joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456701
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
add esi, 4
mov ebx, eax
shr eax, 0x10
and ebx, 0x7fff
cmp edx, dword ss:[0x58bb9c]
jge 0x4567d0
cmp ecx, dword ss:[0x58bb98]
jge 0x4567d0
lea edi, [edx + ebx]
cmp edi, 0
jle 0x4567d0
lea edi, [ecx + eax]
cmp edi, 0
jle 0x4567d0
cmp edi, dword ss:[0x58bb98]
jle 0x456761
mov eax, dword ss:[0x58bb98]
sub eax, ecx
mov dword ss:[0x48732c], eax
cmp ecx, 0
jge 0x456791
mov edi, 0
sub edi, ecx
sub dword ss:[0x48732c], edi
jle 0x4567d0
add ecx, edi
mov al, byte [esi]
inc esi
test al, al
jns 0x45677e
and eax, 0x7f
je 0x45678e
add esi, eax
jmp 0x45677e
dec edi
jne 0x45677e
mov edi, dword ss:[0x58bba0]
imul edi, ecx
add edi, dword ss:[0x58bba4]
add edi, edx
mov dword ss:[0x487340], edi
lea ecx, [edx + ebx]
cmp ecx, dword ss:[0x58bb9c]
setge cl
and ecx, 1
or ecx, 4
cmp edx, 0
jge case.default.0x4567c8
or ecx, 2
xor eax, eax
jmp dword ss:[ecx*4 + 0x486a1c]
popal
mov esp, ebp
pop ebp
ret

Function at 0x4567d5
Capabilities:
Packed with generic packer

Disassembly:
lea edi, [edi + ecx*2]
mov cl, byte [esi]
inc esi
test cl, cl
jns 0x45604b
and ecx, 0x7f
je 0x456073
xor eax, eax
mov al, byte [esi]
inc esi
mov ebx, dword ss:[eax*4 + 0x557160]
nop
mov word [edi], bx
add edi, 2
dec ecx
jne 0x45605c
jmp case.0x4568a1.0
mov edi, dword ss:[0x487340]
add edi, dword ss:[0x58bba0]
mov dword ss:[0x487340], edi
dec dword ss:[0x48732c]
jne case.0x4568a1.0
jmp 0x456322
popal
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
add esi, 4
mov ebx, eax
shr eax, 0x10
and ebx, 0x7fff
cmp edx, dword ss:[0x58bb9c]
jge 0x456322
cmp ecx, dword ss:[0x58bb98]
jge 0x456322
lea edi, [edx + ebx]
cmp edi, 0
jle 0x456322
lea edi, [ecx + eax]
cmp edi, 0
jle 0x456322
cmp edi, dword ss:[0x58bb98]
jle 0x456835
mov eax, dword ss:[0x58bb98]
sub eax, ecx
mov dword ss:[0x48732c], eax
cmp ecx, 0
jge 0x456869
mov edi, 0
sub edi, ecx
sub dword ss:[0x48732c], edi
jle 0x456322
add ecx, edi
mov al, byte [esi]
inc esi
test al, al
jns 0x456856
and eax, 0x7f
je 0x456866
add esi, eax
jmp 0x456856
dec edi
jne 0x456856
mov edi, dword ss:[0x58bba0]
imul edi, ecx
add edi, dword ss:[0x58bba4]
lea edi, [edi + edx*2]
mov dword ss:[0x487340], edi
lea ecx, [edx + ebx]
cmp ecx, dword ss:[0x58bb9c]
setge cl
and ecx, 1
cmp edx, 0
jge case.default.0x4568a1
or ecx, 2
or ecx, 4
xor eax, eax
jmp dword ss:[ecx*4 + 0x486a3c]
Function at 0x456f39
Capabilities:
Packed with generic packer

Disassembly:
sub edi, ecx
mov cl, byte [esi]
inc esi
test cl, cl
jns 0x456b78
and ecx, 0x7f
je 0x456b9b
mov al, byte [edi]
mov ah, byte [esi]
dec edi
mov al, byte ss:[eax + 0x557680]
inc esi
mov byte [edi + 1], al
dec ecx
jne 0x456b86
jmp case.0x457005.4
mov edi, dword ss:[0x487340]
add edi, dword ss:[0x58bba0]
mov dword ss:[0x487340], edi
dec dword ss:[0x48732c]
jne case.0x457005.4
jmp case.0x457005.3
sub edx, 0
inc edx
mov dword ss:[0x487334], edx
mov cl, byte [esi]
inc esi
test cl, cl
js 0x456dac
sub edi, ecx
sub edx, ecx
jg 0x456d9a
jmp 0x456e82
and ecx, 0x7f
je 0x456e92
sub edx, ecx
jg 0x456dbb
add ecx, edx
sub ecx, 4
js 0x456e58
mov eax, dword [esi]
add esi, 4
bswap eax
mov dword [edi - 3], eax
sub edi, 4
sub ecx, 4
js 0x456e58
mov eax, dword [esi]
add esi, 4
bswap eax
mov dword [edi - 3], eax
sub edi, 4
sub ecx, 4
js 0x456e58
mov eax, dword [esi]
add esi, 4
bswap eax
mov dword [edi - 3], eax
sub edi, 4
sub ecx, 4
js 0x456e58
mov eax, dword [esi]
add esi, 4
bswap eax
mov dword [edi - 3], eax
sub edi, 4
sub ecx, 4
js 0x456e58
mov eax, dword [esi]
add esi, 4
bswap eax
mov dword [edi - 3], eax
sub edi, 4
sub ecx, 4
js 0x456e58
mov eax, dword [esi]
add esi, 4
bswap eax
mov dword [edi - 3], eax
sub edi, 4
sub ecx, 4
js 0x456e58
mov eax, dword [esi]
add esi, 4
bswap eax
mov dword [edi - 3], eax
sub edi, 4
sub ecx, 4
js 0x456e58
mov eax, dword [esi]
add esi, 4
bswap eax
mov dword [edi - 3], eax
sub edi, 4
jmp 0x456dbb
add ecx, 4
je 0x456e78
mov al, byte [esi]
inc esi
mov byte [edi], al
dec edi
dec ecx
je 0x456e78
mov al, byte [esi]
inc esi
mov byte [edi], al
dec edi
dec ecx
je 0x456e78
mov al, byte [esi]
inc esi
mov byte [edi], al
dec edi
dec ecx
je 0x456e78
test edx, edx
jg 0x456d9a
sub esi, edx
mov cl, byte [esi]
inc esi
test cl, cl
jns 0x456e82
and ecx, 0x7f
je 0x456e92
add esi, ecx
jmp 0x456e82
mov edi, dword ss:[0x487340]
add edi, dword ss:[0x58bba0]
mov dword ss:[0x487340], edi
dec dword ss:[0x48732c]
mov edx, dword ss:[0x487334]
jne 0x456d9a
jmp case.0x457005.3
push ebp
mov ebp, esp
pushal
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
add esi, 4
mov ebx, eax
shr eax, 0x10
and ebx, 0x7fff
cmp edx, 0
jle 0x45700d
cmp ecx, dword ss:[0x58bb98]
jge 0x45700d
mov edi, edx
sub edi, ebx
cmp edi, dword ss:[0x58bb9c]
jge 0x45700d
lea edi, [ecx + eax]
cmp edi, 0
jle 0x45700d
cmp edi, dword ss:[0x58bb98]
jle 0x456f9a
mov eax, dword ss:[0x58bb98]
sub eax, ecx
mov dword ss:[0x48732c], eax
cmp ecx, 0
jge 0x456fca
mov edi, 0
sub edi, ecx
sub dword ss:[0x48732c], edi
jle 0x45700d
add ecx, edi
mov al, byte [esi]
inc esi
test al, al
jns 0x456fb7
and eax, 0x7f
je 0x456fc7
add esi, eax
jmp 0x456fb7
dec edi
jne 0x456fb7
mov edi, dword ss:[0x58bba0]
imul edi, ecx
add edi, dword ss:[0x58bba4]
add edi, edx
mov dword ss:[0x487340], edi
mov ecx, edx
sub ecx, ebx
inc ecx
cmp ecx, 0
mov ecx, 4
jge 0x456ff6
or ecx, 2
cmp edx, dword ss:[0x58bb9c]
jl case.default.0x457005
inc ecx
mov eax, dword [ebp + 0x14]
mov ah, al
jmp dword ss:[ecx*4 + 0x486a7c]
popal
mov esp, ebp
pop ebp
ret
Function at 0x457012
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
add esi, 4
mov ebx, eax
shr eax, 0x10
and ebx, 0x7fff
cmp edx, dword ss:[0x58bb9c]
jge 0x45720c
cmp ecx, dword ss:[0x58bb98]
jge 0x45720c
lea edi, [edx + ebx]
cmp edi, 0
jle 0x45720c
lea edi, [ecx + eax]
cmp edi, 0
jle 0x45720c
cmp edi, dword ss:[0x58bb98]
jle 0x457072
mov eax, dword ss:[0x58bb98]
sub eax, ecx
mov dword ss:[0x48732c], eax
cmp ecx, 0
jge 0x4570a6
mov edi, 0
sub edi, ecx
sub dword ss:[0x48732c], edi
jle 0x45720c
add ecx, edi
mov al, byte [esi]
inc esi
test al, al
jns 0x457093
and eax, 0x7f
je 0x4570a3
add esi, eax
jmp 0x457093
dec edi
jne 0x457093
mov edi, dword ss:[0x58bba0]
imul edi, ecx
add edi, dword ss:[0x58bba4]
add edi, edx
mov dword ss:[0x487340], edi
lea ecx, [edx + ebx]
cmp ecx, dword ss:[0x58bb9c]
setge cl
and ecx, 1
cmp edx, 0
jge case.default.0x4570dd
or ecx, 2
mov eax, dword [ebp + 0x14]
mov ah, al
jmp dword ss:[ecx*4 + 0x486a9c]
add edi, ecx
mov cl, byte [esi]
inc esi
test cl, cl
jns 0x4570e5
and ecx, 0x7f
je 0x457101
mov al, byte [esi]
inc edi
add al, ah
inc esi
mov byte [edi - 1], al
dec ecx
jne 0x4570f3
jmp case.0x4570dd.0
mov edi, dword ss:[0x487340]
add edi, dword ss:[0x58bba0]
mov dword ss:[0x487340], edi
dec dword ss:[0x48732c]
jne case.0x4570dd.0
jmp 0x45720c
popal
mov esp, ebp
pop ebp
ret

Function at 0x457871
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
add esi, 4
mov ebx, eax
shr eax, 0x10
and ebx, 0x7fff
cmp edx, dword ss:[0x58bb9c]
jge 0x457a78
cmp ecx, dword ss:[0x58bb98]
jge 0x457a78
lea edi, [edx + ebx]
cmp edi, 0
jle 0x457a78
lea edi, [ecx + eax]
cmp edi, 0
jle 0x457a78
cmp edi, dword ss:[0x58bb98]
jle 0x4578d1
mov eax, dword ss:[0x58bb98]
sub eax, ecx
mov dword ss:[0x48732c], eax
cmp ecx, 0
jge 0x457905
mov edi, 0
sub edi, ecx
sub dword ss:[0x48732c], edi
jle 0x457a78
add ecx, edi
mov al, byte [esi]
inc esi
test al, al
jns 0x4578f2
and eax, 0x7f
je 0x457902
add esi, eax
jmp 0x4578f2
dec edi
jne 0x4578f2
mov edi, dword ss:[0x58bba0]
imul edi, ecx
add edi, dword ss:[0x58bba4]
add edi, edx
mov dword ss:[0x487340], edi
lea ecx, [edx + ebx]
cmp ecx, dword ss:[0x58bb9c]
setge cl
and ecx, 1
cmp edx, 0
jge case.default.0x45793c
or ecx, 2
mov eax, dword [ebp + 0x14]
mov ah, al
jmp dword ss:[ecx*4 + 0x486adc]
add edi, ecx
mov cl, byte [esi]
inc esi
test cl, cl
jns 0x457944
and ecx, 0x7f
je 0x457964
mov al, byte [esi]
inc esi
mov al, byte ss:[eax + 0x557680]
mov byte [edi], al
inc edi
dec ecx
jne 0x457952
jmp case.0x45793c.0
mov edi, dword ss:[0x487340]
add edi, dword ss:[0x58bba0]
mov dword ss:[0x487340], edi
dec dword ss:[0x48732c]
jne case.0x45793c.0
jmp 0x457a78
popal
mov esp, ebp
pop ebp
ret
Function at 0x457c8e
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
add esi, 4
mov ebx, eax
shr eax, 0x10
and ebx, 0x7fff
cmp edx, dword ss:[0x58bb9c]
jge 0x457e77
cmp ecx, dword ss:[0x58bb98]
jge 0x457e77
lea edi, [edx + ebx]
cmp edi, 0
jle 0x457e77
lea edi, [ecx + eax]
cmp edi, 0
jle 0x457e77
cmp edi, dword ss:[0x58bb98]
jle 0x457cee
mov eax, dword ss:[0x58bb98]
sub eax, ecx
mov dword ss:[0x48732c], eax
cmp ecx, 0
jge 0x457d22
mov edi, 0
sub edi, ecx
sub dword ss:[0x48732c], edi
jle 0x457e77
add ecx, edi
mov al, byte [esi]
inc esi
test al, al
jns 0x457d0f
and eax, 0x7f
je 0x457d1f
add esi, eax
jmp 0x457d0f
dec edi
jne 0x457d0f
mov edi, dword ss:[0x58bba0]
imul edi, ecx
add edi, dword ss:[0x58bba4]
add edi, edx
mov dword ss:[0x487340], edi
lea ecx, [edx + ebx]
cmp ecx, dword ss:[0x58bb9c]
setge cl
and ecx, 1
cmp edx, 0
jge case.default.0x457d57
or ecx, 2
mov eax, dword [ebp + 0x14]
jmp dword ss:[ecx*4 + 0x486b0c]
add edi, ecx
mov cl, byte [esi]
inc esi
test cl, cl
jns 0x457d5f
and ecx, 0x7f
je 0x457d76
inc esi
mov byte [edi], al
inc edi
dec ecx
jne 0x457d6d
jmp case.0x457d57.0
mov edi, dword ss:[0x487340]
add edi, dword ss:[0x58bba0]
mov dword ss:[0x487340], edi
dec dword ss:[0x48732c]
jne case.0x457d57.0
jmp 0x457e77
popal
mov esp, ebp
pop ebp
ret
Function at 0x45806d
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
add esi, 4
mov ebx, eax
shr eax, 0x10
and ebx, 0x7fff
cmp edx, dword ss:[0x58bb9c]
jge 0x458274
cmp ecx, dword ss:[0x58bb98]
jge 0x458274
lea edi, [edx + ebx]
cmp edi, 0
jle 0x458274
lea edi, [ecx + eax]
cmp edi, 0
jle 0x458274
cmp edi, dword ss:[0x58bb98]
jle 0x4580cd
mov eax, dword ss:[0x58bb98]
sub eax, ecx
mov dword ss:[0x48732c], eax
cmp ecx, 0
jge 0x458101
mov edi, 0
sub edi, ecx
sub dword ss:[0x48732c], edi
jle 0x458274
add ecx, edi
mov al, byte [esi]
inc esi
test al, al
jns 0x4580ee
and eax, 0x7f
je 0x4580fe
add esi, eax
jmp 0x4580ee
dec edi
jne 0x4580ee
mov edi, dword ss:[0x58bba0]
imul edi, ecx
add edi, dword ss:[0x58bba4]
add edi, edx
mov dword ss:[0x487340], edi
lea ecx, [edx + ebx]
cmp ecx, dword ss:[0x58bb9c]
setge cl
and ecx, 1
cmp edx, 0
jge case.default.0x458138
or ecx, 2
mov eax, dword [ebp + 0x14]
mov ah, al
jmp dword ss:[ecx*4 + 0x486afc]

Function at 0x459ed0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x459fe8
push str.WIN:_Could_not_allocate__u_KB_memory_block__negotiating_with_user
call fcn.0045d3a0
mov eax, dword [0x4a2bb4]
add esp, 4
test eax, eax
je 0x459f21
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4a24c4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x459f27
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, dword [0x4a2f38]
mov dl, byte [0x488150]
sub eax, esi
xor ecx, ecx
cmp dl, 5
mov ebx, eax
sete cl
mov esi, ecx
test esi, esi
je 0x459f4c
xor ecx, ecx
call fcn.00464350
mov edx, dword [0x4a30d4]
mov eax, dword [0x4a30c8]
push edi
push 0x459280
push edx
push 0x8f
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test esi, esi
mov edi, eax
je 0x459f75
call fcn.00464540
mov eax, dword [0x4a2bb4]
test eax, eax
je 0x459f9c
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4a24c4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x459fa2
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [0x4a2f38]
mov ecx, dword [0x4a30e8]
sub eax, ebx
sub eax, edx
add ecx, eax
test edi, edi
mov dword [0x4a30e8], ecx
je 0x459fd4
push str.WIN:_Memory_block_succesfully_allocated
call fcn.0045d3a0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.WIN:_Amnesia_Error:_Out_of_memory__user_canceled_memory_request
call fcn.0045d3a0
add esp, 4
call fcn.0045c9f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45aa10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
mov al, byte [0x4a311c]
push esi
push edi
je 0x45aaf3
cmp al, 1
jne 0x45aa6d
mov ecx, dword [0x4a30d4]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [0x58bbc0], eax
sub edx, eax
mov eax, dword [esp + 0x14]
sub eax, ecx
mov dword [0x58bbc4], ecx
mov dword [0x58bbc8], edx
mov dword [0x58bbcc], eax
mov byte [0x58bbe8], 1
mov ecx, dword [0x4a30d4]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetMenu]
mov edx, dword [0x4a30d4]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongA]
push bind
push 0xfffffffffffffff0
push edx
call esi
mov eax, dword [0x4a30d4]
push 8
push 0xffffffffffffffec
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x20
push 1
mov byte [0x4a311c], 2
call esi
push eax
push 0
call esi
mov ecx, dword [0x4a30d4]
push eax
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [0x4a30d4]
push edx
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x45abd2
mov eax, dword [0x4a30d4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x10
ret
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
cmp al, 2
jne 0x45ab53
mov al, byte [0x58bbe8]
test al, al
je 0x45ab53
mov ecx, dword [0x4a30d4]
push 0
push ecx
call edi
mov edx, dword [0x58bbcc]
mov eax, dword [0x58bbc8]
mov ecx, dword [0x58bbc4]
push 1
push edx
mov edx, dword [0x58bbc0]
push eax
mov eax, dword [0x4a30d4]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
call fcn.0045c7c0
mov ecx, dword [0x4a30d4]
push 0x4a2928
push ecx
call fcn.004688e0
add esp, 8
mov edx, dword [0x4a30d4]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongA]
push 0xcf0000
push 0xfffffffffffffff0
push edx
call esi
mov eax, dword [0x4a30d4]
push 0x300
push 0xffffffffffffffec
push eax
call esi
call fcn.0045abe0
mov ecx, dword [0x4a30d4]
push 3
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [0x4a30d4]
push 5
push edx
mov byte [0x4a311c], 1
call edi
mov eax, dword [0x4a30d4]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x4a30d4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
add esp, 0x10
ret
Function at 0x45c690
Capabilities:
Check for time delay via queryperformancecounter
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4a30d8]
test eax, eax
jne 0x45c7b8
mov ecx, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0xc]
push ebx
push eax
lea edx, [ebp - 0x208]
push ecx
push edx
mov dword [0x4a30d8], 1
call fcn.0047b8a0
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push str.WIN:_Application_notified_error:__s
call fcn.0045d3a0
mov al, byte [0x488150]
add esp, 8
cmp al, 5
jne 0x45c6ee
xor ecx, ecx
call fcn.00463c20
call fcn.0046a330
mov ecx, dword [0x4a30d4]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ecx
call esi
mov eax, dword [0x4a2bb4]
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
test eax, eax
je 0x45c731
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4a24c4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x45c733
call ebx
mov edi, dword [0x4a2f38]
xor ecx, ecx
sub eax, edi
mov edi, eax
call fcn.00463c20
mov eax, dword [0x4a30d4]
push 0
push eax
call esi
mov edx, dword [0x4a30d4]
mov eax, dword [0x4a30c8]
lea ecx, [ebp - 0x208]
push ecx
push 0x45eaa0
push edx
push 0x7b
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov eax, dword [0x4a2bb4]
test eax, eax
je 0x45c796
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4a24c4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x45c798
call ebx
mov edx, dword [0x4a2f38]
mov ecx, dword [0x4a30e8]
sub eax, edi
sub eax, edx
add ecx, eax
mov dword [0x4a30e8], ecx
call fcn.0045c9f0
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x460ea0
Capabilities:
Check for time delay via queryperformancecounter
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push 0x8000080
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [ebp + 0xc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x460ed8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x460fee
push str.WIN:_Could_not_allocate__u_KB_memory_block__negotiating_with_user
call fcn.0045d3a0
mov eax, dword [0x4a2bb4]
add esp, 4
test eax, eax
je 0x460f28
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4a24c4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x460f2e
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [0x4a2f38]
mov cl, byte [0x488150]
sub eax, edx
xor edx, edx
cmp cl, 5
mov dword [ebp + 8], eax
sete dl
mov edi, edx
test edi, edi
je 0x460f54
xor ecx, ecx
call fcn.00464350
mov eax, dword [0x4a30d4]
mov ecx, dword [0x4a30c8]
push ebx
push 0x459280
push eax
push 0x8f
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test edi, edi
mov ebx, eax
je 0x460f7d
call fcn.00464540
mov eax, dword [0x4a2bb4]
test eax, eax
je 0x460fa4
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
div dword [0x4a24c4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x460faa
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edi, dword [ebp + 8]
mov edx, dword [0x4a2f38]
mov ecx, dword [0x4a30e8]
sub eax, edi
sub eax, edx
add ecx, eax
test ebx, ebx
mov dword [0x4a30e8], ecx
je 0x460fda
push str.WIN:_Memory_block_succesfully_allocated
call fcn.0045d3a0
add esp, 4
mov eax, ebx
jmp 0x460fee
push str.WIN:_Amnesia_Error:_Out_of_memory__user_canceled_memory_request
call fcn.0045d3a0
add esp, 4
call fcn.0045c9f0
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi]
push 0
push 0
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
jne 0x461027
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
jne 0x461064
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi]
mov dword [esi + 4], 0
push eax
call edi
mov dword [esi], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461ff0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4873b8]
push ebx
push ebp
push esi
test eax, eax
push edi
mov dword [esp + 0x14], 0xff
jne 0x462018
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov ebp, dword [0x4a30f4]
mov ebx, dword [esp + 0x120]
test ebp, ebp
je 0x462061
mov esi, 0x4a3170
mov eax, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x462054
test cl, cl
je 0x462050
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x462054
add eax, 2
add esi, 2
test cl, cl
jne 0x462030
xor eax, eax
jmp 0x462059
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4620e5
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4a3170
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebp, ebp
rep movsb byte es:[edi], byte [esi]
je 0x46208e
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x4854a0]
mov edx, dword [str.Jazz_Jackrabbit_2]
mov eax, dword [str.Epic_MegaGames]
push ebx
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push str.Software_s_s_s_s
push ecx
call fcn.0047aba0
add esp, 0x18
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push 0x4a30f4
push 0
push 0xf003f
push 0
push 0x4a0dc0
push 0
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebp, dword [0x4a30f4]
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push 0x4a2fc0
push edx
push 0
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x462116
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov eax, dword [esp + 0x10]
pop edi
dec eax
pop esi
neg eax
sbb eax, eax
pop ebp
not eax
and eax, 0x4a2fc0
pop ebx
add esp, 0x10c
ret
Function at 0x462140
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x11c]
push ebx
mov dword [esp + 4], eax
mov eax, dword [0x4873b8]
push ebp
push esi
test eax, eax
push edi
je 0x46227c
mov ebp, dword [0x4a30f4]
mov ebx, dword [esp + 0x120]
test ebp, ebp
je 0x4621ab
mov esi, 0x4a3170
mov eax, ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x46219e
test cl, cl
je 0x46219a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x46219e
add eax, 2
add esi, 2
test cl, cl
jne 0x46217a
xor eax, eax
jmp 0x4621a3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46222f
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4a3170
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebp, ebp
rep movsb byte es:[edi], byte [esi]
je 0x4621d8
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x4854a0]
mov edx, dword [str.Jazz_Jackrabbit_2]
mov eax, dword [str.Epic_MegaGames]
push ebx
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push str.Software_s_s_s_s
push ecx
call fcn.0047aba0
add esp, 0x18
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push 0x4a30f4
push 0
push 0xf003f
push 0
push 0x4a0dc0
push 0
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebp, dword [0x4a30f4]
mov edx, dword [esp + 0x128]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x128]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46227c
cmp dword [esp + 0x14], 3
jne 0x46227c
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x10]
cmp eax, edx
jne 0x46227c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret