
mov dword [ecx + 4], edx
call fcn.005cc620
mov eax, dword [edi + 0xc0]
add esp, 4
dec eax
mov dword [edi + 0xc0], eax
mov dword [edi + 0xc4], esi
mov eax, dword [edi + 0xc4]
mov ecx, dword [eax]
mov dword [edi + 0xc4], ecx
mov eax, dword [edi + 0xbc]
mov edx, ecx
cmp edx, eax
jne 0x4c6ee0
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x18
ret
Function at 0x4c85f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b0ea7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], 0x6c2978
mov dword [esp + 0x18], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
lea ebx, [esi + 0xb8]
mov ecx, ebx
mov byte [esp + 0x18], 8
mov dword [esi + 0xb4], 0x6c2974
call fcn.004ce840
mov dword [ebx + 4], eax
mov dword [ebx + 8], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0x20], edi
mov eax, dword [0x70859c]
add eax, 0xffffff36
mov dword [esi + 4], eax
mov ecx, dword [0x7085a0]
add ecx, 0xfffffef0
mov eax, 0xc0
mov dword [esi + 8], ecx
mov byte [esp + 0x18], 9
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xb0], edi
mov ecx, esi
call fcn.004c5620
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4d7150
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SOFTWARESONOVShaiya
push reloc.ijl15.dll_Ordinal_2
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d71d7
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 4]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x6c2cc4
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4d71d7
cmp dword [esp + 4], 4
jne 0x4d71d7
cmp dword [esp + 8], 4
jne 0x4d71d7
mov eax, dword [esp]
test eax, eax
push ebx
mov bl, byte [esp + 0x10]
je 0x4d71d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x10
ret
xor al, al
add esp, 0x10
ret

Function at 0x4da140
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push esi
push edi
push 0x7191e0
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x6bb5d5
push str.SHOW_MESSAGE_PRIEST
push str.INTERFACE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4da19e
mov edi, str.TRUE
lea esi, [esp + 8]
mov ecx, 5
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x7191e0
lea eax, [esp + 0xc]
push eax
push str.SHOW_MESSAGE_PRIEST
push str.INTERFACE
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4da6a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b125a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, 1
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], 0x6c3294
mov dword [esp + 0x14], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
push fcn.00527170
push fcn.00527000
push 7
mov byte [esp + 0x20], al
push 0x5d8
lea eax, [esi + 0x3c]
push eax
call fcn.005ce6bb
lea ecx, [esi + 0x2924]
mov byte [esp + 0x14], 2
call fcn.0052d480
lea ecx, [esi + 0x2994]
mov byte [esp + 0x14], 3
call fcn.0052b880
mov dword [esi + 0x3bf0], edi
xor eax, eax
lea edi, [esi + 0x3bf6]
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4db300
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b133f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi], 0x6c3304
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
push fcn.00527170
push fcn.00527000
push 2
push 0x5d8
lea eax, [esi + 0x4c]
push eax
mov byte [esp + 0x30], 2
call fcn.005ce6bb
lea ecx, [esi + 0xbfc]
mov byte [esp + 0x1c], 3
call fcn.0052d480
lea ecx, [esi + 0xc6c]
mov byte [esp + 0x1c], 4
call fcn.0052b880
lea ecx, [esi + 0x1ec8]
mov byte [esp + 0x1c], 5
call fcn.0052b880
lea ebp, [esi + 0x3438]
mov ecx, ebp
mov byte [esp + 0x1c], 6
call fcn.00527000
push ebx
push 0x447a0000
xor eax, eax
mov byte [esi + 0x3432], bl
mov dword [esi + 0x3434], ebx
mov byte [esi + 0x3124], bl
mov byte [esi + 0x3125], bl
lea edi, [esi + 0x3126]
mov ecx, 0xc3
push 0x22094c8
rep stosd dword es:[edi], eax
push str.ui_paper001.wav
mov ecx, 0x22071e0
mov byte [esp + 0x2c], 7
call fcn.0053a850
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push ebx
fld dword [0x709f78]
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebx
push 0x3e800000
push ebx
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
call fcn.005cd414
fld dword [0x709f74]
push eax
call fcn.005cd414
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
push ecx
push edx
mov ecx, ebp
call fcn.00528830
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4dc0f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6b137c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi], 0x6c337c
mov dword [esp + 0x18], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea ebp, [esi + 0x3c]
mov ecx, ebp
mov byte [esp + 0x18], 1
call fcn.00527000
lea ecx, [esi + 0x614]
mov byte [esp + 0x18], 2
call fcn.0052b880
mov dword [esi + 0xc], 0xf4
mov ecx, dword [0x708598]
mov eax, 4
cmp ecx, eax
mov byte [esp + 0x18], 3
jne 0x4dc18a
mov dword [esi + 0xc], 0x129
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x3f800000
push edi
push 0x3f400000
push 0x3f000000
push 0x3f800000
push edi
push 0x3f000000
push 0x3e800000
push 0x3f800000
push edi
push 0x3e800000
push edi
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push edi
push 0x16
push 0x16
mov dword [esi + 0x10], 0x83
mov dword [esi + 0x1870], 0xffffffff
mov dword [esi + 0x1874], edi
cmp dword [0x708598], eax
push 0x20
push 0x20
jne 0x4dc206
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x108
push eax
push ecx
jmp 0x4dc226
fld dword [0x709fb4]
call fcn.005cd414
fld dword [0x709fb0]
push eax
call fcn.005cd414
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push edx
push eax
mov ecx, ebp
call fcn.00528830
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret