joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, eax
shl ebx, 4
add ebx, eax
shl ebx, 2
mov eax, dword [ebx + 0x714f6c]
test eax, eax
push ebp
je 0x4042e8
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.00404110
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x404303
pop ebp
pop ebx
ret
mov edx, dword [esp + 0xc]
push 0x40
push 0x1000
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [ebx + 0x714f68], eax
jne 0x404324
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0xc]
push esi
push edi
mov edi, eax
mov eax, ecx
shr ecx, 2
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x14]
mov dword [ebx + 0x714f7c], ecx
mov edx, dword [ebx + 0x714f68]
mov dword [ebx + 0x714f6c], edx
mov dword [ebx + 0x714f88], 1
mov eax, dword [ebx + 0x714f68]
pop edi
pop esi
mov dword [ebx + 0x714f70], eax
mov dword [ebx + 0x714f74], eax
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x4047f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov cl, byte [eax]
sub esp, 0x108
push esi
mov esi, dword [esp + 0x114]
or cl, byte [esi]
jne 0x404812
xor eax, eax
pop esi
add esp, 0x108
ret
push eax
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 8]
push esi
push eax
call fcn.0040e790
add esp, 8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40485a
xor eax, eax
pop esi
add esp, 0x108
ret
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
push 0
lea edx, [esp + 8]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404884
pop esi
add esp, 0x108
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x108
ret
Function at 0x404f80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push 0x1390
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x404fa8
push str.Global_Alloc_Error
push 0x7197b0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop ebx
ret
push esi
push edi
mov ecx, 0xfa
mov esi, 0x4fcb60
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x3e8]
mov ecx, 0x3e8
mov esi, 0x512780
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ecx, [ebx + 0x1388]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, dword [0x462170]
test eax, eax
je 0x40502a
push ebp
xor esi, esi
call sub.MSVCRT.dll_rand
and eax, 0x800000ff
jns 0x404ff6
dec eax
or eax, 0xffffff00
inc eax
mov edx, ebx
mov edi, 0x1388
xor ecx, ecx
mov cl, byte [edx]
mov ebp, ecx
and ebp, 0xff
xor cl, al
xor ebp, 0xd3
xor cl, 0xf4
add esi, ebp
mov byte [edx], cl
inc edx
dec edi
jne 0x404ffd
xor al, 0xb1
xor esi, 0x4bc57d21
mov byte [edx], al
mov dword [edx + 4], esi
pop ebp
mov edx, dword [esp + 0x10]
push 0x1390
push ebx
push edx
call fcn.004048a0
add esp, 0xc
test eax, eax
pop edi
pop esi
push ebx
jne 0x40504e
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
pop ebx
ret

Function at 0x405060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push 0xfa8
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x405088
push str.Global_Alloc_Error
push 0x7197b0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop ebx
ret
push esi
push edi
mov ecx, 0x3e8
mov esi, 0x60e6c0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
lea ecx, [ebx + 0xfa0]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, dword [0x462170]
test eax, eax
je 0x4050f8
push ebp
xor esi, esi
call sub.MSVCRT.dll_rand
and eax, 0x800000ff
jns 0x4050c4
dec eax
or eax, 0xffffff00
inc eax
mov edx, ebx
mov edi, 0xfa0
xor ecx, ecx
mov cl, byte [edx]
mov ebp, ecx
and ebp, 0xff
xor cl, al
xor ebp, 0xd3
xor cl, 0xf4
add esi, ebp
mov byte [edx], cl
inc edx
dec edi
jne 0x4050cb
xor al, 0xb1
xor esi, 0x4bc57d21
mov byte [edx], al
mov dword [edx + 4], esi
pop ebp
mov edx, dword [esp + 0x10]
push 0xfa8
push ebx
push edx
call fcn.004048a0
add esp, 0xc
test eax, eax
pop edi
pop esi
push ebx
jne 0x40511c
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
pop ebx
ret
Function at 0x405130
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push ecx
call fcn.00404110
add esp, 8
test eax, eax
jne 0x405147
ret
cmp dword [esp + 4], 0x1390
je 0x405164
push str.Not_Flag_file.
push 0x7197b0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
ret
mov ecx, dword [0x462170]
test ecx, ecx
push esi
push edi
je 0x40519f
push ebx
mov bl, byte [eax + 0x1388]
xor esi, esi
mov edx, eax
xor bl, 0xb1
mov edi, 0x1388
mov cl, byte [edx]
xor cl, bl
xor cl, 0xf4
mov byte [edx], cl
and ecx, 0xff
xor ecx, 0xd3
add esi, ecx
inc edx
dec edi
jne 0x405183
pop ebx
mov esi, eax
mov ecx, 0xfa
mov edi, 0x4fcb60
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x3e8]
mov ecx, 0x3e8
mov edi, 0x512780
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, 1
pop esi
ret

Function at 0x4051d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push ecx
call fcn.00404110
add esp, 8
test eax, eax
jne 0x4051e7
ret
cmp dword [esp + 4], 0xfa8
je 0x405204
push str.Not_System_Flag_file.
push 0x7197b0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
ret
mov ecx, dword [0x462170]
test ecx, ecx
push esi
push edi
je 0x40523f
push ebx
mov bl, byte [eax + 0xfa0]
xor esi, esi
mov edx, eax
xor bl, 0xb1
mov edi, 0xfa0
mov cl, byte [edx]
xor cl, bl
xor cl, 0xf4
mov byte [edx], cl
and ecx, 0xff
xor ecx, 0xd3
add esi, ecx
inc edx
dec edi
jne 0x405223
pop ebx
mov esi, eax
mov ecx, 0x3e8
mov edi, 0x60e6c0
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, 1
pop esi
ret

Function at 0x405260
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
mov cl, byte [eax]
sub esp, 0x158
push esi
mov esi, dword [esp + 0x164]
or cl, byte [esi]
jne 0x405282
xor eax, eax
pop esi
add esp, 0x158
ret
push edi
push eax
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x5c]
push esi
push eax
call fcn.0040e790
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 8
push 0x45d0fc
lea ecx, [esp + 0x60]
push ecx
call esi
mov edx, dword [esp + 0x16c]
push edx
lea eax, [esp + 0x60]
push eax
call esi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 8], ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x7c]
push ecx
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x158
ret
Function at 0x406730
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 0x3a
push 0x617e6c
call sub.MSVCRT.dll_strchr
mov esi, dword [esp + 0x128]
mov edi, dword [esp + 0x124]
mov ebx, dword [esp + 0x120]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 8
test eax, eax
je 0x406776
push 0x617e6c
push esi
push edi
push ebx
call ebp
cmp eax, esi
jne 0x4067b1
mov al, byte [0x719bf8]
test al, al
je 0x4067af
push 0x719bf8
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push 0x617e6c
push ecx
call fcn.0040e790
add esp, 8
lea edx, [esp + 0x10]
push edx
push esi
push edi
push ebx
call ebp
cmp eax, esi
jne 0x4067b1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x4067c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 0x3a
push 0x617e6c
call sub.MSVCRT.dll_strchr
mov edi, dword [esp + 0x12c]
mov esi, dword [esp + 0x128]
mov ebx, dword [esp + 0x124]
mov ebp, dword [esp + 0x120]
add esp, 8
test eax, eax
je 0x406811
push 0x617e6c
push edi
push esi
push 0x484668
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x406859
mov al, byte [0x719bf8]
test al, al
je 0x406854
push 0x719bf8
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push 0x617e6c
push ecx
call fcn.0040e790
add esp, 8
lea edx, [esp + 0x10]
push edx
push edi
push esi
push 0x484668
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x406859
mov byte [esi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x4073d0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x244
push ebx
push ebp
mov ebp, dword [esp + 0x250]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov bl, 0x41
movsx esi, bl
push esi
lea eax, [esp + 0x14]
push str._c:_
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x407435
push ebp
push esi
lea edx, [esp + 0x18]
push str._c:_s
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x407449
inc bl
cmp bl, 0x5a
jle 0x4073e9
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x244
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x244
ret
Function at 0x407460
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
push esi
push edi
push 0x4fc138
call fcn.0040ede0
mov al, byte [0x4fc038]
xor ebx, ebx
add esp, 4
cmp al, bl
je 0x4074fe
push 0x4fc038
lea eax, [esp + 0x1c]
push 0x45d310
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x24]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4074fe
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x7199f0
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.InstPath
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4074f3
mov eax, dword [esp + 0xc]
push eax
jmp 0x4074f8
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x484668
push 0x7199f0
call fcn.0040e790
add esp, 8
push 0x719af4
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x484668
push 0x719af4
call fcn.0040e790
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 8
push str.autoexec.scn
push 0x719cfc
call edi
push 0x719cfc
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
js 0x407578
cmp byte [eax + 0x719cfc], 0x5c
je 0x407574
dec eax
mov byte [eax + 0x719cfd], bl
jns 0x407552
lea edx, [eax + 0x462021]
push edx
push str.autoexec.scn
call edi
jmp 0x40758e
cmp eax, ebx
jge 0x407588
lea edx, [eax + 0x462021]
push edx
push str.autoexec.scn
call edi
jmp 0x40758e
mov byte [eax + 0x719cfc], bl
cmp byte [0x719cfc], bl
je 0x4075a8
push 0x484668
push 0x719cfc
call fcn.0040e790
add esp, 8
push 0x104
push 0x719e08
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x484668
push 0x719e08
call fcn.0040e790
add esp, 8
push 0x719f0c
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x484668
push 0x719f0c
call fcn.0040e790
push 0x484668
push 0x71a010
call fcn.0040e790
add esp, 0x10
push str.20011002
push 0x466aff
call edi
push 0x5c
push 0x617e6c
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x407659
mov eax, dword [0x71a218]
mov ecx, eax
shl ecx, 6
add ecx, eax
push 0x617e6c
lea edx, [ecx*4 + 0x61837c]
push edx
call edi
mov eax, dword [0x71a218]
mov ecx, eax
shl ecx, 6
add ecx, eax
shl ecx, 2
sub ecx, 0x617e6c
mov byte [ecx + esi + 0x61837d], bl
inc dword [0x71a218]
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x409bf0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp + 4]
dec eax
cmp ecx, eax
push esi
push edi
ja 0x409d40
mov eax, dword [ebp + 0x24]
mov edi, dword [eax + ecx*4]
mov esi, dword [eax + ecx*4 + 4]
xor edx, edx
mov ebx, 0x30
mov eax, ecx
div ebx
and edi, 0x3fffffff
and esi, 0x3fffffff
sub esi, edi
mov ebx, edx
lea edx, [ebx + ebx*2]
lea eax, [ebp + edx*4]
cmp dword [eax + 0x58], ecx
mov dword [esp + 0x18], eax
jne 0x409c49
mov edx, dword [eax + 0x5c]
test edx, edx
jne 0x409d40
mov edx, dword [eax + 0x5c]
test edx, edx
je 0x409c5f
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
test esi, esi
je 0x409d27
mov eax, dword [ebp + 0x18]
push 0
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [ebp + 0x18]
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
mov edi, eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409ca7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
push edi
push 0
call fcn.00432f10
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x409cc2
mov eax, dword [esp + 0x18]
mov dword [eax + 0x5c], edi
jmp 0x409cd0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x5c], esi
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x5c]
cmp dword [eax], 0x3449414d
jne 0x409d02
lea ecx, [ebx + ebx*2 + 0x18]
mov dword [ebp + ecx*4], 1
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, edx
mov dword [eax + 0x58], ecx
pop esi
mov dword [ebp + 0x54], ecx
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [ebx + ebx*2 + 0x18]
pop edi
mov dword [ebp + edx*4], 0
mov dword [eax + 0x58], ecx
pop esi
mov dword [ebp + 0x54], ecx
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
lea edx, [ebx + ebx*2 + 0x18]
mov dword [ebp + edx*4], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x58], ecx
mov dword [ebp + 0x54], ecx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x409d50
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor eax, eax
push eax
push eax
push eax
push eax
mov ecx, 0xa6
mov edi, 0x4880c0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c]
push DirectSoundCreate
push eax
call fcn.00403e70
add esp, 0x18
cmp eax, 0xffffffff
mov dword [0x4880d8], eax
jne 0x409d8f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x18
push 0x4880c0
push eax
call ebx
test eax, eax
je 0x409e78
mov eax, dword [0x4880d4]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
je 0x409e48
push eax
push 0x40
call ebp
mov ecx, dword [0x4880d4]
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [0x4880d8]
push ecx
push eax
push edx
mov dword [0x4880dc], eax
call ebx
test eax, eax
je 0x409e78
mov edi, dword [0x4880d4]
cmp edi, 0x400
jbe 0x409dfe
mov edi, 0x400
xor ecx, ecx
test edi, edi
jle 0x409e1e
mov esi, dword [0x4880dc]
mov al, byte [esi + ecx]
mov dl, al
shl dl, 7
shr al, 1
or dl, al
mov byte [esi + ecx], dl
inc ecx
cmp ecx, edi
jl 0x409e04
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [0x4880dc]
push eax
mov eax, dword [esp + 0x24]
or ecx, 1
push ecx
push edx
push eax
push 0x4880e0
call fcn.00436070
add esp, 0x14
test eax, eax
je 0x409e78
mov ecx, dword [0x4880c4]
lea esi, [ecx*4 + 4]
push esi
push 0x40
call ebp
test eax, eax
mov dword [0x4880e4], eax
je 0x409e78
push 0
lea edx, [esp + 0x20]
push edx
push esi
push eax
mov eax, dword [0x4880d8]
push eax
call ebx
test eax, eax
jne 0x409ee4
mov ecx, dword [0x4880e0]
push ecx
call fcn.00436630
mov eax, dword [0x4880d8]
add esp, 4
test eax, eax
je 0x409e97
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4880dc]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x409ea9
push eax
call edi
mov eax, dword [0x4880e4]
test eax, eax
je 0x409eb5
push eax
call edi
mov esi, 0x48811c
mov eax, dword [esi]
test eax, eax
je 0x409ec3
push eax
call edi
add esi, 0xc
cmp esi, 0x48835c
jl 0x409eba
mov ecx, 0xa6
xor eax, eax
mov edi, 0x4880c0
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [0x4880c8]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
fild qword [esp + 0x10]
mov eax, dword [0x461ff8]
pop edi
pop esi
fdivr qword [0x458490]
pop ebp
mov dword [0x488110], eax
mov eax, 1
pop ebx
fstp qword [0x4880f0]
add esp, 8
ret
Function at 0x409f20
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
mov dword [0x488104], eax
mov eax, ebx
and eax, 0xff
and eax, 1
mov dword [0x488108], ecx
mov ecx, dword [0x4880c4]
mov dword [0x488100], eax
xor eax, eax
inc ecx
test ecx, ecx
push esi
mov dword [0x48810c], edx
jbe 0x409f78
mov ecx, dword [0x4880e4]
and dword [ecx + eax*4], 0xbfffffff
mov edx, dword [0x4880c4]
inc eax
inc edx
cmp eax, edx
jb 0x409f5f
or eax, 0xffffffff
mov dword [0x4880f8], eax
mov dword [0x488118], eax
xor esi, esi
push esi
push 0x4880c0
call fcn.00409bf0
add esp, 8
test eax, eax
je 0x40a088
inc esi
cmp esi, 0x18
jl 0x409f87
test bl, 2
je 0x40a074
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40a074
mov eax, dword [0x4880d8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push 0
push 0
push eax
call edi
mov ecx, dword [0x4880c4]
add ecx, 0xfffffffe
cmp esi, ecx
mov dword [esp + 0x14], eax
jge 0x40a061
mov edx, dword [0x4880e4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edx + esi*4]
mov ecx, dword [edx + esi*4 + 4]
and eax, 0x3fffffff
and ecx, 0x3fffffff
sub ecx, eax
mov dword [esp + 0x14], ecx
je 0x40a053
cmp ecx, 0x400
jbe 0x40a020
mov dword [esp + 0x14], 0x400
mov edx, dword [0x4880d8]
push 0
push 0
push eax
push edx
call edi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x4880d8]
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push ebx
push edx
call ebp
test eax, eax
je 0x40a060
mov edx, dword [0x4880e4]
add esi, 0x10
jmp 0x40a054
inc esi
mov eax, dword [0x4880c4]
add eax, 0xfffffffe
cmp esi, eax
jl 0x409ff6
pop ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [0x4880d8]
push 0
push 0
push ecx
push edx
call edi
pop edi
mov eax, dword [0x4880e0]
push 0
push eax
call fcn.004377e0
add esp, 8
test eax, eax
jne 0x40a08d
pop esi
xor eax, eax
pop ebx
ret
call fcn.0040e820
mov ecx, dword [0x71a7ac]
test ecx, ecx
mov dword [0x4880e8], eax
je 0x40a0b6
mov edx, dword [0x4880e0]
mov eax, dword [edx + 0x30]
test eax, eax
je 0x40a0b6
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop esi
mov eax, 1
pop ebx
ret
Function at 0x40c030
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push esi
push edi
push 0x4fc038
lea eax, [esp + 0x18]
push str._sSystem
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x20]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c1cb
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
push eax
push 0x7199c4
lea ecx, [esp + 0x18]
push ecx
push 0
push str.gbFullScreenFlag
mov edi, 4
push edx
mov dword [esp + 0x28], 3
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40c0bc
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c1cb
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x462014
lea edx, [esp + 0x18]
push edx
push 0
push str.gnWindowLeft
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40c0f1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c1cb
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0x462018
lea eax, [esp + 0x18]
push eax
push 0
push str.gnWindowTop
push ecx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40c126
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c1cb
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0x461ff8
lea ecx, [esp + 0x18]
push ecx
push 0
push str.gdwWindowWidth
push edx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40c158
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c1cb
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x461ffc
lea edx, [esp + 0x18]
push edx
push 0
push str.gdwWindowHeight
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40c18a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c1cb
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0x462008
lea eax, [esp + 0x18]
push eax
push 0
push str.gdwWindowBpp
push ecx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x40c1bc
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40c1cb
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x40c1e6
push str.Registry_Read_Error.
push 0x7197b0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
xor eax, eax
pop esi
add esp, 0x110
ret
mov eax, 1
pop edi
mov dword [0x71a644], eax
pop esi
add esp, 0x110
ret