joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fa00
Capabilities:
Create directory

Disassembly:
sub esp, 0x58
mov eax, dword [0x44d890]
xor eax, esp
mov dword [esp + 0x54], eax
mov eax, dword [0x19b82c0]
lea edx, [esp + 4]
push edx
mov dword [esp + 4], 0
mov ecx, dword [eax]
push 0
push eax
mov eax, dword [ecx + 0x20]
call eax
mov eax, dword [0x19b82c0]
mov ecx, dword [eax]
push 0
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x10]
push 2
push 0x15
push edx
mov edx, dword [esp + 0x18]
push edx
push eax
mov eax, dword [ecx + 0x90]
call eax
mov ecx, dword [esp]
test ecx, ecx
jne 0x41fa7e
push str._Error__CopyHARDToDIB__:
call fcn.0042ec60
push str.Failed_to_create_surface__n
call fcn.0042ec60
add esp, 8
xor al, al
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004305fb
add esp, 0x58
ret
mov eax, dword [0x19b82c0]
mov edx, dword [eax]
push esi
push ecx
push 0
push eax
mov eax, dword [edx + 0x84]
call eax
mov esi, eax
test esi, esi
jns 0x41fb1e
push str._Error__CopyHARDToDIB__:
call fcn.0042ec60
add esp, 4
cmp esi, 0x8876086c
jne 0x41fad0
push str.Invalid_Call_n
call fcn.0042ec60
add esp, 4
pop esi
xor al, al
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004305fb
add esp, 0x58
ret
cmp esi, 0x88760868
jne 0x41faf7
push str.Device_Lost_n
call fcn.0042ec60
add esp, 4
pop esi
xor al, al
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004305fb
add esp, 0x58
ret
cmp esi, 0x88760827
jne 0x41fb6b
push str.Driver_Internal_Error_n
call fcn.0042ec60
add esp, 4
pop esi
xor al, al
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004305fb
add esp, 0x58
ret
push 0
push str.Screenshots
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x174bfd4]
inc eax
push eax
lea ecx, [esp + 0x1c]
push 0x442c3c
push ecx
mov dword [0x174bfd4], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [esp + 0x10]
add esp, 0xc
push 0
push 0
push edx
push 0
lea eax, [esp + 0x28]
push eax
call sub.d3dx9_43.dll_D3DXSaveSurfaceToFileA
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x58]
pop esi
xor ecx, esp
xor al, al
call fcn.004305fb
add esp, 0x58
ret
Function at 0x42c310
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x1991560]
push esi
push edi
push 0xba1c
push 0
push eax
call fcn.0042b5f0
mov esi, dword [esp + 0x1c]
add esp, 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push 0x8000
mov dword [esi], eax
mov edx, dword [0x19e8308]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
lea ebx, [ebx]
mov edx, 0x20
mov ecx, dword [esi]
cmp word [ecx + eax], 0
jne 0x42c367
mov edi, 1
mov word [ecx + eax], di
mov ecx, dword [esi]
cmp word [eax + ecx + 2], 0
lea ecx, [eax + ecx + 2]
jne 0x42c37d
mov edi, 1
mov word [ecx], di
mov ecx, dword [esi]
cmp word [eax + ecx + 4], 0
lea ecx, [eax + ecx + 4]
jne 0x42c393
mov edi, 1
mov word [ecx], di
mov ecx, dword [esi]
cmp word [eax + ecx + 6], 0
lea ecx, [eax + ecx + 6]
jne 0x42c3a9
mov edi, 1
mov word [ecx], di
add eax, 8
dec edx
jne 0x42c355
cmp eax, 0x8000
jl 0x42c350
mov edx, dword [esi]
push 0x4000
push edx
call fcn.0042bf50
mov eax, dword [esi]
lea ecx, [eax + 0xba18]
push ecx
lea edx, [eax + 0xba14]
push edx
lea ecx, [eax + 0xba10]
push ecx
push 0x4000
push eax
call fcn.0042c290
mov eax, dword [esi]
push 0x40
lea edx, [eax + 0x8000]
push edx
push eax
call fcn.0042c010
mov eax, dword [esi]
lea ecx, [eax + 0xa000]
push 0x20
push ecx
add eax, 0x8000
push eax
call fcn.0042c010
mov eax, dword [esi]
lea edx, [eax + 0xa800]
push 0x10
push edx
add eax, 0xa000
push eax
call fcn.0042c010
mov eax, dword [esi]
add esp, 0x40
push 0xba1c
push eax
call fcn.0042c250
add esp, 8
pop edi
pop esi
pop ecx
ret

Function at 0x42c440
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x6925a8]
mov ecx, dword [0x19e8308]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push 1
push 0
shl eax, 0x11
push eax
push ecx
call esi
mov edx, dword [0x19e8308]
push 0
push 0x19e830c
push 0x20000
push 0x892600
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [0x19e8308]
push 1
mov eax, 2
sub eax, dword [0x6925a8]
push 0
shl eax, 0x11
push eax
push ecx
call esi
push 0x10000
push 0x892600
call fcn.0042bf50
add esp, 8
mov esi, 0x892600
mov eax, 0x8c01b0
mov ecx, esi
mov edx, 0x80
jmp 0x42c4c0
mov di, word [ecx]
mov word [eax], di
add ecx, 4
add eax, 2
dec edx
jne 0x42c4c0
add esi, 0x400
cmp eax, 0x8c81b0
jl 0x42c4b4
mov edi, 0x8c81b0
mov esi, 0x10
push esi
push edi
push 0x8c01b0
call fcn.0042c160
add esi, 0x20
add esp, 0xc
add edi, 0x8000
cmp esi, 0xf0
jl 0x42c4e6
push 0xfa
push 0x9001b0
push 0x8c01b0
call fcn.0042c160
add esp, 0xc
pop edi
pop esi
ret
Function at 0x42c6d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x1991560]
push esi
push edi
push 0x30020
push 0
push eax
call fcn.0042b5f0
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
push 0
push 0x19e830c
push 4
mov dword [esi], eax
mov ecx, dword [0x19e8308]
push eax
push ecx
call edi
mov edx, dword [esi]
mov eax, dword [0x19e8308]
push 0
push 0x19e830c
push 4
add edx, 4
push edx
push eax
call edi
mov ecx, dword [0x19e8308]
push 0
push 0x19e830c
push 4
push 0x1951c5c
push ecx
call edi
mov edx, dword [esi]
mov eax, dword [0x19e8308]
push 0
push 0x19e830c
push 4
add edx, 8
push edx
push eax
call edi
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov edx, dword [0x19e8308]
push 0
push 0x19e830c
shl ecx, 6
push ecx
add eax, 0x8010
push eax
push edx
call edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [0x19e8308]
push 0
push 0x19e830c
shl ecx, 4
push ecx
add eax, 0x10
push eax
push edx
call edi
mov eax, dword [0x1951c5c]
mov ecx, dword [0x19e8308]
push 0
push 0x19e830c
lea eax, [eax + eax*2]
shl eax, 4
push eax
push 0x1951c60
push ecx
call edi
cmp dword [0x54f6cc], 0
je 0x42c7bb
mov edx, dword [esi]
push edx
call fcn.0041cf90
add esp, 4
cmp dword [0x54f6cc], 0
mov eax, dword [esi]
push ebx
mov ebx, dword [eax + 8]
je 0x42c7d3
mov dword [eax + 0xc], 0x100
jmp 0x42c7db
mov ecx, ebx
sar ecx, 9
mov dword [eax + 0xc], ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
shl edx, 9
mov dword [eax + 8], edx
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov edx, dword [0x1991560]
push ecx
push 0
push edx
call fcn.0042b5f0
mov ecx, dword [esi]
add esp, 0xc
push 0
mov dword [ecx + 0x28010], eax
mov edx, dword [esi]
mov eax, dword [edx + 0x28010]
mov ecx, dword [0x19e8308]
push 0x19e830c
push ebx
push eax
push ecx
call edi
mov eax, ebx
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
push eax
mov eax, dword [edx + 0x28010]
push eax
call fcn.0042bf50
mov ecx, dword [esi]
add esp, 8
xor edx, edx
pop ebx
cmp dword [ecx], edx
jle 0x42c880
fld qword [0x4416f8]
xor ecx, ecx
fld qword [0x443048]
mov eax, dword [esi]
fld dword [eax + ecx + 0x10]
add eax, ecx
fmul st(2)
inc edx
fstp dword [eax + 0x10]
fld dword [eax + 0x14]
fmul st(2)
fstp dword [eax + 0x14]
mov eax, dword [esi]
fld dword [ecx + eax + 0x18]
lea eax, [ecx + eax + 0x18]
fmul st(1)
add ecx, 0x10
fstp dword [eax]
mov eax, dword [esi]
cmp edx, dword [eax]
jl 0x42c84f
fstp st(1)
fstp st(0)
mov ecx, dword [esi]
push ecx
call fcn.0042c560
mov esi, dword [esi]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x28010]
push edx
push eax
call fcn.0042c250
add esp, 0xc
pop edi
pop esi
ret
Function at 0x42c8a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov edx, dword [0x19e8308]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push edx
call edi
mov edx, dword [0x19e8308]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push edx
call edi
mov ebx, dword [esp + 0x18]
mov ecx, dword [0x19e8308]
push 0
lea eax, [esp + 0x10]
push eax
push 4
push ebx
push ecx
call edi
mov eax, dword [0x19e8308]
push 0
lea edx, [esp + 0x10]
push edx
push 4
lea esi, [ebx + 4]
push esi
push eax
call edi
inc dword [esi]
mov ecx, dword [esi]
mov eax, ecx
imul ecx, dword [esp + 0x10]
imul eax, eax, 0x3e8
cdq
idiv dword [ebx]
lea ecx, [ecx + ecx*2]
add ecx, ecx
push ecx
push 0
mov dword [ebx + 8], eax
mov edx, dword [0x1991560]
push edx
call fcn.0042b5f0
mov esi, dword [esi]
imul esi, dword [esp + 0x1c]
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esi + esi*2]
add edx, edx
push edx
push eax
mov dword [ebx + 0xc], eax
mov eax, dword [0x19e8308]
push eax
call edi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x42c960
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x204
mov eax, dword [0x44d890]
xor eax, esp
mov dword [esp + 0x200], eax
push esi
mov esi, dword [esp + 0x20c]
push edi
mov edi, dword [esp + 0x214]
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_2
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x19e8308], eax
cmp eax, 0xffffffff
jne 0x42c9c5
push edi
lea eax, [esp + 0xc]
push str.Error_opening_model_file_n_s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x14]
push ecx
call fcn.0041a670
add esp, 0x10
mov edx, dword [0x1991560]
push ebx
push 0x30020
push 0
push edx
call fcn.0042b5f0
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
push 0
push 0x19e830c
push 4
push eax
mov dword [esi], eax
mov eax, dword [0x19e8308]
push eax
call edi
mov ecx, dword [esi]
mov edx, dword [0x19e8308]
push 0
push 0x19e830c
push 4
add ecx, 4
push ecx
push edx
call edi
mov eax, dword [0x19e8308]
push 0
push 0x19e830c
push 4
push 0x1951c5c
push eax
call edi
mov ecx, dword [esi]
mov edx, dword [0x19e8308]
push 0
push 0x19e830c
push 4
add ecx, 8
push ecx
push edx
call edi
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov edx, dword [0x19e8308]
push 0
push 0x19e830c
shl ecx, 6
push ecx
add eax, 0x8010
push eax
push edx
call edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [0x19e8308]
push 0
push 0x19e830c
shl ecx, 4
push ecx
add eax, 0x10
push eax
push edx
call edi
mov eax, dword [0x1951c5c]
mov ecx, dword [0x19e8308]
push 0
push 0x19e830c
lea eax, [eax + eax*2]
shl eax, 4
push eax
push 0x1951c60
push ecx
call edi
cmp dword [0x54f6cc], 0
mov eax, dword [esi]
mov ebx, dword [eax + 8]
je 0x42caaf
mov dword [eax + 0xc], 0x100
jmp 0x42cab7
mov edx, ebx
sar edx, 9
mov dword [eax + 0xc], edx
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
shl ecx, 9
mov dword [eax + 8], ecx
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, dword [0x1991560]
push eax
push 0
push ecx
call fcn.0042b5f0
mov edx, dword [esi]
add esp, 0xc
push 0
mov dword [edx + 0x28010], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x28010]
mov edx, dword [0x19e8308]
push 0x19e830c
push ebx
push ecx
push edx
call edi
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x28010]
push ecx
call fcn.0042bf50
mov eax, dword [esi]
add esp, 8
xor edx, edx
pop ebx
cmp dword [eax], edx
jle 0x42cb5c
fld qword [0x4416f8]
xor ecx, ecx
fld qword [0x443048]
mov eax, dword [esi]
fld dword [eax + ecx + 0x10]
add eax, ecx
fmul st(2)
inc edx
fstp dword [eax + 0x10]
fld dword [eax + 0x14]
fmul st(2)
fstp dword [eax + 0x14]
mov eax, dword [esi]
fld dword [eax + ecx + 0x18]
lea eax, [eax + ecx + 0x18]
fmul st(1)
add ecx, 0x10
fstp dword [eax]
mov eax, dword [esi]
cmp edx, dword [eax]
jl 0x42cb2b
fstp st(1)
fstp st(0)
mov ecx, dword [esi]
push ecx
call fcn.0042c560
mov esi, dword [esi]
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x28010]
push edx
push eax
call fcn.0042c250
mov ecx, dword [esp + 0x214]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.004305fb
add esp, 0x204
ret
Function at 0x42cb90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x44d890]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_2
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42cbf4
push edi
lea eax, [esp + 0x20]
push str.Error_opening_sound_file_n_s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x28]
push ecx
call fcn.0041a670
add esp, 0x10
mov edx, dword [ebp + 4]
mov eax, dword [0x1991560]
push edx
push 0
push eax
call fcn.0042b630
add esp, 0xc
push 0
push 0
push 0x24
push esi
mov dword [ebp + 4], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov byte [esp + 0x18], 0
lea ecx, [ecx]
push 0
lea ecx, [esp + 0x14]
push ecx
push 1
lea edx, [esp + 0x20]
push edx
push esi
call edi
cmp byte [esp + 0x14], 0x64
jne 0x42cc30
push 0
lea eax, [esp + 0x14]
push eax
push 3
lea ecx, [esp + 0x21]
push ecx
push esi
call edi
push str.data
lea edx, [esp + 0x18]
push edx
call ebx
test eax, eax
je 0x42cc78
push 1
push 0
push 0xfffffffffffffffd
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x42cc30
push 0
lea eax, [esp + 0x14]
push eax
push 4
push ebp
push esi
call edi
mov ecx, dword [ebp]
mov edx, dword [0x1991560]
push ecx
push 0
push edx
call fcn.0042b5f0
mov edx, dword [ebp]
add esp, 0xc
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push esi
mov dword [ebp + 4], eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004305fb
add esp, 0x210
ret
Function at 0x42cdc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x208
mov eax, dword [0x44d890]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x220]
push 0
push 0x80
push 3
push 0
push 0
push Ordinal_2
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x42ce24
push edi
lea eax, [esp + 0x18]
push str.Error_opening_picture_file_n_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x20]
push ecx
call fcn.0041a670
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0xc
push ebp
call ebx
push 0
lea edx, [esp + 0x14]
push edx
push 2
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea edi, [esi + 2]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0x12
push ebp
call ebx
mov eax, dword [esi + 4]
xor ebx, ebx
mov dword [esi + 8], ebx
cmp eax, ebx
je 0x42ce76
push eax
call fcn.0043121a
add esp, 4
movzx ecx, word [esi]
movzx eax, word [edi]
imul eax, ecx
xor ecx, ecx
mov edx, 2
mul edx
seto cl
mov dword [esi + 4], ebx
neg ecx
or ecx, eax
push ecx
call fcn.00431830
mov dword [esi + 4], eax
xor eax, eax
add esp, 4
cmp ax, word [edi]
jae 0x42ced2
movzx eax, word [esi]
push 0
lea ecx, [esp + 0x14]
push ecx
movzx ecx, word [edi]
sub ecx, ebx
dec ecx
imul ecx, eax
lea edx, [eax + eax]
push edx
mov edx, dword [esi + 4]
lea eax, [edx + ecx*2]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx ecx, word [edi]
inc ebx
cmp ebx, ecx
jl 0x42cea5
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004305fb
add esp, 0x208
ret
Function at 0x42d230
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x1991560]
sub esp, 0x14
push esi
push 0x8000
push 0
push eax
call fcn.0042b5f0
mov esi, dword [esp + 0x28]
add esp, 0xc
push 0
push 0x19e830c
push 0x8000
mov dword [esi + 0x130], eax
mov ecx, dword [0x19e8308]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esi + 0x130]
push 0x4000
push edx
call fcn.0042bf50
mov eax, dword [esi + 0x130]
push 0x8000
push eax
call fcn.0042c250
add esp, 0x10
cmp dword [0x54f6cc], 0
je 0x42d34e
push ebx
push edi
mov ebx, 0x200
jmp 0x42d2b0
mov eax, ebx
mov edi, 0x20
jmp 0x42d2c0
mov ecx, dword [esi + 0x130]
cmp word [eax + ecx - 0x200], 0
lea ecx, [eax + ecx - 0x200]
je 0x42d2e0
mov edx, 0x8000
or word [ecx], dx
mov ecx, dword [esi + 0x130]
lea edx, [eax + ecx - 0x100]
movzx ecx, word [edx]
test cx, cx
je 0x42d2fe
or ecx, 0x8000
mov word [edx], cx
mov edx, dword [esi + 0x130]
movzx ecx, word [edx + eax]
test cx, cx
je 0x42d317
or ecx, 0x8000
mov word [edx + eax], cx
mov ecx, dword [esi + 0x130]
lea edx, [eax + ecx + 0x100]
movzx ecx, word [edx]
test cx, cx
je 0x42d335
or ecx, 0x8000
mov word [edx], cx
add eax, 0x400
dec edi
jne 0x42d2c0
add ebx, 2
cmp ebx, 0x300
jl 0x42d2b0
pop edi
pop ebx
mov eax, dword [esi + 0x138]
cmp dword [eax], 0
fld dword [eax + 0x10]
fld qword [0x4414c0]
lea ecx, [eax + 0x14]
fadd st(1), st(0)
fxch st(1)
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fst dword [esp + 8]
fld dword [eax + 0x10]
fsub st(2)
fstp dword [esp + 0x1c]
fstp dword [esp + 4]
fsubr dword [ecx]
fstp dword [esp + 0xc]
jle 0x42d3f7
mov edx, dword [eax]
lea ebx, [ebx]
fld dword [ecx - 4]
fstp dword [esp + 0x10]
fld dword [ecx]
fstp dword [esp + 0x14]
fld dword [esp + 0x10]
fld dword [esp + 8]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x42d3b2
fst dword [esp + 8]
fld dword [esp + 0x1c]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x42d3c5
fstp dword [esp + 0x1c]
jmp 0x42d3c7
fstp st(0)
fld dword [esp + 0x14]
fld dword [esp + 4]
fcomp st(1)
fnstsw ax
test ah, 5
jp 0x42d3dc
fst dword [esp + 4]
fld dword [esp + 0xc]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x42d3ef
fstp dword [esp + 0xc]
jmp 0x42d3f1
fstp st(0)
add ecx, 0x10
dec edx
jne 0x42d390
fld dword [esp + 0x1c]
fst dword [esi + 0x100]
fld dword [esp + 4]
fst dword [esi + 0x104]
fldz
fst dword [esi + 0x108]
fld dword [esp + 8]
fst dword [esi + 0x10c]
fstp dword [esi + 0x118]
fxch st(1)
fstp dword [esi + 0x110]
fst dword [esi + 0x114]
fld dword [esp + 0xc]
fst dword [esi + 0x11c]
fstp dword [esi + 0x128]
fst dword [esi + 0x120]
fstp dword [esi + 0x12c]
fstp dword [esi + 0x124]
pop esi
add esp, 0x14
ret
Function at 0x42dbb0
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x54
mov eax, dword [0x44d890]
xor eax, esp
mov dword [esp + 0x50], eax
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
call fcn.0041fa00
test al, al
je 0x42dd99
mov ecx, dword [0x107f860]
mov eax, dword [0xc5e4fc]
mov dword [esp + 0x20], eax
imul eax, ecx
push ebx
push ebp
mov edx, 1
mov word [esp + 0x2c], dx
xor ebp, ebp
push edi
lea eax, [eax + eax*2]
mov edx, 0x18
mov dword [esp + 0x28], ecx
mov word [esp + 0x32], dx
mov dword [esp + 0x38], eax
push ebp
mov ecx, 0x4d42
add eax, 0x36
xor edx, edx
push str.Screenshots
mov dword [esp + 0x2c], 0x28
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebp
mov word [esp + 0x1c], cx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], edx
mov dword [esp + 0x26], 0x36
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x174bfd4]
inc eax
push eax
lea ecx, [esp + 0x50]
push 0x442c3c
push ecx
mov dword [0x174bfd4], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebp
push 0x80
push 2
push ebp
push ebp
push 0xc0000000
lea edx, [esp + 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov edi, eax
lea eax, [esp + 0x10]
push eax
push 0xe
lea ecx, [esp + 0x20]
push ecx
push edi
call ebx
push ebp
lea edx, [esp + 0x10]
push edx
push 0x28
lea eax, [esp + 0x30]
push eax
push edi
call ebx
mov eax, dword [0x107f860]
lea ecx, [eax + eax*2]
push ecx
call fcn.00431830
add esp, 4
mov dword [esp + 0x10], eax
cmp dword [0xc5e4fc], ebp
jle 0x42dd82
push esi
jmp 0x42dcd0
mov eax, dword [0x107f860]
xor esi, esi
test eax, eax
jle 0x42dd39
mov ecx, dword [esp + 0x14]
add ecx, 2
mov edx, dword [0x8925f0]
sub edx, ebp
imul edx, eax
mov eax, dword [0x1493ef0]
add edx, esi
movzx eax, word [eax + edx*2]
mov dl, al
add dl, dl
add dl, dl
add dl, dl
mov byte [ecx - 2], dl
mov edx, eax
shr edx, 5
add dl, dl
add dl, dl
cmp dword [0x54f6cc], 0
je 0x42dd1b
shr ax, 0xb
jmp 0x42dd21
add dl, dl
shr ax, 0xa
add al, al
add al, al
add al, al
mov byte [ecx], al
mov byte [ecx - 1], dl
mov eax, dword [0x107f860]
inc esi
add ecx, 3
cmp esi, eax
jl 0x42dce2
mov esi, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax*2]
push edx
push esi
push edi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x107f860]
lea ecx, [eax + eax*2]
push ecx
push esi
push edi
call ebx
mov eax, dword [0x107f860]
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [eax + eax*2]
push eax
push esi
push edi
call ebx
inc ebp
cmp ebp, dword [0xc5e4fc]
jl 0x42dcd0
pop esi
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0043121a
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004305fb
add esp, 0x54
ret
Function at 0x42ec60
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
xor esi, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ec70
sub eax, edx
je 0x42eccf
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov al, byte [esi + edi]
mov byte [esp + 0xf], al
cmp al, 0xa
jne 0x42eca4
cmp byte [esi + edi - 1], 0xd
je 0x42eca4
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x4432dc
jmp 0x42ecb2
push 0
lea edx, [esp + 0x14]
push edx
push 1
lea eax, [esp + 0x1b]
push eax
mov ecx, dword [0x153aa60]
push ecx
call ebp
mov eax, edi
inc esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42ecc1
sub eax, edx
cmp esi, eax
jb 0x42ec82
pop ebp
pop edi
pop esi
add esp, 8
ret
Function at 0x4305fb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d890]
jne 0x430605
repz ret
jmp fcn.00432fb8

Function at 0x43b24e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44d890]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004330be
and dword [ebp - 0x14], 0
cmp dword [0x19e8f88], 0
mov dword [ebp - 0x18], eax
jne 0x43b301
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x43b3a9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x43b3a9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x449978
push ebx
mov dword [0x19e8f88], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x19e8f8c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x19e8f90], eax
call edi
push eax
call esi
mov dword [0x19e8f98], eax
test eax, eax
je 0x43b301
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x19e8f94], eax
mov eax, dword [0x19e8f94]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x43b35a
cmp dword [0x19e8f98], ecx
je 0x43b35a
push eax
call esi
push dword [0x19e8f98]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x43b35a
test ebx, ebx
je 0x43b35a
call edi
test eax, eax
je 0x43b351
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x43b351
test byte [ebp - 8], 1
jne 0x43b35a
or dword [ebp + 0x10], 0x200000
jmp 0x43b38d
mov eax, dword [0x19e8f8c]
cmp eax, dword [ebp - 0x18]
je 0x43b38d
push eax
call esi
test eax, eax
je 0x43b38d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43b38d
mov eax, dword [0x19e8f90]
cmp eax, dword [ebp - 0x18]
je 0x43b38d
push eax
call esi
test eax, eax
je 0x43b38d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x19e8f88]
call esi
test eax, eax
je 0x43b3a9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x43b3ab
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004305fb
leave
ret
Function at 0x4220b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x422010]
mov ecx, dword [0x422004]
xor eax, eax
test edx, edx
je 0x4220cf
xor byte [eax + ecx + 0x1000], 1
inc eax
cmp eax, edx
jb 0x4220c2
jmp fcn.00422020