joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43abd0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43ac03
push esi
call fcn.0043dcd0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43abfc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43ac89
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43ac72
mov eax, dword [esi + 8]
test eax, eax
je 0x43ac27
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43ac6e
cmp eax, 2
je 0x43ac72
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43ac1a
cmp eax, 3
je 0x43ac4d
cmp eax, 1
jne 0x43ac1a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43ac1a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43ac1a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043acb0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43ac98
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043acb0
add esp, 4
pop esi
ret

Function at 0x446820
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x4468c3
test eax, eax
jbe 0x4468c3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x4468c3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44686e
xor esi, esi
jmp 0x446874
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44689f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00402370
add esi, eax
push esi
mov ebx, esi
call fcn.00402370
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x446880
pop ebp
test edi, edi
pop edi
jne 0x4468c3
test ebx, ebx
je 0x4468c3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0044b0b0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x446a05
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x446b1d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x446b1d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0045b96f
mov esi, eax
test esi, esi
je 0x446b1d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x446b1d
mov ecx, esi
call fcn.00446970
cmp edi, eax
jge 0x446b1d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x446aa3
mov dword [esp + 0x34], 1
jmp 0x446afe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x446b1d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00445f10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x45c312
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45c34a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045a3c9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045a3a1
jmp 0x45c356
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45da03
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45da45
call fcn.004634bc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45da45
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45da3c
xor eax, eax
jmp 0x45da4d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045da53
pop edi
pop esi
pop ebx
ret 4
Function at 0x4639ec
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x463a1a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x463a38
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00463952
jmp 0x463a38
mov eax, dword [esi + 0x14]
test eax, eax
je 0x463a38
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00463952
test edi, edi
mov eax, edi
jne 0x463a22
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x47d4b0
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x150
push esi
push edi
call fcn.00468630
mov edi, eax
xor esi, esi
cmp edi, esi
mov dword [esp + 0xc], edi
je 0x47d629
push ebx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
call fcn.0046e060
push 1
push esi
push edi
lea ecx, [esp + 0x2c]
call fcn.0046e140
mov edx, dword [0x4d27ac]
mov eax, dword [str.Shockwave_Flash]
mov ecx, dword [0x4d27a8]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x44]
push esi
mov dword [esp + 0x5c], edx
push esi
mov dword [esp + 0x58], eax
mov eax, dword [0x4d27b0]
mov dword [esp + 0x5c], ecx
mov ecx, dword [0x4ce1bc]
push esi
lea edx, [esp + 0x5c]
push esi
push edx
mov dword [esp + 0x70], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
push esi
push esi
push 3
push esi
push esi
push ebp
push edi
push eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push esi
push 0x84000000
push esi
mov ebp, eax
push esi
push str.HTTP_1.0
lea eax, [esp + 0x2c]
push ebx
push eax
push ebp
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
push esi
push esi
mov edi, eax
push esi
push esi
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x47d5cc
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x64]
push 0x100
push edx
push edi
call ebx
test eax, eax
je 0x47d5cc
cmp dword [esp + 0x10], esi
je 0x47d5cc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x60]
push eax
push 0x100
push ecx
push edi
call ebx
test eax, eax
jne 0x47d5b0
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp edi, esi
je 0x47d5d9
push edi
call ebx
cmp ebp, esi
je 0x47d5e0
push ebp
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x47d5eb
push eax
call ebx
mov edx, dword [esp + 0x14]
mov ecx, 0x4da3e8
push edx
call fcn.0041e810
mov eax, dword [esp + 0x38]
mov ecx, 0x4da3e8
push eax
call fcn.0041e810
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, 0x4da3e8
call fcn.0041e810
mov edx, dword [esp + 0x20]
mov ecx, 0x4da3e8
push edx
call fcn.0041e810
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x150
ret

Function at 0x47da90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
ret
Function at 0x483070
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [ecx + 0x11c4]
xor bl, bl
call dword [sym.imp.USER32.dll_GetFocus]
cmp esi, eax
jne 0x48309a
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
pop esi
pop ebx
setl al
ret 4
mov al, bl
pop esi
pop ebx
ret 4

Function at 0x483180
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x4daf74]
sub esp, 0x190
cmp eax, 1
push esi
jne 0x483199
pop esi
add esp, 0x190
ret
cmp eax, 2
je 0x4832e8
push str.WSOCK32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4832de
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WSACleanup
push esi
call edi
push str.WSAStartup
push esi
mov dword [0x4daf30], eax
call edi
push str.listen
push esi
mov dword [0x4daf34], eax
call edi
push str.closesocket
push esi
mov dword [0x4daf38], eax
call edi
push str.bind
push esi
mov dword [0x4daf3c], eax
call edi
push str.htons
push esi
mov dword [0x4daf40], eax
call edi
push str.htonl
push esi
mov dword [0x4daf44], eax
call edi
push 0x4d2a1c
push esi
mov dword [0x4daf48], eax
call edi
push str.WSAAsyncSelect
push esi
mov dword [0x4daf4c], eax
call edi
push str.accept
push esi
mov dword [0x4daf50], eax
call edi
push str.WSAGetLastError
push esi
mov dword [0x4daf54], eax
call edi
push str.WSAAsyncGetHostByName
push esi
mov dword [0x4daf58], eax
call edi
push str.inet_addr
push esi
mov dword [0x4daf5c], eax
call edi
push str.connect
push esi
mov dword [0x4daf60], eax
call edi
push str.send
push esi
mov dword [0x4daf64], eax
call edi
push str.recv
push esi
mov dword [0x4daf68], eax
call edi
push str.WSACancelAsyncRequest
push esi
mov dword [0x4daf6c], eax
call edi
mov dword [0x4daf70], eax
lea eax, [esp + 8]
push eax
push 0x101
call dword [0x4daf34]
test eax, eax
pop edi
jne 0x4832de
mov ax, word [esp + 4]
cmp al, 1
jne 0x4832d8
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x4832d8
mov dword [0x4daf74], 1
mov eax, 1
pop esi
add esp, 0x190
ret
call dword [0x4daf30]
mov dword [0x4daf74], 2
xor eax, eax
pop esi
add esp, 0x190
ret
Function at 0x483350
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
xor eax, eax
push ebp
mov dword [esp + 4], eax
mov ebp, ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
push esi
push edi
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x1c], eax
mov word [esp + 0x10], 2
call sub.WSOCK32.dll_htons
mov edi, dword [esp + 0x20]
mov word [esp + 0xe], ax
cmp byte [edi], 0
je 0x483411
push ebx
mov esi, str.localhost
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4833bd
test cl, cl
je 0x4833b9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4833bd
add eax, 2
add esi, 2
test cl, cl
jne 0x483395
xor eax, eax
jmp 0x4833c2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x483411
push edi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x48341f
push edi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4833eb
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10
ret 0x10
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
lea edi, [esp + 0x10]
mov esi, dword [edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [eax + 8]
mov word [esp + 0xc], ax
jmp 0x48341f
push 0x7f000001
call sub.WSOCK32.dll_htonl
mov dword [esp + 0x10], eax
mov edx, dword [ebp]
lea ecx, [esp + 0xc]
push 0x10
push ecx
push edx
call dword [0x4daf64]
test eax, eax
je 0x48343f
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10
ret 0x10
mov al, byte [esp + 0x28]
test al, al
jne 0x483463
mov ecx, dword [ebp]
lea eax, [esp + 0x28]
push 4
push eax
push 1
push 6
push ecx
mov dword [esp + 0x3c], 1
call sub.WSOCK32.dll_setsockopt
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x10
ret 0x10
Function at 0x4a4920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x74
push ebp
push esi
lea eax, [esp + 8]
push edi
xor ebp, ebp
push eax
push 1
push ebp
push 0x4d97d8
push 0x80000001
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a4a90
mov edi, dword [esp + 0x84]
mov eax, 0x4d97d0
test edi, edi
jne 0x4a4975
mov eax, 0x4d97c4
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4a4a90
mov eax, dword [esp + 0x14]
inc eax
push eax
call fcn.0041ec00
add esp, 4
mov ebp, eax
test edi, edi
mov eax, 0x4d97d0
jne 0x4a49b4
mov eax, 0x4d97c4
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4a4a90
test edi, edi
je 0x4a49da
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
jmp 0x4a49e0
call dword [sym.imp.WINMM.dll_waveOutGetNumDevs]
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4a4a90
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4a4a3c
lea eax, [esp + 0x1c]
push 0x30
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a4a31
test cl, cl
je 0x4a4a2d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a4a31
add eax, 2
add esi, 2
test cl, cl
jne 0x4a4a0d
xor eax, eax
jmp 0x4a4a36
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4a4a8c
jmp 0x4a4a7d
lea eax, [esp + 0x4c]
push 0x34
push eax
push edi
call dword [sym.imp.WINMM.dll_waveOutGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a4a74
test cl, cl
je 0x4a4a70
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a4a74
add eax, 2
add esi, 2
test cl, cl
jne 0x4a4a50
xor eax, eax
jmp 0x4a4a79
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4a4a8c
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x4a49ee
jmp 0x4a4a90
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a4a9f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x4a4aac
push ebp
call fcn.0041ec10
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x74
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
push edi
push str.D3DCompiler_43.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.MSVCR100.dll__controlfp]
push 0x30000
push 0x20000
call esi
push 0x300
xor edi, edi
push edi
call esi
add esp, 0x10
call dword [sym.imp.StrongholdBase.dll_public:_static_class_StrongholdBase::GameFramework____cdecl_StrongholdBase::GameFramework::Instance_void_]
mov ebx, eax
xor esi, esi
cmp ebx, edi
je 0x401050
lea eax, [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, ebx
mov eax, 1
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x400
mov dword [esp + 0x3c], 0x300
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], 0xca
mov dword [esp + 0x50], edi
mov dword [esp + 0x30], str.Stronghold_3
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 0xb0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [esp + 0x14], eax
mov dword [esp + 0x4c], str.config.xml
mov edx, dword [esi]
mov edx, dword [edx + 0x5c]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call edx
test al, al
je 0x4010ed
lea ecx, [ecx]
mov eax, dword [esi]
mov edx, dword [eax + 0x40]
mov ecx, esi
call edx
test al, al
jne 0x4010e0
mov eax, dword [esi]
mov edx, dword [eax + 0x60]
mov ecx, esi
call edx
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [edi]
test eax, eax
jne 0x40110f
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esp + 0x24]
call dword [sym.imp.vBase100.dll_public:_void___thiscall_VString::destructor_void_]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406676
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4f2214]
xor eax, dword [ebp + 4]
push ebx
push esi
mov esi, ecx
push 0x4c3840
push str.hiscores.dat
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], esi
call fcn.004a85fe
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x406885
lea eax, [esi + 0xc8]
mov dword [ebp - 8], eax
lea eax, [esi + 0x1e0]
push edi
mov dword [ebp - 0x10], eax
lea eax, [esi + 0xc0]
add esi, 0x88
xor edi, edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], 2
inc edi
push ebx
push 4
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.004a8556
push ebx
push 2
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.004a8556
add esp, 0x20
cmp word [ebp - 0x14], 0xff
jbe 0x406707
mov dword [ebp - 0x14], 0xff
movzx eax, word [ebp - 0x14]
push ebx
push edi
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004a8556
movzx eax, word [ebp - 0x14]
and byte [ebp + eax - 0x13c], 0
push ebx
push 4
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.004a8556
push ebx
push 4
lea eax, [ebp - 0x34]
push edi
push eax
call fcn.004a8556
movzx eax, word [ebp - 0x14]
mov esi, dword [ebp - 0x28]
add esp, 0x30
xor esi, 0x42beef
xor ecx, ecx
test eax, eax
jle 0x406768
movsx edx, byte [ebp + ecx - 0x13c]
imul edx, edx, 0x11
xor esi, edx
inc ecx
cmp ecx, eax
jl 0x406756
mov ecx, dword [ebp - 0x3c]
call fcn.00406346
cmp dword [ebp - 0x30], eax
jne 0x406791
cmp dword [ebp - 0x34], esi
jne 0x406791
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x13c]
push eax
call fcn.00403027
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 5
push ebx
push 2
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.004a8556
add esp, 0x10
cmp word [ebp - 0x18], 0xff
jbe 0x4067c3
mov dword [ebp - 0x18], 0xff
movzx eax, word [ebp - 0x18]
push ebx
push edi
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004a8556
movzx eax, word [ebp - 0x18]
and byte [ebp + eax - 0x13c], 0
push ebx
push 4
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.004a8556
push ebx
push 4
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.004a8556
movzx eax, word [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
add esp, 0x30
xor esi, 0x42beef
xor ecx, ecx
test eax, eax
jle 0x406824
movsx edx, byte [ebp + ecx - 0x13c]
imul edx, edx, 0x11
xor esi, edx
inc ecx
cmp ecx, eax
jl 0x406812
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x13c]
push eax
call fcn.00403027
cmp dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x1c]
jne 0x406842
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x40684f
cdq
mov ecx, 0x100
idiv ecx
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
add dword [ebp - 8], 0x1c
add dword [ebp - 0xc], 4
dec dword [ebp - 0x10]
jne 0x4067a4
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x24], 4
add dword [ebp - 0x20], 0x1c
dec dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jne 0x4066db
push ebx
call fcn.004a841c
pop ecx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.004a8117
leave
ret
Function at 0x41d6b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x41d77a
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push str.Version
push eax
mov dword [ebp - 4], 2
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x78]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.MinVidMemory
push ecx
mov dword [ebp - 8], edx
call edi
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x7c]
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.RecVidMemory
push ecx
mov dword [ebp - 0xc], edx
call edi
mov eax, dword [esi + 0x1c]
push 0x10
lea edx, [esi + 0x20]
push edx
push 3
push 0
push str.DisplayGUID
push eax
call edi
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x58]
inc eax
cmp ecx, 0x10
jb 0x41d740
mov ecx, dword [esi + 0x44]
jmp 0x41d743
lea ecx, [esi + 0x44]
push eax
push ecx
mov ecx, dword [esi + 0x1c]
push 1
push 0
push str.FailureReason
push ecx
call edi
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
inc eax
cmp ecx, 0x10
jb 0x41d765
mov ecx, dword [esi + 0x60]
jmp 0x41d768
lea ecx, [esi + 0x60]
mov edx, dword [esi + 0x1c]
push eax
push ecx
push 1
push 0
push str.Warning
push edx
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.004a9500
mov eax, dword [0x4f2214]
xor eax, dword [ebp + 4]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x1c]
test eax, eax
mov byte [ebx + 0x82], 1
jne 0x42408b
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.004a8117
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.Version
mov edi, 4
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
test eax, eax
je 0x4240d3
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.004a8117
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x18], 2
jne 0x4240bf
lea edx, [ebp - 8]
push edx
mov edx, dword [ebx + 0x1c]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.MinVidMemory
push edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x4240bf
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x78]
jne 0x4240bf
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebx + 0x1c]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.RecVidMemory
push ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call esi
test eax, eax
jne 0x4240bf
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebx + 0x7c]
jne 0x4240bf
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x1c]
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push str.DisplayGUID
push eax
mov dword [ebp - 8], 0x10
mov dword [ebp - 0xc], 3
call esi
test eax, eax
jne 0x4240bf
cmp dword [ebp - 8], 0x10
jne 0x4240bf
mov ecx, edi
lea edi, [ebx + 0x20]
lea esi, [ebp - 0x28]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x4240bf
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x1c]
lea ecx, [ebp - 0x1028]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push str.FailureReason
mov edi, 1
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 0x1000
call esi
test eax, eax
jne 0x4240bf
lea ecx, [ebp - 0x1028]
push ecx
lea ecx, [ebx + 0x40]
call fcn.00405bdd
lea edx, [ebp - 8]
push edx
mov edx, dword [ebx + 0x1c]
lea eax, [ebp - 0x1028]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.Warning
push edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 0x1000
call esi
test eax, eax
jne 0x4240bf
lea eax, [ebp - 0x1028]
push eax
lea ecx, [ebx + 0x5c]
call fcn.00405bdd
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
mov byte [ebx + 0x82], 0
mov al, 1
pop ebx
call fcn.004a8117
mov esp, ebp
pop ebp
ret