joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e6d0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x535980]
sub esp, 0x114
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
jne 0x42e6f5
cmp dword [0x535984], edi
jne 0x42e6f5
mov dword [esi + 0x184], edi
jmp 0x42e6ff
mov dword [esi + 0x184], 1
lea eax, [esp + 0x1c]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x42e91c
push ebx
push ebp
mov ecx, esi
call fcn.0042c830
mov dl, byte [esp + 0x24]
mov bl, al
xor ecx, ecx
cmp bl, dl
sete cl
mov dword [esi + 0x188], ecx
push str.CLAW.REZ
lea ecx, [esp + 0x14]
mov dword [esi + 0x18c], edi
mov dword [esi + 0x190], edi
mov dword [esi + 0x194], edi
call fcn.004fce17
push str.CLAW24.REZ
lea ecx, [esp + 0x18]
call fcn.004fce17
push str.CLAW.FEC
lea ecx, [esp + 0x1c]
call fcn.004fce17
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x24]
push edx
lea ebp, [esi + 0x178]
push eax
push 0x5240bc
push ebp
call fcn.004fafb8
mov ecx, dword [esp + 0x24]
add esp, 0x10
lea edx, [esp + 0x24]
lea edi, [esi + 0x17c]
push ecx
push edx
push 0x5240bc
push edi
call fcn.004fafb8
mov ecx, dword [esp + 0x28]
add esp, 0x10
lea edx, [esp + 0x24]
lea eax, [esi + 0x180]
push ecx
push edx
push 0x5240bc
push eax
call fcn.004fafb8
mov eax, 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [edi]
push eax
call fcn.0048f3f0
add esp, 0x14
test eax, eax
jne 0x42e81d
test bl, bl
je 0x42e815
mov eax, dword [esp + 0x14]
movsx ecx, bl
push eax
push ecx
push str._c:HIREZ_s
push edi
call fcn.004fafb8
mov edi, dword [edi]
push edi
call fcn.0048f3f0
add esp, 0x14
test eax, eax
je 0x42e815
mov dword [esi + 0x190], 1
jmp 0x42e81d
mov dword [esp + 0x1c], 0
mov eax, dword [ebp]
push eax
call fcn.0048f3f0
add esp, 4
test eax, eax
jne 0x42e871
mov eax, dword [esi + 0x188]
xor edi, edi
cmp eax, edi
jne 0x42e86d
test bl, bl
je 0x42e86d
mov edx, dword [esp + 0x10]
movsx eax, bl
push edx
push eax
push str._c:DATA_s
push ebp
call fcn.004fafb8
mov ebp, dword [ebp]
push ebp
call fcn.0048f3f0
add esp, 0x14
test eax, eax
je 0x42e86d
mov dword [esi + 0x18c], 1
jmp 0x42e871
mov dword [esp + 0x20], edi
mov eax, dword [esi + 0x180]
lea edi, [esi + 0x180]
push eax
call fcn.0048f3f0
add esp, 4
test eax, eax
jne 0x42e8bb
test bl, bl
je 0x42e8bb
mov ecx, dword [esp + 0x18]
movsx edx, bl
push ecx
push edx
push str._c:MOVIES_s
push edi
call fcn.004fafb8
mov edi, dword [edi]
push edi
call fcn.0048f3f0
add esp, 0x14
test eax, eax
je 0x42e8bb
mov dword [esi + 0x194], 1
mov eax, dword [esi + 0x184]
pop ebp
test eax, eax
pop ebx
je 0x42e8e8
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42e8e8
push 8
mov ecx, esi
call fcn.0042ea20
test eax, eax
jne 0x42e927
push 0x3eb
push 0x8010
jmp 0x42e8fa
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x42e927
push 0x3eb
push 0x800b
mov ecx, esi
call fcn.00429b30
lea ecx, [esp + 0x10]
call fcn.004fcda9
lea ecx, [esp + 0xc]
call fcn.004fcda9
lea ecx, [esp + 8]
call fcn.004fcda9
pop edi
xor eax, eax
pop esi
add esp, 0x114
ret
lea ecx, [esp + 0x10]
call fcn.004fcda9
lea ecx, [esp + 0xc]
call fcn.004fcda9
lea ecx, [esp + 8]
call fcn.004fcda9
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
Function at 0x442340
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov eax, dword [0x535dc8]
sub esp, 0x104
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x44235b
xor eax, eax
add esp, 0x104
ret
push esi
lea ecx, [esp + 8]
push edi
push ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jbe 0x4423da
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jbe 0x4423b2
mov edi, 0x52418c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
lea edx, [esp + 0x10]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
push 0x535dc8
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.004fd066
push eax
mov ecx, 0x535dc8
call fcn.004fce96
lea ecx, [esp + 8]
call fcn.004fcda9
mov edx, dword [0x535dc8]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edx
push 1
push str.GameType
push 0x5255c0
call esi
mov dword [0x535dec], eax
mov eax, dword [0x535dc8]
push eax
push 1
push str.LevelID
push 0x5255c0
call esi
mov ecx, dword [0x535dc8]
mov dword [0x535de4], eax
push ecx
push 0
push str.EndLevelID
push 0x5255c0
call esi
mov edx, dword [0x535dc8]
mov dword [0x535de8], eax
push edx
push 0
push str.UserMap
push 0x5255c0
call esi
mov dword [0x535dd8], eax
mov eax, dword [0x535dc8]
push eax
push 1
push str.Curses
push 0x5255c0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [0x535ddc], eax
mov eax, dword [0x535dd8]
test eax, eax
je 0x4424a4
mov ecx, dword [0x535dc8]
lea edx, [esp + 0xc]
push ecx
push 0xff
push edx
push 0x5326cc
push str.UserMapName
push 0x5255c0
call edi
test eax, eax
jbe 0x4424a4
lea eax, [esp + 0xc]
mov ecx, 0x535df4
push eax
call fcn.004fcee6
mov ecx, dword [0x535dc8]
push ecx
push 0
push str.GameID
push str.Engage
call esi
mov edx, dword [0x535dc8]
mov dword [0x535de0], eax
push edx
push pe_nt_image_headers32
push str.NumPlayers
push str.Engage
call esi
mov dword [0x535df0], eax
mov eax, dword [0x535dc8]
push eax
lea ecx, [esp + 0x10]
push 0xff
push ecx
push 0x5326cc
push str.ScreenName
push str.Engage
mov byte [esp + 0x24], 0
call edi
lea edx, [esp + 0xc]
mov ecx, 0x535df8
push edx
call fcn.004fcee6
mov eax, dword [0x535dc8]
lea ecx, [esp + 0xc]
push eax
push 0xff
push ecx
push 0x5326cc
push str.OwnerName
push str.Engage
mov byte [esp + 0x24], 0
call edi
lea edx, [esp + 0xc]
mov ecx, 0x535dfc
push edx
call fcn.004fcee6
mov eax, dword [0x535dc8]
push eax
push 0x14d
push str.SendDelayBase
push str.Timing
call esi
mov ecx, dword [0x535dc8]
mov dword [0x535e00], eax
push ecx
push 0x14
push str.SendDelayAdjust
push str.Timing
call esi
mov dword [0x535e04], eax
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret
Function at 0x464620
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push edi
mov edi, ecx
test edi, edi
jne 0x464630
mov dword [esp + 4], ecx
jmp 0x464637
mov eax, dword [edi + 0x1c]
mov dword [esp + 4], eax
lea ecx, [esp + 4]
push ecx
push 1
push 0x806
mov ecx, edi
call fcn.00464780
test eax, eax
jne 0x464653
pop edi
add esp, 0x28
ret
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [edi + 0x44], 1
mov ebx, 1
mov eax, dword [edi + 0x44]
test eax, eax
je 0x4646d8
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
test edx, 0x80000000
je 0x46468d
xor ebx, ebx
mov dword [0x5362e4], 1
push 1
push 0
push 0
lea eax, [esp + 0x24]
push 0
push eax
call esi
test eax, eax
je 0x4646d4
mov eax, dword [esp + 0x1c]
cmp eax, 0x112
je 0x4646c1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x24]
push 0
push ecx
call esi
test eax, eax
jne 0x4646a0
test ebx, ebx
jne 0x464667
pop esi
mov dword [edi + 0x44], 0
pop ebx
mov eax, 1
pop edi
add esp, 0x28
ret

Function at 0x47ae40
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x20]
mov ebx, eax
mov eax, dword [esi + 0x7ac]
add ebx, ecx
test eax, eax
mov dword [esp + 0x10], ebx
jne 0x47af8b
mov ecx, esi
call fcn.0047afb0
mov edi, eax
test edi, edi
jle 0x47af7d
jmp 0x47ae7f
mov ebx, dword [esp + 0x10]
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp eax, ebx
ja 0x47af8b
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test eax, 0x80000000
jne 0x47af99
mov eax, dword [esi + 0x784]
mov edx, dword [esi + 0x780]
test eax, eax
je 0x47af75
mov ecx, dword [eax + 4]
mov eax, dword [edx + 0x18]
lea ebx, [esp + 0x14]
mov edx, dword [eax]
push ebx
push ecx
push eax
call dword [edx + 0x44]
test eax, eax
jne 0x47af75
mov eax, dword [esp + 0x14]
test eax, eax
mov ebx, eax
jle 0x47af75
mov eax, dword [esi + 0x784]
mov edi, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 0
test ebx, ebx
jle 0x47af6c
mov ecx, dword [esi + 0x784]
mov eax, dword [esi + 0x780]
mov edx, dword [ecx + 4]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x18], edx
lea edx, [esp + 0xc]
mov ecx, dword [eax]
push edx
push edi
lea edx, [esp + 0x20]
push 1
push edx
lea edx, [esp + 0x30]
push edx
push eax
call dword [ecx + 0x64]
test eax, eax
jne 0x47af57
mov ecx, dword [esi + 0x784]
mov eax, dword [esp + 0x20]
dec ebx
cmp eax, dword [ecx + 4]
je 0x47aef7
mov edx, dword [esp + 0xc]
mov ecx, esi
push edx
push edi
push eax
call fcn.00479530
mov eax, dword [esi + 0x7ac]
test eax, eax
jne 0x47af8b
jmp 0x47aef7
push 0
push eax
push 0x13e
push str.projincs_netmgr.h
call fcn.004e2fb0
add esp, 0x10
mov ecx, esi
call fcn.0047afb0
mov edi, eax
test edi, edi
jg 0x47ae7b
push 1
push 0x3ee
mov ecx, esi
call fcn.00479230
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 4
Function at 0x47b0e2
Capabilities:
Check os version

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x780], edi
jne 0x47b0f7
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 3
je 0x47b10d
cmp al, 4
je 0x47b10d
cmp al, 5
je 0x47b10d
push 1
jmp 0x47b10e
push edi
push 1
push 1
push 1
push str.BACKGND
mov ecx, esi
call fcn.00492950
mov eax, dword [esi + 0x2c]
cmp eax, edi
je 0x47b12f
mov ecx, dword [eax + 0x10]
call fcn.004bcc50
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x14]
push edx
call fcn.004cb6b0
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov ecx, esi
call fcn.004779e0
cmp eax, edi
jne 0x47b15e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [0x5235d0]
sub esp, 0x10
mov edx, esp
push eax
mov dword [edx], ecx
mov ecx, dword [0x5235d4]
mov dword [edx + 4], ecx
mov ecx, dword [0x5235d8]
mov dword [edx + 8], ecx
mov ecx, dword [0x5235dc]
mov dword [edx + 0xc], ecx
mov ecx, dword [esi + 0x780]
call fcn.004e3a90
test eax, eax
jne 0x47b19b
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, dword [sym.imp.USER32.dll_ShowCursor]
push 1
call ebx
test eax, eax
jge 0x47b1b1
push 1
call ebx
test eax, eax
jl 0x47b1a9
mov ecx, esi
call fcn.00477c80
mov ebp, eax
mov eax, dword [esi + 0x7b4]
cmp eax, edi
je 0x47b237
push 1
mov dword [esi + 0x78c], edi
mov dword [esi + 0x790], edi
mov dword [esi + 0x794], 1
mov dword [esi + 0x79c], edi
mov dword [esi + 0x7a0], edi
mov dword [esi + 0x7a4], edi
mov dword [esi + 0x7a8], edi
mov dword [esi + 0x7ac], edi
mov dword [esi + 0x7b4], edi
mov dword [esi + 0x7b0], edi
mov dword [esi + 0x7b8], edi
mov dword [esi + 0x258], edi
call ebx
test eax, eax
jge 0x47b220
push 1
call ebx
test eax, eax
jl 0x47b218
mov ecx, dword [esi + 4]
push edi
push str.The_game_creator_has_closed_this_session.
call fcn.0042a4f0
cmp ebp, edi
jne 0x47b242
jmp 0x47b1b1
cmp ebp, edi
jne 0x47b242
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
add ebp, 0xc
sub esp, 0x10
mov edx, esp
mov eax, dword [ebp]
mov dword [edx], eax
mov ecx, dword [ebp + 4]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [edx + 0xc], ecx
call fcn.0047c3e0
mov ecx, dword [esi + 0x780]
add esp, 0x10
push edi
call fcn.004e4840
mov ecx, eax
cmp ecx, edi
jne 0x47b280
mov ecx, 0x32
mov eax, 0xd41d41d5
pop edi
mul ecx
sub ecx, edx
mov eax, 1
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [esi + 0xbfc], ecx
mov dword [esi + 0xc00], ecx
pop esi
pop ebp
pop ebx
ret
Function at 0x47bd40
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x100
push ebx
push ebp
mov ebp, dword [esp + 0x10c]
mov ebx, ecx
test ebp, ebp
je 0x47bead
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0x4c]
mov eax, dword [ecx + 0xc]
test eax, eax
jle 0x47bead
push esi
push edi
push 0x538048
push 0x270e
push 0xd
push ebp
mov byte [0x538048], 0
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0x138a
jle 0x47bdb4
mov edi, 0x5393d0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x538048
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x47bdb8
test eax, eax
jle 0x47bde5
mov edi, 0x525530
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x538048
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
add eax, 0x4c
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
test edx, edx
jle 0x47be8a
mov eax, dword [eax]
push 1
lea edx, [esp + 0x14]
push 0xfe
push edx
mov ecx, eax
call fcn.00423450
test eax, eax
je 0x47be77
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x538048
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0x4c]
mov eax, dword [ecx + 0xc]
test eax, eax
jle 0x47be77
mov edi, 0x525530
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x538048
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
add eax, 0x4c
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
test edx, edx
jg 0x47bdf8
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x538048
push 0
push 0xc
push ebp
call esi
push 0x270f
push 0
push 0xb6
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 4
Function at 0x48f290
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x53b0c4]
push esi
test eax, eax
jne 0x48f29e
xor eax, eax
pop esi
ret
push edi
push 0x53ae98
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x53ae98
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
test ecx, ecx
jle 0x48f2d3
cmp byte [ecx + 0x53ae97], 0x5c
jne 0x48f2d3
mov byte [ecx + 0x53ae97], 0
push 0x53ae98
push str._sCLAW4.SF2
push 0x53ad98
call fcn.004a5b6e
add esp, 0xc
push 0x53ae98
push str._sCLAW.SF2
push 0x53ac98
call fcn.004a5b6e
movsx esi, byte [esp + 0x14]
add esp, 0xc
push esi
push str._c:MUSICCLAW4.SF2
push 0x53ab98
call fcn.004a5b6e
add esp, 0xc
push esi
push str._c:MUSICCLAW.SF2
push 0x53aa98
call fcn.004a5b6e
add esp, 0xc
call fcn.0048f240
mov eax, dword [0x53b0ac]
xor esi, esi
cmp eax, 0x37115c
mov word [0x53af98], 1
mov word [0x53af9a], 0
mov dword [0x53afa0], 0x80
mov word [0x53afac], 0
jb 0x48f370
mov esi, 1
mov eax, 0x53ad98
jmp 0x48f375
mov eax, 0x53ac98
push eax
mov dword [0x53afa4], eax
call fcn.0048f3f0
add esp, 4
test eax, eax
je 0x48f3a8
mov ax, word [0x53b0a8]
mov ecx, dword [0x53b0bc]
push 0x53afa0
push 0x53af98
push eax
call dword [ecx + 0x2c]
add esp, 0xc
test eax, eax
je 0x48f3e5
test esi, esi
mov dword [0x53afa4], 0x53ab98
jne 0x48f3c0
mov dword [0x53afa4], 0x53aa98
mov dx, word [0x53b0a8]
mov eax, dword [0x53b0bc]
push 0x53afa0
push 0x53af98
push edx
call dword [eax + 0x2c]
add esp, 0xc
test eax, eax
je 0x48f3e5
xor eax, eax
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x49f6c0
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x104
push ebp
mov ebp, ecx
push esi
push edi
lea esi, [ebp + 0x1c]
mov ecx, esi
call fcn.004fcd34
lea eax, [esp + 0xc]
mov byte [esp + 0xc], 0
push eax
push 0xfe
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, dword [esp + 0x114]
test eax, eax
jbe 0x49f709
lea ecx, [esp + 0xc]
push edi
push ecx
push 0x5240bc
push esi
call fcn.004fafb8
add esp, 0x10
lea edx, [esp + 0xc]
mov byte [esp + 0xf], 0
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x49f725
mov ecx, esi
call fcn.004fcd34
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x49f756
lea ecx, [esp + 0xc]
push 0xfe
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jbe 0x49f756
lea edx, [esp + 0xc]
push edi
push edx
push 0x5240bc
push esi
call fcn.004fafb8
add esp, 0x10
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x49f76d
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x104
ret 4
mov ecx, 8
xor eax, eax
lea edi, [ebp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, ebp
call fcn.0049f820
test eax, eax
jle 0x49f794
push 0x523660
mov ecx, ebp
call fcn.0049fc20
test eax, eax
jne 0x49f7bc
push 0
push 0x5326cc
push 0x5326cc
push 0x523660
mov ecx, ebp
call fcn.0049fad0
test eax, eax
jne 0x49f7bc
pop edi
pop esi
pop ebp
add esp, 0x104
ret 4
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x104
ret 4
Function at 0x49fcb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x49fcbf
xor eax, eax
pop edi
ret 8
push esi
mov esi, dword [esp + 0x10]
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jbe 0x49fce2
push ebx
xor edx, edx
mov dl, byte [ecx + edi]
mov ebx, dword [edx*4 + 0x52bca4]
xor eax, ebx
inc ecx
cmp ecx, esi
jb 0x49fcce
pop ebx
pop esi
pop edi
ret 8

Function at 0x49fd70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
push eax
call fcn.004a594e
add esp, 4
mov ecx, edi
push 0x1000000
call fcn.0049fcf0
mov ebx, dword [esp + 0x14]
test ebx, ebx
jbe 0x49fdaa
mov ecx, edi
call fcn.0049fd40
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ebx
jne 0x49fd99
pop edi
pop esi
pop ebx
ret 8

Function at 0x4a0390
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x418
push ebx
mov ebx, dword [esp + 0x420]
push ebp
push esi
test ebx, ebx
push edi
jne 0x4a03b2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret
mov edi, dword [esp + 0x430]
test edi, edi
jne 0x4a03ca
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret
mov esi, dword [esp + 0x434]
test esi, esi
jne 0x4a03e2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret
push 0x5235e4
lea ecx, [esp + 0x14]
call fcn.004f5840
push esi
push edi
push ebx
lea ecx, [esp + 0x1c]
call fcn.004f5880
test eax, eax
jne 0x4a0427
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CHTTPSocket.0
call fcn.004f5870
lea ecx, [esp + 0x10]
call fcn.005056df
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x418
ret
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
mov ebx, dword [esp + 0x438]
mov esi, eax
mov eax, dword [esp + 0x24]
add esi, ebx
test eax, eax
je 0x4a0482
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x535cf4]
test ecx, ecx
je 0x4a0461
mov eax, dword [ecx]
mov dword [ecx + 0x170], 1
call dword [eax + 0x14]
push 0x1b
call ebp
movsx ecx, ax
test ecx, reloc.DPLAYX.dll_Ordinal_1
jne 0x4a0400
test ebx, ebx
je 0x4a047a
call edi
cmp eax, esi
ja 0x4a0400
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4a0448
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CHTTPSocket.0
call fcn.004f5870
lea ecx, [esp + 0x10]
call fcn.005056df
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x418
ret
Function at 0x4a3490
Capabilities:
Create process on windows
Get file version info

Disassembly:
sub esp, 0x108
lea eax, [esp + 8]
push esi
push 0xfe
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x4a3542
push 0
lea ecx, [esp + 0x10]
push 2
push ecx
call fcn.004a0020
add esp, 0xc
test eax, eax
je 0x4a3542
push 0x5235e4
push str.ClawClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x4a36ab
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4a34fe
push 0
push 0xf120
push 0x112
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x118]
test eax, eax
je 0x4a36ab
push str.LOBBYLAUNCH
push eax
call fcn.004a5bc0
add esp, 8
test eax, eax
je 0x4a36ab
push 0
push 0x8062
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop esi
add esp, 0x108
ret 0x10
push edi
lea edx, [esp + 0x10]
push 0
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
push edi
call fcn.004fcaea
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push esi
push edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push edx
push str.StringFileInfo040904B0FileVersion
push esi
call sub.VERSION.dll_VerQueryValueA
push 0x53d360
push 0x53d35c
mov eax, dword [esp + 0x10]
push 0x53d358
push 0x53d354
push str._d___d___d___d
push eax
call fcn.004a65a5
push esi
call fcn.004fcb13
push 0
call fcn.004ceb40
add esp, 0x20
test eax, eax
pop edi
je 0x4a36ab
mov esi, dword [esp + 0x110]
push 0
push esi
call fcn.00455010
add esp, 8
dec eax
je 0x4a3685
sub eax, 2
je 0x4a36ab
push 0x254
call fcn.004fcaea
add esp, 4
test eax, eax
je 0x4a3642
mov ecx, eax
call fcn.00424880
test eax, eax
mov dword [0x53d374], eax
je 0x4a36ab
mov ecx, dword [esp + 0x118]
push Ordinal_4
push Ordinal_4
push 0
push ecx
mov dword [0x53d378], esi
mov edx, dword [eax]
push 0x521774
push 0x5235e4
push esi
mov ecx, eax
call dword [edx + 8]
mov ecx, dword [0x53d374]
test eax, eax
jne 0x4a3658
test ecx, ecx
je 0x4a3642
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [0x53d374], 0
xor eax, eax
pop esi
add esp, 0x108
ret 0x10
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [0x53d374]
mov esi, eax
test ecx, ecx
je 0x4a366f
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, esi
mov dword [0x53d374], 0
pop esi
add esp, 0x108
ret 0x10
push 1
push str.Rundll32.exe_shell32.dll_Control_RunDLL_joy.cpl
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jg 0x4a36ab
push 0
push 0x5235e4
push str.Unable_to_launch_joystick_applet
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x108
ret 0x10