joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40689b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40b570]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040418f
and dword [ebp - 0x14], 0
cmp dword [0x43c430], 0
mov dword [ebp - 0x18], eax
jne 0x40694e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4069f6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4069f6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43c430], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43c434], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43c438], eax
call edi
push eax
call esi
mov dword [0x43c440], eax
test eax, eax
je 0x40694e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43c43c], eax
mov eax, dword [0x43c43c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4069a7
cmp dword [0x43c440], ecx
je 0x4069a7
push eax
call esi
push dword [0x43c440]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4069a7
test ebx, ebx
je 0x4069a7
call edi
test eax, eax
je 0x40699e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40699e
test byte [ebp - 8], 1
jne 0x4069a7
or dword [ebp + 0x10], 0x200000
jmp 0x4069da
mov eax, dword [0x43c434]
cmp eax, dword [ebp - 0x18]
je 0x4069da
push eax
call esi
test eax, eax
je 0x4069da
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4069da
mov eax, dword [0x43c438]
cmp eax, dword [ebp - 0x18]
je 0x4069da
push eax
call esi
test eax, eax
je 0x4069da
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43c430]
call esi
test eax, eax
je 0x4069f6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4069f8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004055d9
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40c052
Capabilities:
Persist via run registry key

Disassembly:
invalid
push ebp
iretd
lea eax, [ebp - 0x648]
mov dword [ebp - 0x648], 0x94
push eax
call dword [0x406130]
cmp dword [ebp - 0x644], 6
je 0x40c052
nop
nop
nop
nop
nop
nop
nop
nop
push eax
call dword [0x406068]
cmp eax, 0x1f600
jbe 0x40d0ed
call 0x40c052
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub esp, 0x208
lea eax, ss:[0x40c24a]
push 0x104
push eax
push 0
call dword [0x40608c]
push edi
lea eax, ss:[0x40c216]
push 0x104
push eax
call dword [0x406058]
lea ecx, ss:[0x40c216]
push 0x408644
push ecx
call dword [0x406084]
lea eax, ss:[0x40c216]
push edi
push 0x4084a8
push eax
call dword [0x406084]
nop
push 0
push 0x40c216
push 0x40c24a
call dword [0x4060a0]
cmp eax, 1
jne 0x40c12b
nop
nop
nop
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x40c24a
call dword [0x40609c]
nop
push 5
push 0
push 0
push 0x40c216
push 0x407138
push 0
call dword [0x4061b0]
nop
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x40c216
call dword [0x40609c]
nop
call fcn.004067e1
nop
sub dword [0x408670], 0xb
jmp 0x402360
nop
push 0x40c24a
push 0x40c216
call dword [sym.imp.kernel32.dll_lstrcmpA]
jne 0x40c16a
nop
push 0x40c24a
push 0x4084c8
push 0x40c1e5
push 0x80000002
call fcn.0040c17a
push eax
call dword [0x406068]
cmp eax, 0x1f600
jbe 0x402360
push 0xff
call dword [0x4060cc]
ret
nop
nop
sub esp, 0x208
lea eax, ss:[0x40c24a]
push 0x104
push eax
push 0
call dword [0x40608c]
push edi
lea eax, ss:[0x40c216]
push 0x104
push eax
call dword [0x406058]
lea ecx, ss:[0x40c216]
push 0x408644
push ecx
call dword [0x406084]
lea eax, ss:[0x40c216]
push edi
push 0x407035
push eax
call dword [0x406084]
nop
nop
push 0x40c24a
push 0x40c216
call dword [sym.imp.kernel32.dll_lstrcmpA]
jne 0x40599f
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x4084a8
call dword [0x40609c]
nop
push 0x40d1a7
push 0x4084c8
push 0x40c1e5
push 0x80000002
call fcn.0040c17a
jmp 0x40599f
Function at 0x49c1b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x65000]
push edi
jmp 0x49c1ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49c1d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49c1c0
mov eax, 1
add ebx, ebx
jne 0x49c1e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49c1f4
jne 0x49c213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49c213
dec eax
add ebx, ebx
jne 0x49c200
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x49c1d8
add ebx, ebx
jne 0x49c20f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49c265
xor ecx, ecx
sub eax, 3
jb 0x49c22b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49c29a
sar eax, 1
mov ebp, eax
jmp 0x49c236
add ebx, ebx
jne 0x49c236
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49c204
inc ecx
add ebx, ebx
jne 0x49c244
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49c204
add ebx, ebx
jne 0x49c251
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49c246
jne 0x49c262
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49c246
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49c284
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49c276
jmp 0x49c1c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49c284
add edi, ecx
jmp 0x49c1c6
pop esi
mov edi, esi
mov ecx, 0x22b4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49c2a2
cmp byte [edi], 0x16
jne 0x49c2a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49c2a7
lea edi, [esi + 0x98000]
mov eax, dword [edi]
or eax, eax
je 0x49c316
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9d73c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9d7a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49c2d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9d7a4]
or eax, eax
je 0x49c310
mov dword [ebx], eax
add ebx, 4
jmp 0x49c2f1
call dword [esi + 0x9d7b4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x49c347
cmp al, 0xef
ja 0x49c33a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x49c31c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x49c329
mov ebp, dword [esi + 0x9d7a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49c37b
sub esp, 0xffffff80
jmp 0x45702b
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x72146489
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x6cbb3b75
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4010e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x2252fe8], 0
push esi
je 0x40111f
cmp dword [0x2252fe4], 2
jne 0x40115d
mov edx, dword [esp + 0xc]
test edx, edx
mov eax, dword [esp + 8]
lea ecx, [edx + 0x2251fe0]
jle 0x40115d
sub ecx, eax
mov esi, edx
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x401110
pop esi
ret
cmp byte [0x2252fea], 0
je 0x40115d
cmp dword [0x2252fe0], 0
jne 0x401148
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
mov ecx, eax
mov esi, 0x2253140
call fcn.004051b0
pop esi
ret
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ecx
mov edx, eax
mov ecx, 0x2253258
call fcn.00401700
pop esi
ret

Function at 0x401700
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [ecx + 0x30]
test eax, eax
push edi
mov edi, edx
mov edx, dword [esp + 0x14]
mov ebp, 0x10
jle 0x401784
mov esi, ebp
sub esi, eax
cmp edx, esi
jg 0x401758
test edx, edx
je 0x401741
mov esi, edx
mov eax, dword [ecx + 0x30]
mov dl, byte [ecx + eax + 0x20]
xor dl, byte [ebx]
add edi, 1
mov byte [edi - 1], dl
add dword [ecx + 0x30], 1
add ebx, 1
sub esi, 1
jne 0x401726
cmp dword [ecx + 0x30], ebp
jl 0x40180b
pop edi
pop esi
pop ebp
mov dword [ecx + 0x30], 0
pop ebx
ret 4
sub edx, esi
cmp eax, ebp
mov dword [esp + 0x14], edx
jge 0x40177d
mov eax, dword [ecx + 0x30]
mov al, byte [ecx + eax + 0x20]
xor al, byte [ebx]
add edi, 1
mov byte [edi - 1], al
add dword [ecx + 0x30], 1
add ebx, 1
cmp dword [ecx + 0x30], ebp
jl 0x401762
mov dword [ecx + 0x30], 0
cmp edx, ebp
jl 0x4017d6
mov ebp, edx
shr ebp, 4
mov eax, ebp
neg eax
shl eax, 4
add edx, eax
lea esi, [ecx + 0x20]
mov dword [esp + 0x14], edx
lea ecx, [ecx]
call fcn.004015c0
mov edx, dword [ebx]
xor edx, dword [esi]
add edi, 0x10
mov dword [edi - 0x10], edx
mov eax, dword [ebx + 4]
xor eax, dword [ecx + 0x24]
add ebx, 0x10
mov dword [edi - 0xc], eax
mov edx, dword [ebx - 8]
xor edx, dword [ecx + 0x28]
mov dword [edi - 8], edx
mov eax, dword [ebx - 4]
xor eax, dword [ecx + 0x2c]
sub ebp, 1
mov dword [edi - 4], eax
jne 0x4017a0
mov edx, dword [esp + 0x14]
test edx, edx
jle 0x40180b
lea esi, [ecx + 0x20]
call fcn.004015c0
mov esi, dword [esp + 0x14]
cmp dword [ecx + 0x30], esi
jge 0x40180b
jmp 0x4017f0
mov edx, dword [ecx + 0x30]
mov al, byte [ecx + edx + 0x20]
xor al, byte [ebx]
add edi, 1
mov byte [edi - 1], al
add dword [ecx + 0x30], 1
add ebx, 1
cmp dword [ecx + 0x30], esi
jl 0x4017f0
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x404410
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x6c
mov eax, dword [0x70e4ec]
xor eax, esp
push ebx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
push ecx
push eax
lea ebx, [esp + 0x10]
mov dword [esp + 0x18], 0x6a09e667
mov dword [esp + 0x1c], 0xbb67ae85
mov dword [esp + 0x20], 0x3c6ef372
mov dword [esp + 0x24], 0xa54ff53a
mov dword [esp + 0x28], 0x510e527f
mov dword [esp + 0x2c], 0x9b05688c
mov dword [esp + 0x30], 0x1f83d9ab
mov dword [esp + 0x34], 0x5be0cd19
call fcn.004041c0
add esp, 8
mov ecx, ebx
call fcn.00404270
mov ecx, dword [esp + 0x70]
pop esi
pop ebx
xor ecx, esp
call fcn.005d0efa
add esp, 0x6c
ret
Function at 0x408240
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebp
push esi
push edi
push 0x7191e0
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov dword [0x7198d8], eax
lea eax, [esp + 0x18]
push eax
push 0x6bb5d5
push str.MOUSE
push str.TUTORIAL
call ebx
test eax, eax
mov ebp, 1
je 0x4082af
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x719850], eax
jmp 0x4082b5
mov dword [0x719850], ebp
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push str.MOVE
push str.TUTORIAL
call ebx
test eax, eax
je 0x4082f7
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x719854], eax
jmp 0x4082fd
mov dword [0x719854], ebp
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push str.SKILL
push str.TUTORIAL
call ebx
test eax, eax
je 0x40833f
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x719858], eax
jmp 0x408345
mov dword [0x719858], ebp
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push str.QUEST
push str.TUTORIAL
call ebx
test eax, eax
je 0x408387
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x71985c], eax
jmp 0x40838d
mov dword [0x71985c], ebp
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push str.LEVELUP
push str.TUTORIAL
call ebx
test eax, eax
je 0x4083cf
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x719860], eax
jmp 0x4083d5
mov dword [0x719860], ebp
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push str.ITEM
push str.TUTORIAL
call ebx
test eax, eax
je 0x408417
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x719864], eax
jmp 0x40841d
mov dword [0x719864], ebp
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push str.FULLSCREEN
push str.VIDEO
call ebx
test eax, eax
je 0x40845f
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x719a44], eax
jmp 0x408465
mov dword [0x719a44], ebp
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push str.SIZE_X
push str.VIDEO
call ebx
test eax, eax
je 0x40849b
lea edx, [esp + 0x10]
push edx
call fcn.005cd365
add esp, 4
mov dword [0x70859c], eax
push 0x7191e0
push 0x104
lea eax, [esp + 0x18]
push eax
push 0x6bb5d5
push str.SIZE_Y
push str.VIDEO
call ebx
test eax, eax
je 0x4084d3
lea ecx, [esp + 0x10]
push ecx
call fcn.005cd365
add esp, 4
mov dword [0x7085a0], eax
jmp 0x4084d8
mov eax, dword [0x7085a0]
mov ecx, dword [0x70859c]
jmp 0x2262700
Function at 0x4089a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
push 0x7191e0
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x6bb5d5
push str.VOL_BGM
push str.SOUND
call ebx
test eax, eax
je 0x4089ff
lea ecx, [esp + 0x10]
push ecx
call fcn.005cd365
add esp, 4
mov dword [0x719900], eax
mov esi, 6
jmp 0x408a0a
mov esi, 6
mov dword [0x719900], esi
push 0x7191e0
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x6bb5d5
push str.VOL_EFFECT
push str.SOUND
call ebx
test eax, eax
je 0x408a42
lea eax, [esp + 0x10]
push eax
call fcn.005cd365
add esp, 4
mov dword [0x719904], eax
jmp 0x408a48
mov dword [0x719904], esi
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push 0x6bb770
push str.SOUND
call ebx
test eax, eax
je 0x408a80
lea edx, [esp + 0x10]
push edx
call fcn.005cd365
add esp, 4
mov dword [0x719908], eax
jmp 0x408a86
mov dword [0x719908], esi
fild dword [0x719900]
fmul dword [0x6bb76c]
fmul dword [0x6bb768]
fsub dword [0x6bb768]
call fcn.005cd414
push eax
mov ecx, 0x22071e0
call fcn.00539db0
fild dword [0x719904]
fmul dword [0x6bb76c]
fmul dword [0x6bb768]
fsub dword [0x6bb768]
call fcn.005cd414
push eax
mov ecx, 0x22071e0
call fcn.00539e10
fild dword [0x719908]
fmul dword [0x6bb76c]
fmul dword [0x6bb768]
fsub dword [0x6bb768]
call fcn.005cd414
push eax
mov ecx, 0x22071e0
call fcn.00539e30
push 0x7191e0
push 0x104
lea eax, [esp + 0x18]
push eax
push 0x6bb5d5
push str.VOICE_CHAR
push str.SOUND
call ebx
test eax, eax
je 0x408b40
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x71990c], eax
jmp 0x408b4a
mov dword [0x71990c], 1
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push str.VOICE_NPC
push str.SOUND
call ebx
test eax, eax
je 0x408b8c
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x719910], eax
jmp 0x408b96
mov dword [0x719910], 1
push 0x7191e0
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
push str.DANGER_DETECT
push str.SOUND
call ebx
test eax, eax
je 0x408bdd
xor edx, edx
mov edi, str.FALSE
lea esi, [esp + 0x10]
mov ecx, 6
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
setne al
mov dword [0x719914], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov dword [0x719914], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409130
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
xor esi, esi
jmp 0x409150
push esi
lea eax, [esp + 0x11c]
push str.KEY_d
push eax
call fcn.005cd489
add esp, 0xc
push 0x7191e0
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
push 0x6bb5d5
lea edx, [esp + 0x128]
push edx
push str.OPTION
call ebx
test eax, eax
je 0x4091b0
lea eax, [esp + 0x10]
push eax
call fcn.005cd365
add esp, 4
mov dword [esi*4 + 0x719990], eax
jmp 0x4091be
mov ecx, dword [esi*4 + 0x70a4f0]
mov dword [esi*4 + 0x719990], ecx
inc esi
cmp esi, 0x14
jl 0x409150
xor esi, esi
jmp 0x4091d0
push esi
lea edx, [esp + 0x11c]
push str.ADD_KEY_d
push edx
call fcn.005cd489
add esp, 0xc
push 0x7191e0
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x6bb5d5
lea ecx, [esp + 0x128]
push ecx
push str.OPTION
call ebx
test eax, eax
je 0x409229
lea edx, [esp + 0x10]
push edx
call fcn.005cd365
add esp, 4
jmp 0x409230
mov eax, dword [esi*4 + 0x70a5e0]
mov dword [esi*4 + 0x719968], eax
inc esi
cmp esi, 0xa
jl 0x4091d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409f00
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 8]
cmp eax, 0x60000000
jbe 0x409f3f
cmp dword [esp + 0xc], 0x2bc00000
mov dword [0x7198d0], 3
jb 0x409f81
mov dword [0x7198d0], 4
mov eax, 1
add esp, 0x20
ret
cmp eax, 0x32000000
jb 0x409f59
mov dword [0x7198d0], 2
mov eax, 1
add esp, 0x20
ret
cmp eax, 0x19000000
ja 0x409f77
cmp eax, 0x9600000
mov dword [0x7198d0], 0
ja 0x409f81
xor eax, eax
add esp, 0x20
ret
mov dword [0x7198d0], 1
mov eax, 1
add esp, 0x20
ret

Function at 0x40ac50
Capabilities:
Hash data using djb2

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
movsx ecx, byte [ebx]
test ecx, ecx
mov edx, ebx
mov eax, 0x1505
je 0x40ac80
inc edx
cmp ecx, 0x40
jle 0x40ac74
cmp ecx, 0x5b
jge 0x40ac74
add ecx, 0x20
imul eax, eax, 0x21
add eax, ecx
movsx ecx, byte [edx]
test ecx, ecx
jne 0x40ac66
xor edx, edx
div dword [esi]
mov eax, dword [esi + 8]
mov edx, dword [eax + edx*4]
test edx, edx
mov dword [esi + 0x14], edx
je 0x40acd7
mov ecx, dword [edx + 4]
mov eax, dword [ecx]
mov dword [esi + 0x18], eax
cmp eax, dword [edx + 4]
je 0x40acd7
mov edi, edi
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 8]
mov dword [esi + 0x1c], eax
cmp dword [eax + 0x18], 0x10
jb 0x40acb4
mov eax, dword [eax + 4]
jmp 0x40acb7
add eax, 4
push eax
push ebx
call fcn.005e0428
add esp, 8
test eax, eax
je 0x40acec
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
mov dword [esi + 0x18], edx
mov eax, dword [esi + 0x14]
mov ecx, edx
cmp ecx, dword [eax + 4]
jne 0x40aca0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40ace5
mov dword [eax], 0
pop esi
xor al, al
pop ebx
ret 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40acfc
mov edx, dword [esi + 0x1c]
mov ecx, dword [edx + 0x20]
mov dword [eax], ecx
pop esi
mov al, 1
pop ebx
ret 8

Function at 0x40af40
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
push edi
mov edi, ecx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40af50
sub eax, edx
push eax
push esi
mov ecx, edi
call fcn.00405710
movsx eax, byte [esi]
test eax, eax
mov edx, esi
mov ecx, 0x1505
je 0x40af8a
inc edx
cmp eax, 0x40
jle 0x40af7e
cmp eax, 0x5b
jge 0x40af7e
add eax, 0x20
imul ecx, ecx, 0x21
add ecx, eax
movsx eax, byte [edx]
test eax, eax
jne 0x40af70
mov dword [edi + 0x1c], ecx
pop edi
pop esi
ret 4
Function at 0x40d040
Capabilities:
Hash data using djb2

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
mov eax, 0x1505
je 0x40d06e
mov edx, dword [esp + 4]
push esi
mov esi, ecx
movsx ecx, byte [edx]
inc edx
cmp ecx, 0x40
jle 0x40d065
cmp ecx, 0x5b
jge 0x40d065
add ecx, 0x20
imul eax, eax, 0x21
add eax, ecx
dec esi
jne 0x40d054
pop esi
ret

Function at 0x40d0f0
Capabilities:
Hash data using djb2

Disassembly:
sub esp, 0x808
push esi
mov esi, dword [esp + 0x814]
push 5
push esi
push str.data_
call fcn.005e0a1f
add esp, 0xc
test eax, eax
je 0x40d130
push 5
push esi
push 0x6bc710
call fcn.005e0a1f
add esp, 0xc
test eax, eax
je 0x40d130
xor al, al
pop esi
add esp, 0x808
ret
push edi
mov edi, dword [0x719e7c]
test edi, edi
jne 0x40d146
pop edi
xor al, al
pop esi
add esp, 0x808
ret
lea eax, [esi + 5]
lea edx, [esp + 0x10]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40d150
push ebx
xor ebx, ebx
xor ecx, ecx
mov esi, edi
xor eax, eax
mov dl, byte [esp + ebx + 0x14]
cmp dl, 0x2f
je 0x40d179
cmp dl, 0x5c
je 0x40d179
test dl, dl
je 0x40d1c6
inc ebx
inc eax
jmp 0x40d163
test eax, eax
lea edx, [esp + ecx + 0x14]
mov ecx, 0x1505
je 0x40d1a1
mov edi, eax
movsx eax, byte [edx]
inc edx
cmp eax, 0x40
jle 0x40d199
cmp eax, 0x5b
jge 0x40d199
add eax, 0x20
imul ecx, ecx, 0x21
add ecx, eax
dec edi
jne 0x40d188
mov dword [esp + 0xc], ecx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x2c]
call fcn.00564240
mov eax, dword [eax]
cmp eax, dword [esi + 0x30]
je 0x40d222
mov esi, dword [eax + 0x10]
inc ebx
mov ecx, ebx
jmp 0x40d161
push eax
lea edx, [esp + ecx + 0x18]
push edx
call fcn.0040d040
add esp, 8
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x20]
call fcn.00564240
mov eax, dword [eax]
cmp eax, dword [esi + 0x24]
je 0x40d222
mov esi, dword [eax + 0x10]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0x818]
push 0
push edx
mov edx, dword [ecx]
push eax
push edx
call fcn.005ce2a2
add esp, 0x10
pop ebx
pop edi
mov dword [0x719e80], esi
mov al, 1
pop esi
add esp, 0x808
ret
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x808
ret