joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f8e30
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x11
jle 0x7f8ea0
mov dh, byte [esp + 7]
jmp 0x7f8efe
lea esp, [esp + 1]
jmp 0x7f8ed4

Function at 0x7f8e5f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 8], esi
not cx
xchg ah, dh
lea ecx, [esi*4]
jmp 0x7f8e70
pushfd
push dword [esp]
mov dx, 0xf95
mov dword [esp], esi
mov byte [esp + 5], ah
jmp 0x7f8e49
mov edx, dword [esp]
rdtsc
lea esi, [esi + 0xc]
not edx
adc dx, bx
cmc
jmp 0x7f8f2e
mov edx, 0x9f8ac11
xchg dword [esp + 8], esi
not edx
rdtsc
mov ah, byte [esp]
push dword [esp + 8]
ret 0xc

Function at 0x8178d3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x8179e8
push dword [esp + 0xb]
lea esp, [esp + 1]
jmp 0x8179b9
movzx ebx, byte [ebp]
pop ebp
stc
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
call fcn.00817904
bswap ebx
mov ebx, 0x417290dc
bsr bx, sp
movzx ebx, byte [esi + 5]
push ecx
jmp 0x817965
push word [esp + 2]
pop word [esp + 1]
and edx, ecx
jmp 0x81798d
push ebp
mov ebp, esi
add ebp, 2
jmp 0x81791a
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
and edx, ecx
pushal
jmp 0x8179cb
mov edx, dword [esi + 4]
mov dword [esi], edi
lea edi, [eax*4]
push edi
jmp 0x817a12
and ebx, ecx
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
not bx
jmp 0x817985
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
pushal
mov edx, eax
mov dx, 0x41a5
pop dword [esp + 0xb]
jmp 0x817999
and edi, ecx
sub esp, 0xc
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
sub esp, 0x19
jmp 0x8178d8
dec edi
shl ax, cl
mov dword [esp], edx
popal
sub esp, 0xe
push dword [esp + 0xb]
jmp 0x817a25
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
mov edi, dword [esp]
pushal
lea ebp, [ebp - 0xcc]
jmp 0x8179fc
lea esp, [esp + 2]
shr edi, 0x18
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
stc
jmp 0x817a7b
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x817a61
and ebx, ecx
call fcn.00817b15
jp 0x817a67
add byte [edx - 3], bh
insd dword es:[edi], dx
hlt
push bx
lea esp, [esp + 2]
and edi, ecx
stc
jmp 0x817a36

Function at 0x817af3
Capabilities:
Encrypt data using aes

Disassembly:
stc
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
push ax
cmc
jmp 0x817ac1
Function at 0x817b15
Capabilities:
Encrypt data using aes

Disassembly:
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
mov bh, byte [esp]
pushfd
movzx ebx, byte [esi + 9]
jmp 0x817aba
and ebx, ecx
sub esp, 2
push word [esp]
lea esp, [esp + 4]
jmp 0x817a86
and edx, ecx
call fcn.00817af3
add esp, 0
mov byte [esp], al
lea esp, [esp + 2]
jmp 0x817b36
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x817aab
pop word [esp]
clc
lea esp, [esp + 2]
jmp 0x817adb
lea edx, reloc.WINMM.dll_midiStreamStop
mov edx, edi
jmp 0x817b46
and edx, ecx
stc
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x817b20
mov edx, dword [esi + 8]
call fcn.00817b9e
inc esp
fisttp dword [ebx + 0x2e]
fstp qword [edx]
stosb byte es:[edi], al
cmp al, 0xd2
mov ch, 0x44
cmc
mov dword [eax], ebp

Function at 0x817c96
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x817d03
and edx, ecx
cmc
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
call fcn.00817ce9
mov edi, edx
sub esp, 2
sub esp, 0xe
jmp 0x817d66
and edi, ecx
sub esp, 0x18
pop dword [esp + 0xd]
jmp 0x817d74
shr edi, 0x18
clc
clc
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x817d50
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
sub esp, 4
jmp 0x817fe0
and ebx, ecx
call fcn.00817dc9

Function at 0x817ce9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 0
mov dl, byte [esp + 3]
jmp 0x817ceb
jmp 0x817cd3
mov edx, dword [esi + 0xc]
jmp 0x817d48
mov dword [esi + 8], edi
call 0x817d2c

Function at 0x817d8b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and ebx, ecx
stc
sub esp, 3
lea esp, [esp + 3]
jmp 0x817c81
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x817c28
push eax
pushal
mov dword [esp + 0x1c], esi
pushfd
jmp 0x817c66
lea esp, [esp + 4]
popal
add eax, 0xd
movzx ebx, byte [eax]
pop eax
jmp 0x817cac
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
pushfd
btr bx, di
ror bx, cl
mov bx, 0x7dbd
jmp 0x817c59
and edx, ecx
call fcn.00817c96
mov byte [0x2fdcb525], al
xchg edx, eax
fcom qword [esi - 0x3c]
mov dword [reloc.WINMM.dll_midiStreamStop], eax
stc
fcomp dword [esi + 0x21242489]
retf
pushfd
mov word [esp], sp
and ebx, ecx
lea esp, [esp + 0x14]
jmp 0x817c45
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamStop]
jmp 0x817cc3

Function at 0x817dc9
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
push cx
lea esp, [esp + 2]
jmp 0x817f47
lea ebx, [esp - 0x1f]
movzx ebx, byte [esi + 0xe]
push bp
push edi
lea esp, [esp + 2]
jmp 0x817d97
lea esp, [esp + 0x34]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamStop]
adc bh, dh
jmp 0x817dad
Function at 0x818223
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x81822e
pushal
pop word [esp]
mov dword [esp + 9], edi
jmp 0x81820d
lea esp, [esp + 0x20]
jbe 0x7e51de
ja 0x7e528d
xchg edx, eax
adc al, 0x8a
in eax, dx
sbb al, 0xdd
add al, 0x81
adc dword [eax - 0x7d], esi
xor eax, 0x9ceb83c0
jmp 0x8181ea

Function at 0x81824c
Capabilities:
Encrypt data using aes

Disassembly:
call int.00818292
push cx
lea esp, [esp + 2]
jmp 0x818271
push ebp
lea esp, [esp + 4]
cmp al, 0x41
jb 0x7e528d
call fcn.0081820b
adc dword [ecx + reloc.WINMM.dll_midiStreamStop], esi
xor byte [edx + 0x7b24720], dh
xor esi, ebp
cmc
mov edi, eax
lea esp, [esp + 4]
mov al, byte [ecx]
jmp 0x8181cb
jmp 0x8181ea
lea esp, [esp + 4]
jb 0x7e51bf
cmp al, 0x7a
jbe 0x7e51de
ja 0x7e51bf
cmp al, 0xb8
dec ecx
mov eax, 0x3784150a
push ds
imul edi, dword [ecx], reloc.WINMM.dll_midiStreamStop
and al, 2
cmp al, 0x61
pushfd
push sp
lea esp, [esp + 2]
jmp 0x81824e
Function at 0x818314
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jbe 0x7e51f4
ja 0x7e520d
jnp 0x818378
int 0x5c
scasd eax, dword es:[edi]
mov dh, 0x8d
and al, 0x18
sti
popal

Function at 0x81834e
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x818336
cmp bl, 0x30
push si
jmp 0x8183cf
lea esp, [esp + 0x18]
cmp bl, 0x5a
call fcn.00818314
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp 0x818377
lea esp, [esp + 4]
jb 0x7e520d
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x81832a
cmp bl, 0x7a
pushfd
jmp 0x818388
cmp bl, 0x61
jb 0x7e5239
cld
jmp dword [esi + 0x56]
push si
lea esp, [esp + 2]
jmp 0x818361
lea esp, [esp + 4]
jbe 0x7e51f4
ja 0x7e5239
mov ebx, 0x2adfb82a
jmp 0x81837e
cmp bl, 0x39
push bp
lea esp, [esp + 2]
jmp 0x8186fa
mov word [esp], dx
mov word [esp], bx
lea esp, [esp + 2]
jb 0x7e5223
jae 0x8183b9
mul dword gs:[edi + 2]
int1
dec ebx
jge 0x8183d3
jle 0x818406
call 0x27b60950
dec esi
fnstcw word [eax]
cld
dec dword [edi]
xchg byte [ebx + 0xffffcce], ch
xchg dword [eax - 0x32], ebx
cld
inc dword [eax - reloc.WINMM.dll_midiStreamStop]
pushfd
into
cld
dec dword [edi]
xchg dword [eax + 0x3fffcce], eax
lahf
punpckhdq mm3, qword [ecx + 0x7c6d7263]
dec edi
Function at 0x8184bb
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 0
lea esp, [esp + 4]
cmp dl, 0x2f
jmp 0x8184a5
Function at 0x8188dd
Capabilities:
Encrypt data using aes

Disassembly:
cmp al, 0x39
push cx
lea esp, [esp + 2]
jne 0x817ee7
push 0x3f
jmp 0x817efd
push dword [esp]
lea esp, [esp + 8]
jmp 0x818861

Function at 0x8188e9
Capabilities:
Encrypt data using speck

Disassembly:
mov edi, dword [ebp + 0xc]
jmp 0x7e53c6
pushfd
jmp 0x818e4f
call fcn.007e5390
or al, 0x9f
out 0x11, al
invalid
pushal
jmp 0x818e37
jmp 0x818d91
lea esp, [esp + 4]
jmp 0x818924
push 0x3f
jmp 0x817fe7
cmp dl, 0x2f
jne 0x818070
pushfd
lea esp, [esp + 4]
jmp 0x81890e
push di
lea esp, [esp + 2]
cmp dl, 0x39
call fcn.00818c2f
shl eax, 0x10
lea esp, [esp + 0x18]
cmp dword [ebp + 0xc], 2
jmp 0x818df3
push eax
mov eax, ecx
add eax, 1
jmp 0x818ddd
movzx edx, byte [eax]
pop eax
jmp 0x818e69
jb 0x7e53dc
mov edx, edi
jmp 0x818dac
movzx ecx, byte [ecx + 2]
stc
jmp 0x818e48
lea esp, [esp + 0x20]
cmp dword [ebp + 0xc], 3
jne 0x7e53b0
clc
jmp 0x818e1f
or eax, ecx
jmp 0x7e53b0
lea esp, [esp + 4]
push ebx
pushal
neg dh
jmp 0x818e89
shl edx, 8
or eax, edx
jmp 0x7e53dc
mov dword [esp + 0x18], edi
and edx, 0xf03915ff
jmp 0x818eb6
mov dword [esp + 0x1c], esi
lea edx, [eax + edx]
jmp 0x818e73
mov ecx, eax
lea esp, [esp + 0x18]
push 0x3f
jmp 0x81a0b1
and edi, edx
lea esp, [esp + 0x10]
jmp 0x7e53c6
lea esp, [esp + 3]
shr edi, 6
cmc
cmc
jmp 0x818efd
lea ebp, [esp + 0x68]
push edx
mov dword [esp + 4], eax
lea esp, [esp + 4]
popal
sub esp, 0x13
jmp 0x818f22
rcr di, 8
rcl edi, 1
pushal
mov ch, byte [esp]
mov esi, dword [esp]
jmp 0x818f50
lea esp, [esp + 2]
lea esp, [esp + 4]
cmp dword [ebp + 0xc], 2
jb 0x7e5387
jae 0x818f99
shr esi, 0xc
and ecx, edx
and esi, edx
sub esp, 2
jmp 0x819035
mov esi, eax
shr ecx, 0x12
mov edx, dword [esp]
jmp 0x81908d

Function at 0x8ee552
Capabilities:
Parse pe header

Disassembly:
mov word [esp], ax
mov word [esp], dx
push dword [esp]
mov dword [esp + 4], ecx
jmp 0x8ee5a8
mov dword [esp], edx

Function at 0x8ee58d
Capabilities:
Parse pe header

Disassembly:
jmp 0x8ee5d5
mov byte [esp + 1], dh
call fcn.008ee58f

Function at 0x8ee58f
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop dword [esp]
lea esp, [esp + 1]
lea esp, [esp + 3]
push esp
push ecx
jmp 0x8ee5bf

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x717736f8
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x9872658
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401091
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x403fa0
push 0xffffffffffffffff
push 0x4256ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 4], esi
mov dword [esi + 0x14], eax
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0x18], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
lea ecx, [esi + 0x74]
mov byte [esp + 0x10], 4
call fcn.00410b50
mov ecx, esi
mov byte [esp + 0x10], 5
call fcn.00401122
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4010c8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x403740
push 0xffffffffffffffff
push 0x42527f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 4], esi
mov dword [esi + 0x14], eax
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0x18], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [esp + 0x10], 3
call fcn.00410b50
lea ecx, [esi + 0x7c]
mov byte [esp + 0x10], 4
call fcn.00414a20
mov ecx, esi
mov byte [esp + 0x10], 5
call fcn.004010b4
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x401127
Capabilities:
Create directory

Disassembly:
jmp 0x40ac50
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x160]
call fcn.00414530
mov ecx, dword [esi + 0x15c]
xor ebp, ebp
mov dword [esi + 0x160], ebp
call fcn.00414530
mov ecx, 0x280
mov dword [esi + 0x15c], ebp
mov dword [esi + 0x2fc], ebp
mov dword [esi + 0x2f8], ebp
mov dword [esi + 0x2f4], ebp
call fcn.00414510
cmp eax, ebp
mov dword [esi + 0x15c], eax
jne 0x40acae
push str.Unable_to_allocate_memory_for_level_editor_bricks.
call fcn.00412fa0
add esp, 4
pop esi
pop ebp
ret
mov ecx, 0x8000
call fcn.00414510
cmp eax, ebp
mov dword [esi + 0x160], eax
jne 0x40acd2
push str.Unable_to_allocate_memory_for_level_editor_sparks.
call fcn.00412fa0
add esp, 4
pop esi
pop ebp
ret
push ebx
push edi
push ebp
push 0x42b2b4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edi, [esi + 0xc4]
lea ebx, [esi + 0xa8]
push edi
push ebx
push 0xc
push 0x5a
push 0x258
push 0x186
push 0x14
lea ecx, [esi + 0x18c]
mov dword [esi + 0x174], 0x50
mov dword [esi + 0x178], 0x195
mov dword [esi + 0x17c], 0x1e0
mov dword [esi + 0x180], 0x3c
mov dword [esi + 0x184], 1
call fcn.00414680
push edi
push ebx
push 0xc
push 0x2d
push 0x258
push ebp
push 0x14
lea ecx, [esi + 0x1ac]
call fcn.00414680
lea edi, [esi + 0x138]
lea ebx, [esi + 0xe0]
push edi
push ebx
push 0x14
push 0x5f
push 0xc
push 0x26
push 0x42b2b8
lea ecx, [esi + 0x1ec]
call fcn.004148c0
push edi
push ebx
push 0x14
push 0x5f
push 0xc
push 0x9a
push str.Save
lea ecx, [esi + 0x20c]
call fcn.004148c0
push edi
push ebx
push 0x14
push 0x5f
push 0xc
push 0x10e
push str.Load
lea ecx, [esi + 0x22c]
call fcn.004148c0
push edi
push ebx
push 0x14
push 0x5f
push 0xc
push 0x182
push str.Play
lea ecx, [esi + 0x24c]
call fcn.004148c0
push edi
push ebx
push 0x14
push 0x5f
push 0xc
push 0x1f6
push str.Menu
lea ecx, [esi + 0x26c]
call fcn.004148c0
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4101b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4257b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
push eax
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], ebx
call fcn.00415270
cmp eax, ebx
je 0x41021c
mov ecx, eax
call fcn.00413010
push eax
push esi
push 0x42c650
call fcn.00412fa0
add esp, 0xc
mov ecx, dword [esp + 0x38]
push 1
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ecx
lea ecx, [esp + 0x2c]
call fcn.00415870
cmp eax, ebx
je 0x41024c
mov ecx, eax
call fcn.00413010
push eax
push esi
push str.Failed_to_load_palette_from_png:___s.____s_
call fcn.00412fa0
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00415450
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00415450
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc

Function at 0x411590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42580a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x24], bl
mov al, byte [esi + 0x10c]
mov dword [esp + 0x30], ebx
cmp al, bl
je 0x411667
mov eax, dword [esi]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp eax, ebx
je 0x411604
mov ecx, eax
call fcn.00413010
lea edx, [esi + 0xc]
push eax
push edx
push str.Failed_to_restore_DirectSound_buffer.___s____s_
call fcn.00412fa0
add esp, 0xc
lea eax, [esi + 0x8c]
lea edi, [esi + 0xc]
push eax
push edi
lea ecx, [esp + 0x14]
call fcn.00415270
cmp eax, ebx
je 0x411634
mov ecx, eax
call fcn.00413010
push eax
push edi
push 0x42caa0
call fcn.00412fa0
add esp, 0xc
jmp 0x411667
mov ecx, dword [esi]
push ebx
push ebx
push ecx
lea ecx, [esp + 0x18]
call fcn.00415a30
cmp eax, ebx
je 0x41165e
mov ecx, eax
call fcn.00413010
push eax
push edi
push str.Failed_to_load_wav_data_to_buffer:___s____s_
call fcn.00412fa0
add esp, 0xc
jmp 0x411667
lea ecx, [esp + 0xc]
call fcn.00415450
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00415450
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4145e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x4378a4]
push esi
test eax, eax
mov esi, ecx
jne 0x414600
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [0x4378a4], eax
cmp esi, 2
jne 0x414634
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp eax, 1
jne 0x414622
push 2
call esi
test ah, 0x80
je 0x41461d
mov al, 1
pop esi
ret
mov eax, dword [0x4378a4]
cmp eax, 2
jne 0x41467c
push 1
call esi
test ah, 0x80
je 0x41467c
mov al, 1
pop esi
ret
cmp esi, 1
jne 0x41464a
push 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x41467c
mov al, 1
pop esi
ret
test esi, esi
jne 0x41467c
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp eax, 1
jne 0x41466b
push 1
call esi
test ah, 0x80
je 0x414666
mov al, 1
pop esi
ret
mov eax, dword [0x4378a4]
cmp eax, 2
jne 0x41467c
push eax
call esi
test ah, 0x80
je 0x41467c
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x415270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x128]
xor ebx, ebx
cmp edi, ebx
mov esi, ecx
jne 0x41528f
mov byte [esi + 0x18], 1
jmp 0x4152a4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4152a1
mov byte [esi + 0x18], 1
jmp 0x4152a4
mov byte [esi + 0x18], bl
mov ebp, dword [esp + 0x12c]
push str.GLOM
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, ebx
je 0x4152fe
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push ebx
mov dword [esi + 8], eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi + 0x14], eax
cmp dword [esi + 8], ebx
jne 0x41531f
cmp dword [esi + 4], ebx
jne 0x41531f
cmp dword [esi], ebx
jne 0x41531f
pop edi
pop esi
pop ebp
mov eax, 0x87770010
pop ebx
add esp, 0x114
ret 8
push ebx
push ebx
push ebp
call dword [sym.imp.WINMM.dll_mmioOpenA]
cmp eax, ebx
mov dword [esi], eax
jne 0x4152de
pop edi
pop esi
pop ebp
mov eax, 0x87770006
pop ebx
add esp, 0x114
ret 8
cmp byte [esi + 0x18], bl
jne 0x41542a
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 4
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
call fcn.00415660
cmp eax, ebx
jne 0x415438
mov eax, dword [esp + 0x10]
xor edi, edi
cmp eax, ebx
jbe 0x4153df
lea ecx, [esp + 0x1c]
push ecx
push 4
mov ecx, esi
call fcn.00415660
cmp eax, ebx
jne 0x415438
mov eax, dword [esp + 0x1c]
lea edx, [eax + 1]
cmp edx, 0x104
ja 0x4153cd
lea ecx, [esp + 0x20]
push ecx
push eax
mov ecx, esi
call fcn.00415660
cmp eax, ebx
jne 0x415438
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push 4
mov ecx, esi
mov byte [esp + edx + 0x28], bl
call fcn.00415660
cmp eax, ebx
jne 0x415438
lea ecx, [esp + 0x14]
push ecx
push 4
mov ecx, esi
call fcn.00415660
cmp eax, ebx
jne 0x415438
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jae 0x4153df
jmp 0x415358
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
add esp, 0x114
ret 8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add eax, edx
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x415402
pop edi
pop esi
pop ebp
mov eax, 0x87770011
pop ebx
add esp, 0x114
ret 8
mov eax, dword [esp + 0x128]
lea ecx, [esi + 0x10]
lea edx, [esi + 0xc]
push ecx
push edx
push eax
mov ecx, esi
call fcn.00415470
cmp eax, ebx
je 0x415436
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 8
or eax, 0xffffffff
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 8
Function at 0x417df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c4
push ebx
push ebp
mov ebp, dword [esp + 0x6d0]
push esi
mov ebx, ecx
push edi
mov ecx, 0x11f
xor eax, eax
lea edi, [esp + 0x258]
mov dword [esp + 0x10], ebx
test ebp, ebp
mov dword [ebx + 0x2d4], ebp
rep stosd dword es:[edi], eax
jbe 0x417e44
mov esi, dword [esp + 0x6dc]
mov ecx, ebp
lea edi, [esp + 0x258]
lea edx, [ebx + 0x96]
rep movsd dword es:[edi], dword [esi]
mov word [edx], ax
inc eax
add edx, 2
cmp eax, ebp
jb 0x417e39
lea eax, [ebp - 1]
test eax, eax
jbe 0x417ed4
mov eax, dword [esp + 0x10]
mov edi, 1
mov dword [esp + 0x18], edi
lea ebx, [esp + 0x258]
lea edx, [eax + 0x96]
cmp edi, ebp
jae 0x417ebb
mov eax, ebp
lea esi, [ebx + 4]
sub eax, edi
lea ecx, [edx + 2]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov edi, dword [ebx]
cmp eax, edi
jb 0x417e94
jne 0x417ea6
mov bp, word [ecx]
cmp bp, word [edx]
mov ebp, dword [esp + 0x6d8]
jae 0x417ea6
mov dword [esi], edi
mov di, word [edx]
mov dword [ebx], eax
xor eax, eax
mov ax, word [ecx]
mov word [ecx], di
mov word [edx], ax
mov eax, dword [esp + 0x14]
add ecx, 2
add esi, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x417e7b
mov edi, dword [esp + 0x18]
inc edi
lea eax, [ebp - 1]
add ebx, 4
add edx, 2
lea ecx, [edi - 1]
mov dword [esp + 0x18], edi
cmp ecx, eax
jb 0x417e69
mov ebx, dword [esp + 0x10]
mov ecx, 0x8f
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
xor ecx, ecx
xor edi, edi
test ebp, ebp
jbe 0x417f20
lea esi, [esp + 0x1c]
lea edx, [esp + 0x258]
mov dword [esp + 0x10], ebp
mov eax, dword [edx]
cmp ecx, eax
je 0x417f07
sub eax, ecx
add ecx, eax
shl edi, 1
dec eax
jne 0x417f02
test ecx, ecx
je 0x417f0f
mov word [esi], di
inc edi
mov eax, dword [esp + 0x10]
add edx, 4
add esi, 2
dec eax
mov dword [esp + 0x10], eax
jne 0x417ef8
mov eax, ebx
lea ecx, [ebx + 0x78]
mov edx, 0xf
mov esi, 0xfffffff
mov word [ecx], 0
mov dword [eax + 0x3c], esi
mov dword [eax], 0xffffffff
add ecx, 2
add eax, 4
dec edx
jne 0x417f2f
xor ecx, ecx
xor eax, eax
test ebp, ebp
jbe 0x417f87
lea edx, [esp + 0x1c]
lea edi, [esp + 0x258]
mov esi, dword [edi]
cmp eax, esi
je 0x417f6f
mov eax, esi
xor esi, esi
mov si, word [edx]
mov word [ebx + eax*2 + 0x76], cx
mov dword [ebx + eax*4 + 0x38], esi
test eax, eax
je 0x417f7c
xor esi, esi
mov si, word [edx]
mov dword [ebx + eax*4 - 4], esi
inc ecx
add edi, 4
add edx, 2
cmp ecx, ebp
jb 0x417f59
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c4
ret 8

Function at 0x419b1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427748
push 0x41b70c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [0x43790c]
test eax, eax
je 0x419b64
mov dword [ebp - 4], 1
call eax
jmp 0x419b60
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x419b6d
jmp 0x41d004
push 0xa
call fcn.0041b81d
push 0x16
call fcn.0041e5c2
pop ecx
pop ecx
push 3
call fcn.0041914c