joyce8/EMBER2024-capa huggingface dataset:
Function at 0x564960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0x40
mov eax, dword [esp + 0x5c]
mov ebp, dword [esp + 0x58]
mov ebx, dword [esp + 0x7c]
fldz
fld dword [eax]
fsub dword [ebp]
lea edi, [esp + 0x18]
fstp dword [esp + 0x30]
fld dword [eax + 4]
fsub dword [ebp + 4]
lea esi, [esp + 0x30]
fstp dword [esp + 0x34]
fld dword [eax + 8]
fsub dword [ebp + 8]
fstp dword [esp + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fld dword [esp + 0x1c]
fst st(1)
fmul st(0)
fld dword [esp + 0x18]
fmul st(0)
faddp st(1)
fld dword [esp + 0x20]
fstp st(2)
fld st(1)
fmul st(0)
faddp st(1)
fst st(1)
fsqrt
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp st(1)
fdiv dword [esp + 0x64]
fld dword [0x698320]
fcomp st(1)
fnstsw ax
test ah, 0x45
jne 0x5649e2
fld dword [0x698320]
fstp st(1)
fld st(0)
fnstcw word [esp + 4]
mov eax, dword [esp + 4]
or byte [esp + 5], 0xc
fldcw word [esp + 4]
fistp dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 0x10], esi
xor edi, edi
fldcw word [esp + 4]
fild dword [esp + 0x10]
test esi, esi
fdivr dword [0x698320]
fstp st(1)
fld dword [esp + 0x18]
fmul st(1)
fstp dword [esp + 0x18]
fld dword [esp + 0x1c]
fmul st(1)
fstp dword [esp + 0x1c]
fld dword [esp + 0x20]
fmul st(1)
fstp dword [esp + 0x20]
jle 0x564af0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
fldz
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
nop
mov dword [esp + 0x10], edi
mov eax, dword [0x77e8f9]
fild dword [esp + 0x10]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push ebx
fmul dword [esp + 0xc]
push dword [esp + 0x7c]
push dword [esp + 0x7c]
fadd dword [ebp + 8]
mov dword [esp + 0x1c], edi
push dword [esp + 0x7c]
fstp st(1)
fild dword [esp + 0x20]
push eax
push dword [esp + 0x80]
fmul dword [esp + 0x24]
push dword [esp + 0x80]
push dword [esp + 0x7c]
fadd dword [ebp + 4]
mov dword [esp + 0x30], edi
fstp st(2)
fild dword [esp + 0x30]
fmul dword [esp + 0x38]
fadd dword [ebp]
fstp dword [esp + 0x44]
fld st(1)
lea eax, [esp + 0x44]
fstp dword [esp + 0x48]
fst dword [esp + 0x4c]
fcompp
push eax
push dword [esp + 0x78]
call fcn.00563ce0
inc edi
add esp, 0x28
cmp edi, esi
jl 0x564ae0
add esp, 0x40
pop ebp
pop edi
pop esi
pop ebx
ret
fldz
fldz
jmp 0x564a50
fstp st(0)
jmp 0x564ad4
Function at 0x585860
Capabilities:
Check for software breakpoints

Disassembly:
xor ecx, ecx
mov eax, dword [esp + 4]
jmp 0x5859ba
cmp dx, 0x80
jb 0x5859b0
cmp dx, 0x80
jb 0x585897
cmp dx, 0x83
ja 0x585897
add dl, 0x40
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0x84
jb 0x5858b3
cmp dx, 0x8d
ja 0x5858b3
add dl, 0x42
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0x8e
jb 0x5858d0
cmp dx, 0x91
ja 0x5858d0
add dl, 0x44
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0x92
jb 0x5858f0
cmp dx, 0x95
ja 0x5858f0
add dl, 0x47
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0x96
jb 0x585910
cmp dx, 0x9a
ja 0x585910
add dl, 0x49
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0x9b
jb 0x585930
cmp dx, 0xa4
ja 0x585930
add dl, 0x4b
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0xa5
jb 0x585950
cmp dx, 0xa8
ja 0x585950
add dl, 0x4d
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0xa9
jb 0x585970
cmp dx, 0xcc
ja 0x585970
add dl, 0x50
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0xcd
jne 0x585982
add dl, 4
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0xce
jne 0x585994
add dl, 0x23
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
cmp dx, 0xcf
jne 0x5859a6
add dl, 0xf0
mov byte [ecx + 0x77f48c], dl
jmp 0x5859b6
mov byte [ecx + 0x77f48c], 0x23
jmp 0x5859b6
mov byte [ecx + 0x77f48c], dl
add eax, 2
inc ecx
test eax, eax
je 0x5859d2
cmp ecx, 0xff
jge 0x5859d2
mov dx, word [eax]
test dx, dx
jne 0x585870
mov eax, 0x77f48c
mov byte [ecx + 0x77f48c], 0
ret
Function at 0x5a78d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [ebx], 0x3e8
mov eax, dword [0x974c3c]
push esi
mov dword [ecx], eax
mov esi, ecx
mov eax, dword [0x9b6cec]
lea edx, [ecx + 4]
xor ebx, ebx
push edi
add esi, 8
push ebp
xor ebp, ebp
mov dword [edx], eax
lea eax, [eax]
mov edx, dword [ebp + 0x7e4048]
mov edi, esi
mov dword [esi], edx
mov eax, dword [ebp + 0x7e404c]
mov dword [esi + 4], eax
fld dword [ebp + 0x7e4050]
fstp dword [esi + 8]
fld dword [ebp + 0x7e4054]
fstp dword [esi + 0xc]
fld dword [ebp + 0x7e4058]
fstp dword [esi + 0x10]
fld dword [ebp + 0x7e405c]
fstp dword [esi + 0x14]
fld dword [ebp + 0x7e4060]
fstp dword [esi + 0x18]
fld dword [ebp + 0x7e4064]
fstp dword [esi + 0x1c]
fld dword [ebp + 0x7e4068]
fstp dword [esi + 0x20]
fld dword [ebp + 0x7e406c]
fstp dword [esi + 0x24]
fld dword [ebp + 0x7e4070]
fstp dword [esi + 0x28]
fld dword [ebp + 0x7e4074]
fstp dword [esi + 0x2c]
fld dword [ebp + 0x7e4078]
fstp dword [esi + 0x30]
fld dword [ebp + 0x7e407c]
fstp dword [esi + 0x34]
fld dword [ebp + 0x7e4080]
fstp dword [esi + 0x38]
fld dword [ebp + 0x7e4084]
fstp dword [esi + 0x3c]
fld dword [ebp + 0x7e4088]
fstp dword [esi + 0x40]
fld dword [ebp + 0x7e408c]
fstp dword [esi + 0x44]
fld dword [ebp + 0x7e4090]
fstp dword [esi + 0x48]
fld dword [ebp + 0x7e4094]
fstp dword [esi + 0x4c]
fld dword [ebp + 0x7e4098]
fstp dword [esi + 0x50]
fld dword [ebp + 0x7e409c]
fstp dword [esi + 0x54]
fld dword [ebp + 0x7e40a0]
fstp dword [esi + 0x58]
fld dword [ebp + 0x7e40a4]
fstp dword [esi + 0x5c]
fld dword [ebp + 0x7e40a8]
fstp dword [esi + 0x60]
fld dword [ebp + 0x7e40ac]
fstp dword [esi + 0x64]
fld dword [ebp + 0x7e40b0]
fstp dword [esi + 0x68]
mov eax, dword [ebp + 0x7e40b4]
mov dword [esi + 0x6c], eax
mov ecx, dword [ebp + 0x7e40b8]
mov dword [esi + 0x70], ecx
mov al, byte [ebp + 0x7e40bc]
mov byte [esi + 0x74], al
mov dl, byte [ebp + 0x7e40bd]
mov byte [esi + 0x75], dl
mov al, byte [ebp + 0x7e40be]
mov byte [esi + 0x76], al
mov cl, byte [ebp + 0x7e40bf]
mov byte [esi + 0x77], cl
mov al, byte [ebp + 0x7e40c0]
mov byte [esi + 0x78], al
mov dl, byte [ebp + 0x7e40c1]
mov byte [esi + 0x79], dl
mov al, byte [ebp + 0x7e40c2]
mov byte [esi + 0x7a], al
mov eax, dword [edi]
test eax, eax
je 0x5a7a5a
mov ecx, dword [0x97f248]
push eax
call fcn.0043cee0
inc eax
mov dword [edi], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x5a7a71
mov ecx, dword [0x94dbe8]
push eax
call fcn.00434a40
inc eax
mov dword [edi + 4], eax
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x5a7a88
mov ecx, dword [0xa0fdec]
push eax
call fcn.005a95f0
inc eax
mov dword [edi + 0x6c], eax
inc ebx
add esi, 0x7c
add ebp, 0x7c
cmp ebx, 8
jl 0x5a7900
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5cca00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
sub esp, 0x60
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x48], 0
mov eax, dword [ebp]
push eax
call fcn.005d5730
fldz
fldz
fld dword [eax + 4]
movzx eax, byte [0x7e4706]
fstp dword [esp + 8]
fld dword [0x69d39c]
imul eax, eax, 0x1cc
pop ecx
add eax, 0x7e4690
lea esi, [eax + 0x2f0]
add eax, 0x2fc
mov edx, esi
fmul dword [edx + 8]
fadd dword [eax + 8]
fstp st(1)
fld dword [0x69d39c]
fmul dword [edx + 4]
fadd dword [eax + 4]
fstp st(2)
fld dword [0x69d39c]
fmul dword [edx]
fadd dword [eax]
fstp dword [esp + 0x14]
fld st(1)
fstp dword [esp + 0x18]
fst dword [esp + 0x1c]
fld dword [esi]
fstp dword [esp + 8]
fld dword [esi + 4]
fstp dword [esp + 0xc]
fld dword [esi + 8]
fstp dword [esp + 0x10]
fcompp
lea ecx, [esp + 8]
call fcn.004dfec0
fld dword [esp + 8]
fmul dword [esp + 4]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x48]
push 0
fstp dword [esp + 0xc]
fld dword [esp + 0x10]
fmul dword [esp + 8]
push 0
push 0
fstp dword [esp + 0x18]
fld dword [esp + 0x1c]
fmul dword [esp + 0x10]
push 0
push 1
fstp dword [esp + 0x24]
fld dword [esp + 0x1c]
fadd dword [esp + 0x28]
push 1
push 1
fstp dword [esp + 0x24]
fld dword [esp + 0x28]
fadd dword [esp + 0x34]
lea edi, [esp + 0x24]
push 1
fstp dword [esp + 0x2c]
fld dword [esp + 0x30]
fadd dword [esp + 0x3c]
push ecx
push eax
lea eax, [esp + 0x3c]
push edi
push eax
fstp dword [esp + 0x40]
call fcn.004d92f0
add esp, 0x30
test al, al
je 0x5ccbb8
lea esi, [esp + 0x20]
lea edi, [esp + 0x4c]
movsd dword es:[edi], dword [esi]
push 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x5c]
lea esi, [esp + 0x60]
lea edx, [esp + 0x50]
push esi
push eax
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.005778d0
add esp, 0x14
test al, al
je 0x5ccbb8
fld dword [esp + 0x4c]
fstp dword [ebx]
fld dword [esp + 0x50]
fstp dword [ebx + 4]
fld dword [esp + 0x54]
fstp dword [ebx + 8]
fld dword [esp + 0x58]
fmul dword [0x69d414]
mov eax, dword [esp + 0x78]
add ebp, 7
fstp dword [eax]
lea eax, [esp + 0x20]
push dword [0x69d408]
push 0
push dword [0x69d398]
push 1
push 0
push 1
push 0
push 0
push dword [0x69d490]
push dword [0x69d494]
push eax
push 0xff
push 0
push 0
push 0x80
push ebp
call fcn.005427c0
add esp, 0x40
mov al, 1
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret 8
xor al, al
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret 8
Function at 0x5d6450
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
mov esi, ecx
push ebp
sub esp, 0x108
cmp byte [esi + 0x56], 0
mov ebp, dword [esp + 0x118]
je 0x5d6541
cmp ebp, 0x4c8
jae 0x5d6541
movzx ebx, byte [esp + 0x11c]
mov eax, dword [ebx*4 + 0x978670]
test eax, eax
je 0x5d64a2
push 1
push eax
call dword [0x6f25bc]
mov eax, dword [ebx*4 + 0x978670]
push eax
call dword [0x6f25c0]
cmp ebp, 0x66
jae 0x5d64b0
add esi, 0x30c08
push esi
jmp 0x5d64c7
cmp ebp, 0x67
jae 0x5d64c0
lea ecx, [esi + 0x30a00]
push ecx
jmp 0x5d64c7
lea edx, [esi + 0x30b04]
push edx
lea eax, [esp + 8]
push eax
call fcn.006425b0
pop ecx
pop ecx
mov eax, ebp
lea ecx, [eax*8]
lea ecx, [ecx + ecx*2]
add ecx, eax
lea eax, [esp + 4]
add ecx, 0x69dc78
push ecx
push eax
call fcn.00642600
mov eax, dword [0x978558]
lea edx, [esp + 0xc]
pop ecx
pop ecx
push 0
push edx
push eax
call dword [0x6f25c4]
mov dword [ebx*4 + 0x978670], eax
mov eax, dword [ebx*4 + 0x978670]
test eax, eax
je 0x5d6534
push 1
push eax
call dword [0x6f25c8]
mov eax, dword [ebx*4 + 0x978670]
push 1
push eax
call dword [0x6f25d4]
jmp 0x5d6541
call dword [0x6f25d8]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 0x108
pop ebp
pop esi
pop ebx
ret 8

Function at 0x5d6820
Capabilities:
Print debug messages

Disassembly:
mov edx, dword [esp + 8]
push ebx
cmp edx, 0x7f
mov ebx, dword [esp + 8]
jbe 0x5d6833
mov edx, 0x7f
mov eax, ebx
lea eax, [ebx - 0x1c]
test eax, eax
ja 0x5d6843
jmp dword [eax*4 + 0x6a5710]
pop ebx
ret 8
Function at 0x5d69a0
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov byte [esp], 0
lea eax, [ebx - 0x1c]
mov esi, ebx
test eax, eax
ja 0x5d69c7
jmp dword [eax*4 + 0x6a5718]
cmp edx, 0x20c
jae 0x5d6a16
movzx eax, byte [esp + 0x44]
cmp byte [eax + 0xa10980], 0
jne 0x5d69f0
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov esi, edx
mov edi, dword [eax*4 + 0x7e45e0]
lea esi, [esi + esi*4]
lea edi, [edi + edi*4]
mov ebp, dword [ecx + esi*4 + 0x15c]
sub ebp, dword [ecx + edi*4 + 0x15c]
add ebp, dword [eax*4 + 0x94b790]
jmp 0x5d6a50
xor esi, esi
movzx eax, byte [0xa10b5b]
nop
mov edi, eax
sub edi, esi
dec edi
cmp edx, dword [edi*4 + 0x9751d8]
jne 0x5d6a37
mov ebp, dword [edi*4 + 0xa0d210]
jmp 0x5d6a3d
inc esi
cmp esi, 3
jb 0x5d6a20
cmp esi, 3
jne 0x5d6a50
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
cmp byte [esp], 0
je 0x5d6a90
mov ebx, dword [ebx*4 + 0x9b485c]
test ebx, ebx
je 0x5d6a80
lea edx, [edx + edx*4]
mov eax, dword [ecx + edx*4 + 0x160]
push eax
push ebp
push ebx
call dword [0x6f2620]
add esp, 0x28
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov edi, edx
mov dword [esp + 4], 1
mov dword [esp + 8], ebp
lea edi, [edi + edi*4]
lea edi, [edi*4]
mov dword [esp + 0x18], 1
mov eax, dword [ecx + edi + 0x160]
lea ebp, [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + edi + 0x164]
mov dword [esp + 0x10], eax
mov eax, dword [ebx*4 + 0x94b1a8]
push ebp
push eax
mov dword [esp + 0x1c], 0x10
call dword [0x6f2624]
test eax, eax
jne 0x5d6b00
call dword [0x6f25d8]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov al, 1
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x5d8810
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push ebp
sub esp, 0x458
mov ebx, dword [esp + 0x468]
push 0
call dword [0x6f2694]
lea eax, [esp + 4]
push eax
push 0x67e9c8
push 1
push 0
push 0x67e9d8
call dword [0x6f2698]
test eax, eax
jl 0x5d8927
lea eax, [esp + 0x24c]
push eax
mov eax, dword [esp + 8]
mov esi, dword [eax]
push 0x67e9e8
push eax
call dword [esi]
test eax, eax
jl 0x5d891d
lea eax, [esp + 0x250]
push 0x104
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x24c]
lea ecx, [esp + 0x250]
mov ebp, dword [eax]
push 0
push ecx
push eax
call dword [ebp + 0x14]
test eax, eax
jl 0x5d8910
mov eax, dword [esp + 4]
mov ebp, dword [eax]
push 0x13
push 0
push eax
call dword [ebp + 0x4c]
test eax, eax
jl 0x5d8910
lea eax, [esp + 0x148]
push ebx
push eax
call fcn.006425b0
lea eax, [esp + 0x10]
pop ecx
lea edx, [esp + 0x14c]
pop ecx
push 2
push eax
mov eax, dword [esp + 0xc]
mov ebx, dword [eax]
push 0x104
push edx
push eax
call dword [ebx + 0xc]
test eax, eax
jl 0x5d8910
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x46c]
lea ecx, [esp + 0x148]
push ecx
push eax
call fcn.006425b0
pop ecx
pop ecx
add esp, 0x458
mov al, 1
pop ebp
pop esi
pop ebx
ret
mov eax, dword [esp + 0x24c]
mov ebx, dword [eax]
push eax
call dword [ebx + 8]
mov eax, dword [esp + 4]
mov ebx, dword [eax]
push eax
call dword [ebx + 8]
xor al, al
add esp, 0x458
pop ebp
pop esi
pop ebx
ret
Function at 0x5f83d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
push ebp
sub esp, 0x20
cmp byte [esi], 0
je 0x5f85f4
cmp dword [esp + 0x34], 0
jl 0x5f85f4
cmp dword [esp + 0x34], 0xfa
jge 0x5f85f4
mov edi, dword [esp + 0x34]
imul edi, edi, 0x28
cmp byte [esi + edi + 0x1f18], 0
je 0x5f85f4
cmp word [esp + 0x38], 0xcc
jae 0x5f85f4
cmp dword [esi + edi + 0x1f10], 4
jne 0x5f8465
cmp dword [esi + 0x4b2c], 0x28
jge 0x5f85f4
mov ax, word [esp + 0x38]
mov word [esi + edi + 0x1f1a], ax
mov byte [esi + edi + 0x1f34], 1
mov edx, dword [esi + 0x4b2c]
inc dword [esi + 0x4b2c]
mov eax, dword [esp + 0x34]
mov dword [esi + edx*4 + 0x4a8c], eax
jmp 0x5f85f4
mov eax, dword [esp + 0x34]
mov byte [esp + 8], 0
mov edx, eax
mov dword [esp + 0x18], eax
mov ecx, edx
lea eax, [ecx + edx*4]
mov ecx, eax
mov dword [esp + 0x18], eax
lea eax, [ecx*4]
mov ebx, eax
mov dword [esp + 0x18], eax
mov al, byte [esi + edi + 0x1f34]
movzx ebp, word [esp + 0x38]
mov byte [esp + 0x1c], al
mov al, byte [esp + 0x1c]
mov byte [esp + 0xc], al
jmp 0x5f85aa
movzx ecx, word [esi + ebx*2 + 0x1f1a]
mov al, byte [ebp + 0x6be8b8]
mov dl, byte [ecx + 0x6be8b8]
cmp dl, al
jbe 0x5f85a5
cmp byte [esp + 8], 3
jae 0x5f855c
movzx ebx, byte [esp + 8]
mov ebp, 3
sub ebp, ebx
inc ebx
lea eax, [ebp + ebp]
push eax
movzx eax, byte [esp + 0xc]
mov dword [esp + 8], eax
lea ecx, [eax + eax]
mov dword [esp + 0x18], esi
add dword [esp + 0x18], edi
lea eax, [ebx + ebx]
add ecx, dword [esp + 0x18]
add eax, dword [esp + 0x18]
add ecx, 0x1f1a
add eax, 0x1f1a
push ecx
push eax
call fcn.0064dbc0
lea ebp, [ebp*4]
shl dword [esp + 0x10], 2
mov eax, dword [esp + 0x10]
add esp, 0xc
add eax, dword [esp + 0x14]
push ebp
mov dword [esp + 8], eax
add dword [esp + 8], 0x1f24
lea ebx, [ebx*4]
add ebx, dword [esp + 0x18]
add ebx, 0x1f24
push dword [esp + 8]
push ebx
call fcn.0064dbc0
add esp, 0xc
movzx ecx, byte [esp + 8]
mov ax, word [esp + 0x38]
mov ebp, ecx
add ebp, dword [esp + 0x18]
mov word [esi + ebp*2 + 0x1f1a], ax
mov eax, dword [esp + 0x34]
lea eax, [eax + eax*4]
add eax, eax
fld dword [esp + 0x3c]
add eax, ecx
fstp dword [esi + eax*4 + 0x1f24]
cmp byte [esi + edi + 0x1f34], 4
jae 0x5f859b
inc byte [esi + edi + 0x1f34]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
inc ebx
inc byte [esp + 8]
mov al, byte [esp + 8]
cmp al, byte [esp + 0xc]
jb 0x5f84b0
cmp byte [esp + 0x1c], 4
jae 0x5f85f4
movzx edx, byte [esp + 8]
mov ax, word [esp + 0x38]
mov ebp, edx
add ebp, dword [esp + 0x18]
mov word [esi + ebp*2 + 0x1f1a], ax
mov eax, dword [esp + 0x34]
lea eax, [eax + eax*4]
add eax, eax
fld dword [esp + 0x3c]
add eax, edx
fstp dword [esi + eax*4 + 0x1f24]
inc byte [esi + edi + 0x1f34]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x600b00
Capabilities:
Get keyboard layout
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
call dword [sym.imp.kernel32.dll_GetSystemDefaultLCID]
movzx ebx, ax
and ebx, 0x3ff
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
movzx ebp, ax
push 0
and ebp, 0x3ff
call dword [sym.imp.user32.dll_GetKeyboardLayout]
movzx esi, ax
and esi, 0x3ff
call dword [sym.imp.kernel32.dll_GetSystemDefaultLCID]
movzx ecx, ax
mov dword [esp + 4], ecx
sar dword [esp + 4], 0xa
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
movzx edi, ax
push 0
sar edi, 0xa
call dword [sym.imp.user32.dll_GetKeyboardLayout]
movzx eax, ax
sar eax, 0xa
cmp ebx, 7
je 0x600b71
cmp ebp, 7
je 0x600b71
cmp esi, 7
jne 0x600b86
mov byte [0x68dd68], 0
mov byte [0x869691], 0
mov byte [0xa10ac0], 1
cmp ebx, 0xc
je 0x600b95
cmp ebp, 0xc
je 0x600b95
cmp esi, 0xc
jne 0x600baa
mov byte [0x68dd68], 0
mov byte [0x869691], 0
mov byte [0xa10b9e], 1
cmp dword [esp + 4], 3
je 0x600bbb
cmp edi, 3
je 0x600bbb
cmp eax, 3
jne 0x600bc2
mov byte [0xa10ba2], 1
cmp ebp, 7
jne 0x600bd0
mov eax, 7
jmp 0x600c15
cmp ebp, 0xc
jne 0x600be0
mov eax, 0xc
jmp 0x600c15
cmp ebp, 0xa
jne 0x600bf0
mov eax, 0xa
jmp 0x600c15
cmp ebp, 0x10
jne 0x600c00
mov eax, 0x10
jmp 0x600c15
cmp edi, 3
jne 0x600c10
mov eax, 0xffffff9d
jmp 0x600c15
mov eax, 9
mov edx, eax
sub eax, 7
cmp eax, 9
mov dword [0x869684], ebx
ja case.0x600c25.8
jmp dword [eax*4 + 0x6d68e0]
mov dword [0x869688], 1
jmp 0x600c6a
mov dword [0x869688], 2
jmp 0x600c6a
mov dword [0x869688], 4
jmp 0x600c6a
mov dword [0x869688], 3
jmp 0x600c6a
mov dword [0x869688], 0
mov ecx, 0x94b228
call fcn.005850d0
mov ecx, 0x94b228
call fcn.00585510
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6017a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
sub esp, 0x10
push 0
call fcn.0064e130
pop ecx
mov ecx, 0x869638
call fcn.004a396e
call fcn.00642b30
push 0
push 0x16
mov dword [0x974b7c], 0
mov ebx, eax
call fcn.00602ec0
mov edx, dword [0x9b48fc]
mov eax, dword [esp + 0x20]
mov dword [0x783ef4], 1
mov dword [0x783ee8], ebx
mov dword [0x783eec], eax
mov eax, dword [edx]
pop ecx
pop ecx
push eax
push 0x15
call fcn.00602ec0
test eax, eax
pop ecx
pop ecx
jne 0x601805
xor eax, eax
jmp 0x60184d
mov eax, dword [0x9b48e4]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp]
push eax
mov ecx, dword [0x9b48e8]
push 0
mov dword [esp + 0x14], ecx
mov dword [0x974b7c], 1
mov dword [esp + 0xc], 0
mov dword [0x783ef4], 0
call fcn.00602ec0
mov eax, 1
pop ecx
pop ecx
test eax, eax
jne 0x6018a0
mov dword [0x9b48f8], 1
mov edx, dword [0x9b48fc]
mov eax, dword [edx]
push 0
push eax
call dword [sym.imp.user32.dll_ShowWindow]
mov ecx, 0x94b228
push 0
push str.WIN_TTL
call fcn.00584f50
mov ecx, 0x94b228
push eax
push str.WIN_RSZ
call fcn.00584f50
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxW]
add esp, 0x10
pop ebx
ret
mov ecx, 0x869638
call fcn.004a3a34
add esp, 0x10
pop ebx
ret
Function at 0x601eb0
Capabilities:
Print debug messages

Disassembly:
push ebx
push ebp
sub esp, 8
push str.DDRAW.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x601ee0
push str.Couldnt_LoadLibrary_DDraw_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop ebx
ret
push str.DirectDrawCreateEx
push ebx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
jne 0x601f10
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Couldnt_GetProcAddress_DirectDrawCreateEx_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop ebx
ret
lea eax, [esp + 4]
push 0
push 0x67ec9c
push eax
push 0
call ebp
test eax, eax
jge 0x601f40
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Couldnt_DirectDrawCreateEx_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop ebx
ret
mov eax, dword [esp + 4]
mov ebp, dword [eax]
push eax
call dword [ebp + 8]
push str.D3D8.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
jne 0x601f78
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_D3D8.DLL_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x700
pop ebp
pop ebx
ret
push str.dpnhpast.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
test eax, eax
jne 0x601fb2
push eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebp
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_dpnhpast.dll_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x800
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebp
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, 0x801
add esp, 8
pop ebp
pop ebx
ret
Function at 0x602220
Capabilities:
Create directory
Persist via run registry key
Query or enumerate registry value

Disassembly:
push esi
push edi
sub esp, 0x10
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6022ed
mov dword [esp + 8], 0x100
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push 0x783ef8
push eax
mov eax, dword [esp + 0x10]
push 0
push str.Personal
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x6022e2
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push str.GTA_Vice_City_User_Files
push 0x783ef8
call fcn.00642600
pop ecx
pop ecx
push 0
push 0x2000080
push 3
push 0
push 1
push 0x80000000
push 0x783ef8
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x6022d0
push 0
push 0x783ef8
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
jmp 0x6022d7
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
add esp, 0x10
mov eax, 0x783ef8
pop edi
pop esi
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edi, 0x783ef8
mov esi, str.data
movsd dword es:[edi], dword [esi]
mov eax, 0x783ef8
movsb byte es:[edi], byte [esi]
add esp, 0x10
pop edi
pop esi
ret
Function at 0x61d410
Capabilities:
Delete file

Disassembly:
push ebx
mov dword [0x9753cc], 0
sub esp, 0x108
mov ebx, dword [esp + 0x110]
movsx eax, bl
mov dword [esp], ecx
inc eax
push eax
lea eax, [esp + 8]
push 0x9750a4
push str._s_i.b
push eax
call fcn.00648c60
lea eax, [esp + 0x14]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
movsx edx, bl
lea eax, [edx*8]
lea eax, [edx + eax*4]
lea eax, [eax + edx*2]
mov word [eax*4 + 0x812200], 0
mov al, 1
add esp, 0x108
pop ebx
ret 4