joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f48f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x4f4900
mov eax, edx
pop esi
pop ebx
ret

Function at 0x513840
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5139fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040aa94
mov eax, dword [ebp - 4]
call fcn.00513190
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x513892
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b5a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0051448c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x513971
xor eax, eax
push ebp
push 0x51396a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00513430
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00513a30
test al, al
je 0x513948
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040a7f4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x513948
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040b180
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004155d4
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00513390
test al, al
je 0x513942
mov eax, dword [ebp - 8]
call fcn.0040b180
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040b1e4
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00513840
dec ebx
cmp ebx, 0xffffffff
jne 0x5138f1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513971
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00513430
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00415584
ret
cmp byte [0x709490], 0
je 0x5139b1
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040b180
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0051341c
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00513390
mov ebx, eax
jmp 0x5139d8
mov eax, dword [ebp - 4]
call fcn.0040b180
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.0051341c
push eax
call fcn.004155c4
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00513390
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513a02
lea eax, [ebp - 0x3c]
call fcn.0040a66c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a6cc
ret

Function at 0x51db04
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x51db0a
ret
Function at 0x53b1e4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x6fa9cc
test edx, edx
jne 0x53b203
xor eax, eax
jmp 0x53b321
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x53b220
push esi
push edx
push eax
call fcn.0053b344
add esp, 0xc
jmp 0x53b321
push esi
push edx
push eax
call fcn.0053b604
add esp, 0xc
jmp 0x53b321
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x63324c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x709c0c], 0
jne 0x633263
call fcn.00633208
mov eax, edi
dec eax
test eax, eax
jl 0x63328b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x70980c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x63326d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x6362b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6362e1
dec al
je 0x63631c
dec al
je 0x636360
dec al
je 0x6363d2
jmp 0x63646d
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x63646d
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6362f1
jmp 0x63646d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x63646d
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x63632c
jmp 0x63646d
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x63646d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x636393
xor edx, edx
mov dword [esp + 4], edx
jmp 0x6363a8
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x6363c0
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x636370
jmp 0x63646d
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x63646d
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x636439
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00633294
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6363ee
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x63e15c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x63e18a
mov eax, ebx
call fcn.0063ec18
cmp dword [ebx + 0x40], 0
je 0x63e183
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x63e1fb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x63e1ed
cmp dword [ebx + 8], 0
je 0x63e1ac
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x63e1be
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x63e1ed
cmp dword [ebx + 8], 0
je 0x63e19f
cmp eax, 3
je 0x63e1d1
dec eax
jne 0x63e19f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x63e19f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x63e19f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x63e219
cmp dword [ebx + 0x14], 0xcc
je 0x63e219
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0063e224
pop ebx
ret
Function at 0x6b51c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6b51c8
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6b537d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6b5398
call fcn.0040b3e8
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.006b2d74
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x6b53ac
call fcn.0065ca1c
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6b5243
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b5284
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.006b2d74
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b5414
call fcn.0065ca1c
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b390
mov eax, esi
mov edx, 0x6b5440
call fcn.0040b390
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6b529c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b530a
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b5454
call fcn.0065ca1c
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b390
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x6b52d3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b52fe
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b5484
call fcn.0065ca1c
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b390
mov eax, esi
mov edx, 0x6b5440
call fcn.0040b390
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6b5316
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6b5341
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6b54b0
call fcn.0065ca1c
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b390
mov eax, esi
mov edx, 0x6b5440
call fcn.0040b390
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b5384
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040a6cc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a6cc
lea eax, [ebp - 4]
call fcn.0040a66c
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1002aaee
pop dword [ebp - 0x50]
mov eax, 0x63c3fd79
add eax, 0xac3ead75
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x8b15015f
sub dword [ebp - 0x60], 0x3cc2bc14
mov dword [ebp - 0x5c], 0x44b989b8
sub dword [ebp - 0x5c], 0x12863d73
mov dword [ebp - 0x58], 0x4dbc2146
sub dword [ebp - 0x58], 0x16fdd18
mov dword [ebp - 0x54], 0x60b7b2de
sub dword [ebp - 0x54], 0x60b7b2de
lea eax, [ebp - 0x60]
push eax
mov eax, 0x484ae607
add eax, 0xc7b7da31
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x49bc764e
add dword [ebp - 0x60], 0x2ab5f308
mov dword [ebp - 0x5c], 0xf712ebb0
add dword [ebp - 0x5c], 0x4a5975c5
mov dword [ebp - 0x58], 0x21198056
add dword [ebp - 0x58], 0x4255ec16
mov dword [ebp - 0x54], 0xaec3aea5
add dword [ebp - 0x54], 0x513c515b
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xc6b5fd09
sub eax, 0xb6b33ce1
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38a44
push 0
call eax
mov ecx, 0x3aaa4d32
add ecx, 0xc5560380
mov edx, eax
mov ebx, 0x121279c3
sub ebx, 0x20ee3c3
add ebx, dword [ebp - 0x50]
mov esi, 0xb8ddf132
add esi, 0x295cc674
mov dword [ebp - 0x44], 0x54f2f324
mov edi, dword [ebx]
xor dword [ebp - 0x48], ecx
xor edi, esi
mov dword [ebp - 0x24], 0x6a053710
mov dword [edx], edi
xor dword [ebp - 0x10], ebx
add edx, 4
add ebx, 4
loop 0x1002ac10
add eax, 0x46c01957
sub eax, 0x46bee3bc
xor ebx, ebx
add ebx, eax
add eax, 0xcd798184
add eax, 0x32867e81
mov ecx, 0xfc324ac1
add ecx, 0x13cdb53f
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x402110
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408058
call sym._EnterCriticalSection_4
mov ebx, dword [0x408050]
sub esp, 4
test ebx, ebx
je 0x40215b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402154
test esi, esi
je 0x402154
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402130
mov dword [esp], 0x408058
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402340
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402390
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402464
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x4023ce
cmp eax, 4
jne 0x4023f0
test esi, esi
je 0x4023e2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x4023d4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40242f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402421
cmp ecx, 0x40
je 0x4023e2
cmp ecx, 4
je 0x4023e2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402340
lea esi, [esi]
Function at 0x401190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x20
push 0xff
push 0x4248f0
call fcn.00404b30
add esp, 0xc
push 0x41d220
push 0x41d224
call fcn.00407342
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401271
mov eax, dword [ebp - 4]
push eax
push 1
push 0x20
push 0x4248f0
call fcn.00407541
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
push 1
push 1
push 0x424910
call fcn.00407541
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
push 1
push 5
push section..data
call fcn.00407541
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
push 1
push 1
push 0x424911
call fcn.00407541
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
push 1
push 1
push 0x424912
call fcn.00407541
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
push 1
push 1
push 0x424913
call fcn.00407541
add esp, 0x10
movzx eax, byte [0x424913]
test eax, eax
je 0x401265
mov ecx, dword [ebp - 4]
push ecx
push 1
push 4
push 0x424914
call fcn.00407541
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.0040721b
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x401990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.00403fa0
mov eax, dword [0x424044]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004020b0
push 0x424910
call fcn.00401900
add esp, 4
push 0x424911
call fcn.00401f90
add esp, 4
push 0x424912
call fcn.00401fd0
add esp, 4
push 0x424913
call fcn.00402010
add esp, 4
push 0x424914
call fcn.00402050
add esp, 4
call fcn.004017a0
push 0x41d234
push 0x41d238
call fcn.00407342
add esp, 8
mov dword [ebp - 0x2008], eax
cmp dword [ebp - 0x2008], 0
je 0x401b1f
mov eax, dword [ebp - 0x2008]
push eax
push 1
push 0x20
push 0x4248f0
call fcn.0040788b
add esp, 0x10
mov ecx, dword [ebp - 0x2008]
push ecx
push 1
push 1
push 0x424910
call fcn.0040788b
add esp, 0x10
mov edx, dword [ebp - 0x2008]
push edx
push 1
push 5
push section..data
call fcn.0040788b
add esp, 0x10
mov eax, dword [ebp - 0x2008]
push eax
push 1
push 1
push 0x424911
call fcn.0040788b
add esp, 0x10
mov ecx, dword [ebp - 0x2008]
push ecx
push 1
push 1
push 0x424912
call fcn.0040788b
add esp, 0x10
mov edx, dword [ebp - 0x2008]
push edx
push 1
push 1
push 0x424913
call fcn.0040788b
add esp, 0x10
movzx eax, byte [0x424913]
test eax, eax
je 0x401aca
mov ecx, dword [ebp - 0x2008]
push ecx
push 1
push 4
push 0x424914
call fcn.0040788b
add esp, 0x10
mov edx, dword [ebp - 0x2008]
push edx
call fcn.0040721b
add esp, 4
push 0x1000
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.00404b30
add esp, 0xc
push str._SUCCESS___nLOD_Mixer_configuration_saved._n_n
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00402210
add esp, 8
push 0
push 0x41d284
lea edx, [ebp - 0x1004]
push edx
mov eax, dword [0x424918]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401b69
push 0x1000
push 0
lea ecx, [ebp - 0x2004]
push ecx
call fcn.00404b30
add esp, 0xc
push str.lodmixer.dat
push str._ERROR___nProblem_saving_LOD_Mixer_configuration_info_this_file:_n_s._n_n
lea edx, [ebp - 0x2004]
push edx
call fcn.00402210
add esp, 0xc
push 0
push str.LOD_Mixer_Message
lea eax, [ebp - 0x2004]
push eax
mov ecx, dword [0x424918]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f8e
mov esp, ebp
pop ebp
ret

Function at 0x402050
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x424044]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x18]
push ecx
push 0x13
push 0xd
mov edx, dword [0x424954]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 8]
push eax
push 0x41d21c
lea ecx, [ebp - 0x18]
push ecx
call fcn.00402250
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f8e
mov esp, ebp
pop ebp
ret
Function at 0x4037e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x424044]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040d83a
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x40
lea edx, [ebp - 0x6c]
push edx
call fcn.00407541
add esp, 0x10
push 1
mov eax, dword [ebp - 0x30]
sub eax, 0x40
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d83a
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x18
lea eax, [ebp - 0x164]
push eax
call fcn.00407541
add esp, 0x10
push 1
movzx ecx, word [ebp - 0x150]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040d83a
add esp, 0xc
mov ax, word [ebp - 0x15e]
mov word [ebp - 0x16c], ax
xor ecx, ecx
mov word [ebp - 0x168], cx
jmp 0x403884
mov dx, word [ebp - 0x168]
add dx, 1
mov word [ebp - 0x168], dx
movzx eax, word [ebp - 0x168]
movzx ecx, word [ebp - 0x16c]
cmp eax, ecx
jge 0x4038ca
mov edx, dword [ebp + 8]
push edx
push 1
push 0x28
lea eax, [ebp - 0x2c]
push eax
call fcn.00407541
add esp, 0x10
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x20]
jb 0x4038c8
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x24]
cmp dword [ebp + 0xc], edx
jae 0x4038c8
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x18]
jmp 0x4038cc
jmp 0x403872
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f8e
mov esp, ebp
pop ebp
ret

Function at 0x4038e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x424044]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040d83a
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x40
lea edx, [ebp - 0x6c]
push edx
call fcn.00407541
add esp, 0x10
push 1
mov eax, dword [ebp - 0x30]
sub eax, 0x40
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040d83a
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 1
push 0x18
lea eax, [ebp - 0x164]
push eax
call fcn.00407541
add esp, 0x10
push 1
movzx ecx, word [ebp - 0x150]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040d83a
add esp, 0xc
mov ax, word [ebp - 0x15e]
mov word [ebp - 0x16c], ax
xor ecx, ecx
mov word [ebp - 0x168], cx
jmp 0x403984
mov dx, word [ebp - 0x168]
add dx, 1
mov word [ebp - 0x168], dx
movzx eax, word [ebp - 0x168]
movzx ecx, word [ebp - 0x16c]
cmp eax, ecx
jge 0x4039ff
mov edx, dword [ebp + 8]
push edx
push 1
push 0x28
lea eax, [ebp - 0x2c]
push eax
call fcn.00407541
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040d860
add esp, 4
test eax, eax
je 0x4039e6
push 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00404c8a
add esp, 0xc
test eax, eax
je 0x4039e6
push 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.0040d510
add esp, 0xc
test eax, eax
jne 0x4039fa
push 1
push 0xffffffffffffffd8
mov eax, dword [ebp + 8]
push eax
call fcn.0040d83a
add esp, 0xc
mov al, 1
jmp 0x403a01
jmp 0x403972
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403f8e
mov esp, ebp
pop ebp
ret