joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check os version

Disassembly:
push 0xa0
mov eax, 0x40a648
call fcn.0040985c
xor ebx, ebx
push 0x90
lea eax, [ebp - 0xa0]
push ebx
push eax
mov dword [ebp - 0xa4], ebx
call sub.MSVCR100.dll_memset
mov eax, dword [0x45d0e4]
add esp, 0xc
cmp eax, ebx
jne 0x401039
xor ecx, ecx
jmp 0x40103b
mov ecx, dword [eax]
mov esi, str.Init
test cl, 4
je 0x401054
push esi
push str._s:_Calling_CoInitializeEx_...
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0xc
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x45d0e4]
cmp ecx, ebx
jne 0x401069
xor edx, edx
jmp 0x40106b
mov edx, dword [ecx]
test dl, 4
je 0x401080
push eax
push esi
push str._s:_CoInitializeEx_done__rc_d_
push ecx
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0x10
lea ecx, [ebp - 0xa8]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov dword [ebp - 4], ebx
push 2
mov esi, str.SAP_INITIAL
push esi
push str.AccMode
lea eax, [ebp - 0xac]
push str.SoftwareSAPGeneral
push eax
call sub.sapfewut.dll_getRegValString
add esp, 0x14
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xa8]
call dword [sym.imp.mfc100.dll_Ordinal_1313]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xac]
call dword [sym.imp.mfc100.dll_Ordinal_901]
push esi
lea ecx, [ebp - 0xa8]
call dword [sym.imp.mfc100.dll_Ordinal_2617]
test eax, eax
je 0x40115c
push 0x433428
lea ecx, [ebp - 0xa8]
call dword [sym.imp.mfc100.dll_Ordinal_2617]
test eax, eax
jne 0x40115c
call sub.sapfewrm.dll_RmIsFrogThemeActive
test eax, eax
jne 0x40115c
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 5
jne 0x401128
cmp dword [ebp - 0x9c], 1
jae 0x401131
cmp dword [ebp - 0xa0], 6
jb 0x40115c
push str.UxTheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x40115c
push str.SetThemeAppProperties
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x401155
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.sapthmdrw.dll_int___cdecl_SapIsXPThemeActive_void_]
test eax, eax
je 0x40116c
call dword [sym.imp.sapthmdrw.dll_void___cdecl_OpenMsThemeDataHandles_void_]
push ebx
push 0x45bff4
push 0x45d14c
call sub.gdiplus.dll_GdiplusStartup
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
call fcn.004098a6
ret
Function at 0x401eaf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45d074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, str.DelegationMode
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x18]
push ecx
xor eax, eax
mov ebx, 0x20019
push ebx
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
mov edi, 0x4333e0
push edi
push 0x80000001
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 4
call esi
test eax, eax
jne 0x401f3f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f30
cmp dword [ebp - 0x24], 4
jne 0x401f30
mov dword [ebp - 0x20], 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20], 0
jne 0x401f91
lea eax, [ebp - 0x18]
push eax
push ebx
push 0
push edi
push 0x80000002
call esi
test eax, eax
jne 0x401f8d
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f7e
cmp dword [ebp - 0x24], 4
jne 0x401f7e
mov dword [ebp - 0x20], 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20], 0
jne 0x401f91
and dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040981a
leave
ret
Function at 0x4037f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10
mov eax, 0x40a881
call fcn.00409829
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_316]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x45d0e4]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
cmp eax, ebx
jne 0x403822
xor ecx, ecx
jmp 0x403824
mov ecx, dword [eax]
mov edi, str.Process_Shortcut_Cmds
test cl, 4
je 0x403837
push edi
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
pop ecx
pop ecx
push str.__SHORTCUT_
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 1
push 1
lea eax, [ebp - 0x10]
push eax
push 0x22
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.00404490
add esp, 0x14
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp esi, ebx
jne 0x4038ca
mov eax, dword [0x45d0e4]
cmp eax, ebx
jne 0x403880
xor ecx, ecx
jmp 0x403882
mov ecx, dword [eax]
test cl, 4
je 0x40389b
push edi
push str._s:_No_shortcut_command___nothing_to_do
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
mov eax, dword [0x45d0e4]
add esp, 0xc
cmp eax, ebx
jne 0x4038a3
xor ecx, ecx
jmp 0x4038a5
mov ecx, dword [eax]
test cl, 4
je 0x4038b3
push edi
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
pop ecx
pop ecx
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, esi
call fcn.00409892
ret
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc100.dll_Ordinal_13137]
mov eax, dword [0x45d0e4]
cmp eax, ebx
jne 0x4038e0
xor ecx, ecx
jmp 0x4038e2
mov ecx, dword [eax]
test cl, 4
je 0x4038f9
push dword [ebp - 0x10]
push edi
push str._s:_Shortcut_command:___s_
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403918
test al, 0x10
jne 0x403918
mov ecx, dword [ebp + 0x1c]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_1313]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004011fa
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00403228
add esp, 0x20
mov ebx, eax
test esi, esi
je 0x403957
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00401359
pop ecx
pop ecx
test ebx, ebx
je 0x403994
push edi
push str._s:_Shortcut_processing_failed_
push dword [0x45d0e4]
call sub.sapfewtr.dll_FEWTraceError
mov eax, dword [0x45d0e4]
add esp, 0xc
test eax, eax
jne 0x40397c
xor ecx, ecx
jmp 0x40397e
mov ecx, dword [eax]
test cl, 4
je 0x40398c
push edi
push eax
call sub.sapfewtr.dll_FEWTraceMonitor
pop ecx
pop ecx
push 0x15
pop esi
jmp 0x4038b5
mov eax, dword [0x45d0e4]
test eax, eax
jmp 0x40389d
Function at 0x4041b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x45d074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
test edi, edi
jg 0x4041df
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040981a
mov esp, ebp
pop ebp
ret
cmp dword [0x45c1d4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x404200
call esi
mov dword [0x45d198], eax
mov dword [0x45c1d4], 0
call esi
mov ecx, dword [0x45d198]
cmp ecx, eax
ja 0x404212
sub eax, ecx
mov esi, eax
jmp 0x404219
mov dword [0x45d198], eax
xor esi, esi
mov eax, 0x10624dd3
mul esi
push ebx
mov ecx, edx
shr ecx, 6
mov eax, ecx
imul ecx, ecx, 0x3e8
xor edx, edx
mov ebx, 0x3c
div ebx
sub esi, ecx
push esi
lea ecx, [ebp - 0x44]
push edx
push eax
push str.StopWatch:__.2d:_.2d:_.3d
push 0x40
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x18
lea eax, [ebp - 0x44]
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404257
mov esi, dword [ebp - 0x48]
sub eax, edx
inc eax
cmp edi, eax
jb 0x404289
lea edx, [ebp - 0x44]
push edx
push edi
push esi
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040981a
mov esp, ebp
pop ebp
ret
lea eax, [edi - 1]
push eax
lea ecx, [ebp - 0x44]
push ecx
push edi
push esi
call dword [sym.imp.MSVCR100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 4]
add esp, 0x10
mov byte [esi + edi - 1], 0
mov eax, esi
pop esi
xor ecx, ebp
pop edi
call fcn.0040981a
mov esp, ebp
pop ebp
ret

Function at 0x404860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareSAPSapgui
mov edi, 4
push 0x80000002
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4048d4
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.StartSaplogon
push ecx
call ebx
test eax, eax
mov eax, dword [ebp - 4]
je 0x404913
test eax, eax
je 0x4048d4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push str.SoftwareSAPSapgui
push 0x80000001
call esi
test eax, eax
jne 0x40491e
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push str.StartSaplogon
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
call ebx
test eax, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40491e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40981a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45d074]
jne 0x409824
repz ret
jmp fcn.0040a016
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x4fe04d11
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x72120b6c
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..wixburn
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5310f70
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x700c4826
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x402030
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42443b
mov eax, dword fs:[0]
push eax
sub esp, 0x1d0
mov eax, dword [0x435070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x431040
push 0
call fcn.0040eb17
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 8
push 0xf
push 0xfffffffffffffff5
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040eb61
push 0x1ac
lea eax, [ebp - 0x1d8]
push 0
push eax
call fcn.0040c4a0
add esp, 0x10
lea ecx, [ebp - 0x1d8]
call fcn.004038f0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x30]
test esi, esi
jne 0x40225c
xor eax, eax
mov dword [ebp - 0x14], eax
mov esi, eax
push 0xfffffffffffffff5
call ebx
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [ebp - 0x2a]
lea eax, [ebp - 0x14]
push eax
movsx eax, word [ebp - 0x2c]
imul ecx, eax
push esi
push ecx
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
movsx ecx, word [ebp - 0x2a]
lea eax, [ebp - 0x14]
push eax
movsx eax, word [ebp - 0x2c]
imul ecx, eax
push esi
push ecx
push 7
push edi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea ecx, [ebp - 0x1d8]
call fcn.00403c50
mov edx, str.Select_map:
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Summoners_Rift:_1
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.The_Twisted_Treeline:_2
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Howling_Abyss:_3
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
push 0x435f80
call fcn.004033f0
mov edx, str.Rules:_8
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Credits:_9
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Exit:_0
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
add esp, 0x20
mov edx, 0x431118
mov ecx, eax
call fcn.00403150
lea edx, [ebp - 0x1d9]
call fcn.004034a0
movsx eax, byte [ebp - 0x1d9]
add eax, 0xffffffd0
cmp eax, 9
ja case.0x4021e4.52
jmp dword [eax*4 + 0x402288]
push 0
lea ecx, [ebp - 0x1d8]
call fcn.00403cf0
call fcn.00402330
jmp 0x4020c6
push 1
lea ecx, [ebp - 0x1d8]
call fcn.00403cf0
call fcn.00402330
jmp 0x4020c6
push 2
lea ecx, [ebp - 0x1d8]
call fcn.00403cf0
call fcn.00402330
jmp 0x4020c6
lea ecx, [ebp - 0x1d8]
call fcn.004048c0
call fcn.00402330
jmp 0x4020c6
lea ecx, [ebp - 0x1d8]
call fcn.004046b0
call fcn.00402330
jmp 0x4020c6
xor esi, esi
lea ecx, [ebp - 0x1d8]
call fcn.00404b70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409537
mov esp, ebp
pop ebp
ret
Function at 0x4021eb
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42443b
mov eax, dword fs:[0]
push eax
sub esp, 0x1d0
mov eax, dword [0x435070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x431040
push 0
call fcn.0040eb17
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 8
push 0xf
push 0xfffffffffffffff5
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040eb61
push 0x1ac
lea eax, [ebp - 0x1d8]
push 0
push eax
call fcn.0040c4a0
add esp, 0x10
lea ecx, [ebp - 0x1d8]
call fcn.004038f0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x30]
test esi, esi
jne 0x40225c
xor eax, eax
mov dword [ebp - 0x14], eax
mov esi, eax
push 0xfffffffffffffff5
call ebx
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [ebp - 0x2a]
lea eax, [ebp - 0x14]
push eax
movsx eax, word [ebp - 0x2c]
imul ecx, eax
push esi
push ecx
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
movsx ecx, word [ebp - 0x2a]
lea eax, [ebp - 0x14]
push eax
movsx eax, word [ebp - 0x2c]
imul ecx, eax
push esi
push ecx
push 7
push edi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea ecx, [ebp - 0x1d8]
call fcn.00403c50
mov edx, str.Select_map:
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Summoners_Rift:_1
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.The_Twisted_Treeline:_2
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Howling_Abyss:_3
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
push 0x435f80
call fcn.004033f0
mov edx, str.Rules:_8
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Credits:_9
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Exit:_0
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
add esp, 0x20
mov edx, 0x431118
mov ecx, eax
call fcn.00403150
lea edx, [ebp - 0x1d9]
call fcn.004034a0
movsx eax, byte [ebp - 0x1d9]
add eax, 0xffffffd0
cmp eax, 9
ja case.0x4021e4.52
jmp dword [eax*4 + 0x402288]
push 0
lea ecx, [ebp - 0x1d8]
call fcn.00403cf0
call fcn.00402330
jmp 0x4020c6
push 1
lea ecx, [ebp - 0x1d8]
call fcn.00403cf0
call fcn.00402330
jmp 0x4020c6
push 2
lea ecx, [ebp - 0x1d8]
call fcn.00403cf0
call fcn.00402330
jmp 0x4020c6
lea ecx, [ebp - 0x1d8]
call fcn.004048c0
call fcn.00402330
jmp 0x4020c6
lea ecx, [ebp - 0x1d8]
call fcn.004046b0
call fcn.00402330
jmp 0x4020c6
xor esi, esi
lea ecx, [ebp - 0x1d8]
call fcn.00404b70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409537
mov esp, ebp
pop ebp
ret
Function at 0x402202
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42443b
mov eax, dword fs:[0]
push eax
sub esp, 0x1d0
mov eax, dword [0x435070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x431040
push 0
call fcn.0040eb17
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 8
push 0xf
push 0xfffffffffffffff5
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040eb61
push 0x1ac
lea eax, [ebp - 0x1d8]
push 0
push eax
call fcn.0040c4a0
add esp, 0x10
lea ecx, [ebp - 0x1d8]
call fcn.004038f0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x30]
test esi, esi
jne 0x40225c
xor eax, eax
mov dword [ebp - 0x14], eax
mov esi, eax
push 0xfffffffffffffff5
call ebx
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [ebp - 0x2a]
lea eax, [ebp - 0x14]
push eax
movsx eax, word [ebp - 0x2c]
imul ecx, eax
push esi
push ecx
push 0x20
push edi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
movsx ecx, word [ebp - 0x2a]
lea eax, [ebp - 0x14]
push eax
movsx eax, word [ebp - 0x2c]
imul ecx, eax
push esi
push ecx
push 7
push edi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea ecx, [ebp - 0x1d8]
call fcn.00403c50
mov edx, str.Select_map:
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Summoners_Rift:_1
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.The_Twisted_Treeline:_2
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Howling_Abyss:_3
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
push 0x435f80
call fcn.004033f0
mov edx, str.Rules:_8
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Credits:_9
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
mov edx, str.Exit:_0
mov ecx, 0x435f80
call fcn.00403150
push eax
call fcn.004033f0
add esp, 0x20
mov edx, 0x431118
mov ecx, eax
call fcn.00403150
lea edx, [ebp - 0x1d9]
call fcn.004034a0
movsx eax, byte [ebp - 0x1d9]
add eax, 0xffffffd0
cmp eax, 9
ja case.0x4021e4.52
jmp dword [eax*4 + 0x402288]
push 0
lea ecx, [ebp - 0x1d8]
call fcn.00403cf0
call fcn.00402330
jmp 0x4020c6
push 1
lea ecx, [ebp - 0x1d8]
call fcn.00403cf0
call fcn.00402330
jmp 0x4020c6
push 2
lea ecx, [ebp - 0x1d8]
call fcn.00403cf0
call fcn.00402330
jmp 0x4020c6
lea ecx, [ebp - 0x1d8]
call fcn.004048c0
call fcn.00402330
jmp 0x4020c6
lea ecx, [ebp - 0x1d8]
call fcn.004046b0
call fcn.00402330
jmp 0x4020c6
xor esi, esi
lea ecx, [ebp - 0x1d8]
call fcn.00404b70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409537
mov esp, ebp
pop ebp
ret