joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e53b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x10c
mov eax, 0x430d2a
call fcn.004107aa
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
call fcn.0040e484
mov ebx, eax
test ebx, ebx
je 0x40e628
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push dword [esi + 0x38]
call edi
test eax, eax
jne 0x40e5de
push 0x434cb4
lea ecx, [ebp - 0x28]
call fcn.00401ca2
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.0040e4a2
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 5
call fcn.004090c2
push 0x4325e4
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x80]
call fcn.00407da2
mov esi, eax
push 0x46
push 0x434c10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x74]
push 0x434c28
jmp 0x40e692
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi + 0x34], 6
mov edi, eax
jne 0x40e60f
mov edx, dword [esi + 0x18]
mov ecx, edi
and edx, 0xf
jbe 0x40e605
movzx eax, word [ecx]
lea ecx, [ecx + eax*2]
add ecx, 2
sub edx, 1
jne 0x40e5f7
movzx eax, word [ecx]
lea edi, [ecx + 2]
add eax, eax
jmp 0x40e619
push ebx
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov eax, edi
call fcn.00410759
ret 4
push 0x434c9c
lea ecx, [ebp - 0x28]
call fcn.00401ca2
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x64]
mov ecx, esi
push eax
call fcn.0040e4a2
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.004090c2
push 0x4325e4
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [sym.imp.KERNEL32.dll_FindResourceA]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x74]
call fcn.00407da2
mov esi, eax
push 0x41
push 0x434c10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x80]
push 0x434c28
call fcn.00401d7d
push eax
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.00401962
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0x441054
push eax
call fcn.00413602
int3

Function at 0x422c7b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00422af1

Function at 0x428592
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042820f

Function at 0x42ea20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42ea4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42ea4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100903f0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100905d1
pushal
mov esi, section.UPX1
lea edi, [esi - 0x63000]
push edi
or ebp, 0xffffffff
jmp 0x1009041a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10090421
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10090410
mov eax, 1
add ebx, ebx
jne 0x10090433
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10090444
jne 0x10090463
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10090463
dec eax
add ebx, ebx
jne 0x10090450
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10090428
add ebx, ebx
jne 0x1009045f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100904b5
xor ecx, ecx
sub eax, 3
jb 0x1009047b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100904ea
sar eax, 1
mov ebp, eax
jmp 0x10090486
add ebx, ebx
jne 0x10090486
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10090454
inc ecx
add ebx, ebx
jne 0x10090494
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10090454
add ebx, ebx
jne 0x100904a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10090496
jne 0x100904b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10090496
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100904d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100904c6
jmp 0x10090416
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100904d4
add edi, ecx
jmp 0x10090416
pop esi
lea edi, [esi + 0x8b000]
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100904f6
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100904fb
lea edi, [esi + 0x8c000]
mov eax, dword [edi]
or eax, eax
je 0x10090563
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x903c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x90434]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10090521
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x90438]
or eax, eax
je 0x1009055d
mov dword [ebx], eax
add ebx, 4
jmp 0x1009053e
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10090594
cmp al, 0xef
ja 0x10090587
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10090569
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10090576
mov ebp, dword [esi + 0x9043c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100905c8
sub esp, 0xffffff80
jmp 0x1001c8dc
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x73a13a9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rsrc
mov ebx, 0x42e1d0
nop
mov ecx, 0x1ced2228
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401ec9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401f08
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401f08
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401f08
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401f08
cmp dword [ecx + 0x74], 0xe
jbe 0x401f08
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x406e95
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x406ee0
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00407030
test al, al
jne 0x406eda
sub edx, 2
cmp edx, edi
jne 0x406ec0
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x406f02
lea eax, [edi + 2]
cmp edx, eax
je 0x406f02
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00406de1
add esp, 0x10
jmp 0x406ffc
push esi
lea ecx, [ebp - 0x255]
call fcn.00407030
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406f45
push dword [ebp - 0x25c]
jmp 0x406ef2
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x406f82
cmp word [ebp - 0x226], 0
je 0x406fa3
cmp word [ebp - 0x226], ax
jne 0x406f82
cmp word [ebp - 0x224], 0
je 0x406fa3
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00406de1
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x406fef
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406f5c
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x406fd7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x406ffc
push 0x406b42
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040a450
add esp, 0x10
jmp 0x406fcc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401616
leave
ret
Function at 0x407c08
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x407ca5
push ebx
push esi
call fcn.00407bd1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407b65
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x407c52
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407ca4
push edi
push eax
call fcn.00406984
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x407c72
call fcn.00406b08
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407ca3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407b65
add esp, 0x20
test eax, eax
jne 0x407c91
push edi
call fcn.00406b08
jmp 0x407c99
push ebx
call fcn.00406b08
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x408f50
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411010
push 0x411008
push str.FlsAlloc
push 0x1f
call fcn.00408e0f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408f84
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f110]
call esi
jmp 0x408f8a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408fce
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411020
push 0x411018
push str.FlsGetValue
push 0x21
call fcn.00408e0f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409005
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f110]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40900d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x411028
push 0x411020
push str.FlsSetValue
push 0x22
call fcn.00408e0f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409047
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f110]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40e1b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e1dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e1dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402b06
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x402b60
push eax
push 0x40166a
call fcn.00402b9e
push 7
push 0x5ec0bc
push dword [eax + 0x30]
call fcn.00402ef7
cmp eax, 0
jne 0x402b3a
inc eax
jmp 0x402b62
push 0x401682
call fcn.00402b9e
push 7
push 0x5ec0bc
push dword [eax + 0x30]
call fcn.00402ef7
cmp eax, 0
jne 0x402b5b
inc eax
jmp 0x402b62
pop eax
mov eax, dword [eax]
jmp 0x402b14
xor eax, eax
ret

Function at 0x402b78
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x402b8c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x402b9e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x5ec0bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xcd
stosw word es:[edi], ax
cmp ax, 0
jne 0x402bac
pop edi
pop esi
leave
ret 4

Function at 0x402bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x5ec0bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xcd
stosb byte es:[edi], al
cmp al, 0
jne 0x402bce
pop edi
pop esi
leave
ret 4

Function at 0x402e02
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x402e53
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x402e53
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x402e5a
add edx, 4
loop 0x402e1a
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x402e61
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x402ead
cmp dx, 0x41
jb 0x402e92
cmp dx, 0x5a
jbe 0x402e98
cmp dx, 0x61
jb 0x402ea4
cmp dx, 0x7a
ja 0x402ea4
xor dx, 0x20
jmp 0x402ea6
jmp 0x402ec0
cmp dx, word [edi]
je 0x402ead
jmp 0x402ec0
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x402e7e
mov eax, dword [eax + 0x18]
jmp 0x402ec8
mov eax, dword [eax]
cmp ebp, eax
jne 0x402e73
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x407400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6538c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x6af168]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
call fcn.005653c0
mov ecx, dword [ebp + 8]
push 1
push eax
mov dword [esp + 0x40], 0
mov edx, dword [esi + 0xb0]
push ecx
push edx
call fcn.005468d0
test al, al
lea ecx, [esp + 0xc]
jne 0x407470
call fcn.005653e0
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.004074a0
lea ecx, [esp + 0xc]
mov bl, al
call fcn.005653e0
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x412480
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65c7c0
mov eax, dword fs:[0]
push eax
sub esp, 0x180
mov eax, dword [0x6af168]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi + 0x88]
push 0
add eax, 0x8f8
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004e7710
add esp, 0xc
lea edx, [ebp - 0x188]
push edx
push str.levels.dat
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41251e
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ecx]
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x4124fc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.0062517b
add esp, 8
test eax, eax
je 0x41254b
lea ecx, [ebp - 0x188]
push ecx
push esi
call ebx
test eax, eax
jne 0x4124f0
cmp dword [ebp - 0x14], 0x10
jb 0x412530
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0062493b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00624940
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x188]
push edx
push esi
call ebx
test eax, eax
je 0x4125ab
push str.levels_
lea ecx, [ebp - 0x48]
call fcn.00402130
lea eax, [ebp - 0x15c]
mov byte [ebp - 4], 1
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x412573
sub eax, edx
push eax
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x48]
call fcn.00446130
lea ecx, [ebp - 0x48]
push ecx
mov eax, edi
call fcn.00412430
cmp dword [ebp - 0x30], 0x10
jb 0x4125ab
mov edx, dword [ebp - 0x44]
push edx
call fcn.0062493b
add esp, 4
cmp dword [ebp - 0x14], 0x10
jb 0x412530
mov eax, dword [ebp - 0x28]
push eax
jmp 0x412528
Function at 0x413080
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65a7e8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6af168]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, esi
mov byte [0x6b9cc5], 0
call fcn.00413320
push 0
call fcn.004125c0
cmp dword [esi + 0x2bc], 0
je 0x413156
push str.LevelEditor_editlevel.dat
lea ecx, [ebp - 0x2c]
call fcn.00402130
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x28]
mov edi, 0x10
cmp dword [ebp - 0x14], edi
jae 0x4130f3
lea ecx, [ebp - 0x28]
cmp dword [esi + 0x2c0], edi
jb 0x413103
mov eax, dword [esi + 0x2ac]
jmp 0x413109
lea eax, [esi + 0x2ac]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [esi + 0x88]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2c]
add ecx, 0x8f8
push eax
call fcn.00401d10
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], edi
jb 0x413144
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.0062493b
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov edi, dword [esi + 0x88]
mov edx, dword [edi + 0x770]
mov ebx, dword [edx]
add edi, 0x76c
lea ebx, [ebx]
mov eax, dword [esi + 0x88]
mov ecx, dword [eax + 0x770]
add eax, 0x76c
cmp edi, eax
mov dword [ebp - 0x30], ecx
je 0x41318d
call fcn.0062492b
cmp ebx, dword [ebp - 0x30]
je 0x4131b7
cmp ebx, dword [edi + 4]
jne 0x41319c
call fcn.0062492b
mov edx, dword [ebx + 8]
mov dword [edx + 0xe4], 0
cmp ebx, dword [edi + 4]
jne 0x4131b3
call fcn.0062492b
mov ebx, dword [ebx]
jmp 0x413170
mov eax, dword [esi + 0x88]
fld dword [esi + 0xac]
mov ecx, dword [eax + 0x720]
fstp dword [0x6b3660]
movzx edx, byte [ecx + 0x102]
push edx
mov eax, esi
call fcn.004191a0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov edx, dword [esi + 0x88]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00624940
mov esp, ebp
pop ebp
ret

Function at 0x414cc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0x91
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x414cd4
nop
mov ecx, dword [ebp + 8]
add ecx, 0x1e4
call fcn.0060f8f0
pop ebp
ret 4
Function at 0x41bd10
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
mov edi, str.Adventure
mov esi, eax
mov ecx, 0xa
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41bd2f
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.0041bed0
mov edi, str.Character
mov esi, eax
mov ecx, 0xa
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41bd4b
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.0041bff0
mov edi, str.Dialog
mov esi, eax
mov ecx, 7
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41bd67
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.0041c490
mov edi, str.Game
mov esi, eax
mov ecx, 5
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41bd83
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.0041d4a0
mov edi, str.Help
mov esi, eax
mov ecx, 5
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41bd9f
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.0041f4c0
mov edi, 0x670470
mov esi, eax
mov ecx, 3
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41bdbb
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.0041f690
mov edi, str.Init
mov esi, eax
mov ecx, 5
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41bdd7
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.0041ff10
mov edi, str.Interface
mov esi, eax
mov ecx, 0xa
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41bdf3
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.00420520
mov edi, str.LevelSelect
mov esi, eax
mov ecx, 0xc
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41be0f
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.00421010
mov edi, str.Load
mov esi, eax
mov ecx, 5
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41be2b
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.004215c0
mov edi, str.LoadingThread
mov esi, eax
mov ecx, 0xe
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41be47
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.00422010
mov edi, str.MainMenu
mov esi, eax
mov ecx, 9
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41be63
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.00423880
mov edi, str.Story
mov esi, eax
mov ecx, 6
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41be7f
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.004248e0
mov edi, str.Trophy
mov esi, eax
mov ecx, 7
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x41be9b
pop edi
pop esi
mov ecx, edx
pop ebx
jmp fcn.004249a0
mov esi, eax
mov edi, str.Upsell
mov ecx, 7
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
pop ebx
jne 0x41beb7
mov ecx, edx
jmp fcn.00425170
xor al, al
ret
Function at 0x429570
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64bafe
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x6af168]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esi + 0x19c]
mov dword [ebp - 4], 2
call fcn.00445610
cmp dword [esi + 0x30], 0x10
jb 0x4295ba
mov eax, dword [esi + 0x1c]
push eax
call fcn.0062493b
add esp, 4
xor eax, eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0xf
mov byte [esi + 0x1c], al
mov byte [ebp - 4], al
lea eax, [esi + 0xc]
call fcn.00444ca0
mov eax, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00444ca0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4