joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410730
Capabilities:
Print debug messages

Disassembly:
push esi
push str.Creating_DirectInput_interface_n
call fcn.0040ea30
mov eax, dword [0x5c133c]
add esp, 4
push 0
push 0x5c1354
push 0x466964
push 0x800
push eax
call sub.DINPUT8.dll_DirectInput8Create
test eax, eax
jge 0x41076f
push str.DirectInput8Create___failed_n
call fcn.0040ea10
add esp, 4
xor al, al
pop esi
ret
push str.Creating_DirectInput_keyboard_device_n
call fcn.0040ea30
mov eax, dword [0x5c1354]
add esp, 4
mov ecx, dword [eax]
push 0
push 0x5c1358
push 0x4668c4
push eax
call dword [ecx + 0xc]
test eax, eax
jge 0x4107a8
push str.DirectInput_CreateDevice___failed__SysKeyboard__n
call fcn.0040ea10
add esp, 4
xor al, al
pop esi
ret
push str.Setting_keyboard_parameters_n
call fcn.0040ea30
mov eax, dword [0x5c1358]
add esp, 4
mov edx, dword [eax]
push 0x46687c
push eax
call dword [edx + 0x2c]
mov eax, dword [0x5c1358]
mov edx, dword [0x5c1340]
push 0x16
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
push str.Acquiring_keyboard_device_n
call fcn.0040ea30
mov eax, dword [0x5c1358]
add esp, 4
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jge 0x410806
push str.Keyboard_acquisition_failed_n
call fcn.0040ea10
add esp, 4
xor al, al
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Keyboard_acquired_n
call esi
mov eax, dword [0x5c1354]
push 1
push 0
push 0x410890
mov edx, dword [eax]
push 4
push eax
call dword [edx + 0x10]
test eax, eax
jge 0x410834
push str.Couldnt_find_a_joystick_n
call esi
mov eax, dword [0x5c135c]
test eax, eax
jne 0x410848
push str.Joystick_not_found._n
call esi
mov al, 1
pop esi
ret
mov edx, dword [0x5c1340]
mov ecx, dword [eax]
push 5
push edx
push eax
call dword [ecx + 0x34]
test eax, eax
jl 0x41087d
mov eax, dword [0x5c135c]
push 0x466674
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x5c135c]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov byte [0x5c1360], 1
mov al, 1
pop esi
ret
Function at 0x410960
Capabilities:
Print debug messages
Terminate process

Disassembly:
mov eax, dword [0x5c1344]
push 0
push 0x15
push 0x15
mov ecx, dword [eax]
push 1
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x41098a
push str.D3DFMT_A8R8G8B8_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x15
ret
mov eax, dword [0x5c1344]
push 0
push 0x16
push 0x16
mov edx, dword [eax]
push 1
push 0
push eax
call dword [edx + 0x24]
test eax, eax
jl 0x4109b4
push str.D3DFMT_X8R8G8B8_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x16
ret
mov eax, dword [0x5c1344]
push 0
push 0x17
push 0x17
mov ecx, dword [eax]
push 1
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x4109de
push str.D3DFMT_R5G6B5_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x17
ret
mov eax, dword [0x5c1344]
push 0
push 0x18
push 0x18
mov edx, dword [eax]
push 1
push 0
push eax
call dword [edx + 0x24]
test eax, eax
jl 0x410a08
push str.D3DFMT_X1R5G5B5_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 0x18
ret
push str.Couldnt_find_a_decent_display_mode_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.0040fff0
call fcn.0040fd60
push 5
call fcn.00426f0a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4148a0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x100
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
test byte [eax + 0x475bdc], 0x80
je 0x4148bd
mov byte [esp + eax + 0xc], 1
jmp 0x4148c1
mov byte [esp + eax + 0xc], bl
inc eax
cmp eax, 0x100
jl 0x4148ad
mov eax, dword [0x5c1358]
push 0x475bdc
push 0x100
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp eax, ebx
jge 0x41490c
cmp eax, 0x8007001e
je 0x4148f6
cmp eax, 0x8007000c
jne 0x41490c
mov eax, dword [0x5c1358]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
test eax, eax
jl 0x41490c
push str.Keyboard_reacquired_n
call edi
xor eax, eax
mov cl, byte [eax + 0x475bdc]
mov byte [eax + 0x476a5c], bl
test cl, 0x80
je 0x41492c
cmp byte [esp + eax + 0xc], bl
jne 0x41492c
mov byte [eax + 0x476a5c], 1
inc eax
cmp eax, 0x100
jl 0x41490e
cmp dword [0x5bddb4], 1
jne 0x414a2f
mov eax, dword [0x5c135c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x64]
test eax, eax
jge 0x4149ae
mov eax, dword [0x5c135c]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp eax, 0x8007001e
jne 0x41497e
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
mov eax, dword [0x5c135c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp eax, 0x8007001e
je 0x414968
cmp eax, 0x80070057
je 0x41499d
cmp eax, 0x80070015
je 0x41499d
cmp eax, 0x80070005
jne 0x4149ae
pop edi
pop esi
pop ebx
add esp, 0x100
ret
push str.Cannot_communicate_with_wheel_n
call edi
pop edi
pop esi
pop ebx
add esp, 0x100
ret
xor eax, eax
cmp eax, ebx
jl 0x4149c9
cmp eax, 0x20
jge 0x4149c9
test byte [eax + 0x47dfc8], 0x80
je 0x4149c9
mov byte [esp + eax + 0xc], 1
jmp 0x4149cd
mov byte [esp + eax + 0xc], bl
inc eax
cmp eax, 0x20
jl 0x4149b0
mov eax, dword [0x5c135c]
push 0x47df98
push pe_nt_image_headers32
push eax
mov edx, dword [eax]
call dword [edx + 0x24]
xor esi, esi
cmp esi, ebx
mov byte [esi + 0x475bb0], bl
jl 0x414a29
cmp esi, 0x20
jge 0x414a29
test byte [esi + 0x47dfc8], 0x80
je 0x414a29
cmp byte [esp + esi + 0xc], bl
jne 0x414a29
push esi
push str.Button__d_down_n
push 0x479c08
mov byte [esi + 0x475bb0], 1
call fcn.00426959
add esp, 0xc
push 0x479c08
call edi
inc esi
cmp esi, 0x20
jl 0x4149ea
pop edi
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x414ba0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ecx
mov al, byte [0x48d520]
test al, 1
jne 0x414bc2
mov cl, al
push 0
or cl, 1
mov byte [0x48d520], cl
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [0x5bdd6c], eax
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0xffffffff
jne 0x414bd1
xor al, al
pop esi
pop ecx
ret
push 0x47dba0
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x414be5
xor al, al
pop esi
pop ecx
ret
mov eax, dword [0x5bdd6c]
push eax
push 1
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov ecx, dword [0x5bdd6c]
lea edx, [esp + 4]
push ecx
push 0
push edx
push 0x47dba0
push esi
push eax
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov ecx, dword [esp + 4]
dec eax
neg eax
sbb al, al
pop esi
not al
and eax, ecx
pop ecx
ret
Function at 0x42c845
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x470a28
cmp edx, dword [eax]
je 0x42c867
add eax, 8
inc ecx
cmp eax, 0x470ab8
jl 0x42c858
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x470a28]
jne 0x42c995
mov eax, dword [0x5c1490]
cmp eax, 1
je 0x42c96f
test eax, eax
jne 0x42c898
cmp dword [0x46e918], 1
je 0x42c96f
cmp edx, 0xfc
je 0x42c995
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42c8cf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0042e2b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00429140
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x42c912
lea eax, [ebp - 0x1a4]
push eax
call fcn.00429140
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x462a24
push edi
call fcn.004264d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0042e2b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0042e2c0
lea eax, [ebp - 0xa0]
push 0x462a04
push eax
call fcn.0042e2c0
push dword [esi + 0x470a2c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0042e2c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0042eaad
add esp, 0x2c
pop edi
jmp 0x42c995
lea eax, [ebp + 8]
lea esi, [esi + 0x470a2c]
push 0
push eax
push dword [esi]
call fcn.00429140
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x437a7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x437b9f
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x437b83
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x437ad5
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x437ab3
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret
Function at 0x437e6b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x437fb2
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x437f8d
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x437ed4
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x437eab
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x4380df
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x438225
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x438200
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x438148
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x43811f
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x43822e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x438378
mov edx, 0xf0f0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x438353
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x438297
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x43826e
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x438381
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x105c]
push edi
mov edi, dword [edx + 0x1050]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x4384b7
push ebx
mov edx, dword [edx + 0x1058]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x438492
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x4383e0
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1050]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1050]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x4383bc
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x43855b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1050]
push edi
mov edi, dword [edx + 0x105c]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x43869f
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1058]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x438679
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x4385c4
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1050]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1050]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x43859b
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x4387c8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1050]
push edi
mov edi, dword [edx + 0x105c]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x43890c
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1058]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x4388e6
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x438831
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1050]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1050]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x438808
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x438914
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x105c]
push edi
mov edi, dword [edx + 0x1050]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x438a4a
push ebx
mov edx, dword [edx + 0x1058]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x438a25
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x438973
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1050]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1050]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x43894f
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret

Function at 0x44058d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4405e5
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4405e5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x4405e5
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret