joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446430
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
call fcn.004de266
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push eax
mov dword [ebp - 0x10], esi
call fcn.004df9e0
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [eax + eax]
push 0x58042c
call edi
push 0x58042c
call edi
mov eax, dword [0x580418]
cmp eax, dword [0x58041c]
push 0x58042c
sete bl
call esi
test bl, bl
je 0x4464ad
push 0x58042c
call esi
push 0x3e8
call fcn.00445ac0
add esp, 4
jmp 0x446470
mov ecx, dword [0x58041c]
mov eax, dword [0x580414]
mov ebx, dword [eax + ecx*4]
inc ecx
mov dword [0x58041c], ecx
cmp ecx, dword [0x580424]
jl 0x4464d4
mov eax, dword [0x580420]
mov dword [0x58041c], eax
push 0x58042c
call esi
push dword [ebx + 0x20]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
call fcn.004de26f
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x18], 1
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], 0
test ecx, ecx
je 0x44651e
mov eax, dword [ecx + 4]
mov dword [ebx + 0x28], eax
push 0
push ebx
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x44659a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x44659a
push dword [ebx + 0x20]
call fcn.004de26f
add esp, 4
mov dword [ebx + 0x20], 0
mov ecx, 0x580414
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x1c], 0
push ebx
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
call fcn.004461e0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4465b0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x597f2c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
mov eax, ecx
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
push ecx
push 4
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], 0xb5367df1
push ecx
push 0x10
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x11cfcbac
push ecx
push 0xc8000006
push dword [eax + 4]
mov dword [ebp - 0xc], 0x8000ca95
mov dword [ebp - 8], 0x92a1485f
mov dword [ebp - 0x18], 0
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x446648
push str.Failed_to_create_socket_in_IOCP_setup.
call fcn.00446d10
add esp, 4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push 0x58042c
call edi
push 0x58042c
call edi
mov eax, dword [0x580418]
cmp eax, dword [0x58041c]
push 0x58042c
sete bl
call esi
test bl, bl
je 0x446694
push 0x58042c
call esi
push 0x3e8
call fcn.00445ac0
add esp, 4
jmp 0x446657
mov ecx, dword [0x58041c]
mov eax, dword [0x580414]
mov ebx, dword [eax + ecx*4]
inc ecx
mov dword [0x58041c], ecx
cmp ecx, dword [0x580424]
jl 0x4466bb
mov eax, dword [0x580420]
mov dword [0x58041c], eax
push 0x58042c
call esi
push dword [ebx + 0x20]
call fcn.004de26f
mov ecx, dword [ebp - 0x20]
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x18], 3
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov eax, dword [ecx + 4]
push 0x59a1f4
mov dword [ebx + 0x28], eax
call edi
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push ebx
push eax
mov eax, dword [ebp - 0x20]
push 0x20
push 0x20
push 0
push 0x59a240
push edi
push dword [eax + 4]
call dword [ebp - 0x24]
test eax, eax
jne 0x446777
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x446777
push str.AcceptEx___Failed_and_IO_aint_pending.
call fcn.00446d10
add esp, 4
mov ecx, ebx
call fcn.004463f0
push ebx
mov ecx, 0x580414
call fcn.004461e0
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x59a1f4
call esi
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret
push 0x59a1f4
call esi
mov ecx, dword [ebp - 4]
mov al, 1
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret
Function at 0x446940
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov dword [esi + 0xc], eax
mov eax, dword [edi]
test eax, eax
je 0x446a06
cmp eax, 0xffffffff
je 0x446a06
mov ecx, dword [0x59a1d4]
push 0
push eax
call fcn.00442df0
test al, al
jne 0x44698f
push str.Startup__:_Associate_Device_failed_for_pre_created_socket.
call fcn.00446d10
add esp, 4
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x59a1dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi]
mov ecx, 0x59a234
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
call fcn.004450b0
push 0x59a1dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, esi
call fcn.00446270
test al, al
jne 0x446a95
push str.Startup__:_Register_Receive_failed.
call fcn.00446d10
add esp, 4
push 0x59a1dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov ecx, 0x59a234
call fcn.00447950
push 0x59a1dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x446a3c
push str.Startup__:_Socket_Creation_Failure.
call fcn.00446d10
add esp, 4
mov dword [edi], 0
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x59a1d4]
push 0
push eax
call fcn.00442df0
test al, al
jne 0x446a65
push str.Startup__:_Associate_Device_failed.
call fcn.00446d10
add esp, 4
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x59a1dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi]
mov ecx, 0x59a234
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
call fcn.004450b0
push 0x59a1dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
test eax, eax
jne 0x446aa6
mov dword [esi + 0x10], 5
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x446d10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004de600
mov eax, dword [0x597f2c]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x1004]
push 0x55011c
push eax
call fcn.00441710
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x2004]
push 0xffffffffffffffff
push eax
call fcn.0043d560
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0050707d
add esp, 0x1c
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret
Function at 0x44a460
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x597f2c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x59a288], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], ecx
je 0x44a4c2
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x44a48c
mov eax, dword [esi]
mov ecx, 0x59a288
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x44a4b1
test dl, dl
je 0x44a4ad
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x44a4b1
add ecx, 2
add eax, 2
test dl, dl
jne 0x44a491
xor eax, eax
jmp 0x44a4b6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44a4c2
mov edi, dword [0x59a280]
jmp 0x44a4f9
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x44a4cc
mov eax, dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x44a57a
cmp dword [esi + 0x14], 0x10
jb 0x44a4e5
mov esi, dword [esi]
push esi
push 0x59a288
call fcn.00441710
add esp, 8
mov dword [0x59a280], edi
mov ebx, dword [ebp - 0x18]
push 0x33
push dword [ebx + 8]
push dword [ebx]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x44a57a
mov eax, dword [edi + 0xc]
mov ecx, 2
push dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 4], eax
mov word [ebp - 0x14], cx
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x44a565
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
cmp eax, 0x2733
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 8
Function at 0x44a6a0
Capabilities:
Create tcp socket
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x597f2c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [esi]
mov dword [esi + 0x18], eax
cmp edi, 0xffffffff
jne 0x44a6d7
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, edi
je 0x44a76f
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 8], eax
test eax, eax
je 0x44a76f
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x44a76f
cmp edi, 0xffffffff
je 0x44a72f
push 0x23
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x44a76f
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x44a76f
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
lea eax, [esi + 0x14]
push eax
push 0
push esi
push 0x44a250
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x44a76f
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x20], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44a930
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x597f2c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
mov eax, 2
push edi
push dword [ebp + 0xc]
mov word [ebp - 0x14], ax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x14]
push esi
push dword [edi]
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [ebp - 4]
cmp eax, 0xffffffff
pop edi
setne al
xor ecx, ebp
pop esi
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44a9e0
Capabilities:
Create thread
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x597f2c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, ecx
cmp dword [esi], 0xffffffff
mov byte [esi + 0x24], al
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
jne 0x44aa1b
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x44aa5b
cmp byte [esi + 0x24], 1
jne 0x44aac8
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, 2
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [esi]
mov dword [ebp - 0x10], 0
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x44aa6f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 0x18
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 8], eax
test eax, eax
je 0x44aa5b
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x44aa5b
push 3
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x44aa5b
lea eax, [esi + 0x14]
push eax
push 0
push esi
push 0x44a800
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x44aa5b
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x20], eax
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44aad0
sub ecx, edx
je 0x44aaec
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 0x18

Function at 0x44f410
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x597f2c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x404]
push 0xffffffffffffffff
push eax
call fcn.0043d560
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0050707d
add esp, 0x1c
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret
Function at 0x44f9f0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 4]
push edi
push eax
push 0
mov dword [ebp - 4], 0
call esi
push dword [ebp - 4]
call fcn.004de266
push 0x100
mov ebx, eax
call fcn.004de266
add esp, 8
mov edi, eax
lea eax, [ebp - 4]
push eax
push ebx
call esi
mov esi, ebx
test ebx, ebx
je 0x44fa88
cmp dword [esi + 0x1a0], 6
jne 0x44fa82
cmp dword [esi + 0x190], 6
jne 0x44fa82
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X__02X__02X__02X__02X__02X
push edi
call fcn.00441710
add esp, 0x20
mov esi, dword [esi]
test esi, esi
jne 0x44fa32
push edi
call fcn.0044ccd0
push ebx
mov esi, eax
call fcn.004de26f
push edi
call fcn.004de26f
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451530
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x597f2c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0x20e], 0
movsx eax, byte [esi]
push eax
call fcn.0051a3ea
mov byte [ebp - 0x210], al
movsx eax, al
push eax
call fcn.00519470
add esp, 8
test eax, eax
jne 0x451578
mov byte [ebp - 0x210], 0x7a
movsx eax, byte [esi + 1]
push eax
call fcn.0051a3ea
mov byte [ebp - 0x20f], al
movsx eax, al
push eax
call fcn.00519470
add esp, 8
test eax, eax
jne 0x45159f
mov byte [ebp - 0x20f], 0x7a
lea eax, [ebp - 0x210]
push eax
push str.names_s_names.dat
push edi
call fcn.00441710
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0051b0c5
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push str._s_names_
push eax
call fcn.004512c0
add esp, 0x20
lea eax, [ebp - 0x20c]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret
Function at 0x4585a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x597f2c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [edi + 0x7c], eax
mov dword [edi + 0x80], 0
cmp eax, 1
jne 0x458705
test esi, esi
jne 0x4585f0
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi]
test eax, eax
je 0x458605
push eax
call fcn.004de26f
add esp, 4
mov dword [edi], 0
push 0x10000
push 0
push esi
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov dword [edi + 4], eax
test eax, eax
jne 0x4586c3
push str.WAVE
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x458648
push 0x551e48
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x45871a
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x45871a
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x45871a
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x45871a
push ebx
call fcn.004de266
push ebx
push dword [ebp - 0x50]
mov esi, eax
push esi
call fcn.004df9e0
push 0x48
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.004dff60
add esp, 0x1c
mov dword [ebp - 0x48], 0x204d454d
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
push 0x10000
push eax
push 0
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov dword [edi + 4], eax
mov ecx, edi
call fcn.004589b0
mov esi, eax
test esi, esi
jns 0x4586f0
push 0
push dword [edi + 4]
call dword [sym.imp.WINMM.dll_mmioClose]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 0xc
mov ecx, edi
call fcn.00458be0
mov ecx, eax
test ecx, ecx
js 0x45874d
mov eax, dword [edi + 0xc]
mov dword [edi + 0x30], eax
jmp 0x45874d
push 0x11002
push 0
push esi
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov dword [edi + 4], eax
test eax, eax
jne 0x458732
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ecx, edi
call fcn.00458ee0
mov esi, eax
test esi, esi
js 0x4586d0
mov ecx, edi
call fcn.00458be0
mov ecx, eax
test ecx, ecx
js 0x45874f
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ddd4a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x459220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x104
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftDirectX
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4592a4
push esi
lea eax, [ebp - 8]
push eax
push 0x59a358
lea eax, [ebp - 0xc]
push eax
push 0
push str.DX8SDK_Samples_Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4592a4
mov edx, 0x59a358
dec edx
mov cl, byte [edx + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x459280
mov ecx, dword [str.Media_]
mov eax, 0x59a358
mov dword [edx], ecx
mov ecx, dword [0x551ea4]
mov dword [edx + 4], ecx
mov esp, ebp
pop ebp
ret
mov eax, 0x59a354
mov esp, ebp
pop ebp
ret
Function at 0x48f350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
mov ecx, 0x59a2cc
push str.GroundObjectTiles::Generate
call fcn.0044ac20
cmp dword [ebp + 0x14], 0
jne 0x48f371
call fcn.0051bcb4
mov ecx, dword [esi + 0x128]
test ecx, ecx
je 0x48f38b
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x128], 0
push ebx
push 0x1c0000
mov dword [esi + 0x108], 0x100
mov dword [esi + 0x10c], 0x100
call fcn.004de266
mov ecx, dword [esi + 0x10c]
add esp, 4
xor ebx, ebx
mov dword [esi + 0x120], eax
test ecx, ecx
jle 0x48f491
nop dword [eax]
nop word [eax + eax]
xor edx, edx
cmp dword [esi + 0x108], edx
jle 0x48f482
nop
xor edi, edi
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 1], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 2], 0
mov eax, dword [esi + 0x108]
imul eax, ebx
add eax, edx
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x120]
lea eax, [eax + ecx*4]
mov byte [eax + edi + 3], 0
add edi, 4
cmp edi, 0x1c
jl 0x48f3e2
inc edx
cmp edx, dword [esi + 0x108]
jl 0x48f3e0
mov ecx, dword [esi + 0x10c]
inc ebx
cmp ebx, ecx
jl 0x48f3d0
mov eax, dword [esi + 0x108]
imul eax, ecx
push eax
call fcn.004de266
add esp, 4
mov dword [esi + 0x198], eax
mov eax, dword [esi + 0x110]
pop ebx
test eax, eax
jne 0x48f4c0
push 0x5521cc
push str.dat_roads_256.raw
jmp 0x48f4cf
cmp eax, 1
jne 0x48f4fb
push 0x5521cc
push str.dat_roads2_256.raw
call fcn.00514d7d
mov ecx, dword [esi + 0x10c]
mov edi, eax
imul ecx, dword [esi + 0x108]
push edi
push ecx
push 1
push dword [esi + 0x198]
call fcn.00515f0b
push edi
call fcn.00514a8f
add esp, 0x1c
push str.Done_n
mov ecx, 0x59a2cc
call fcn.0044ac20
pop edi
pop esi
pop ebp
ret 0x10