joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412280
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.00412400
mov eax, dword [esp + 0x1c]
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4122be
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ebp, dword [sym.imp.kernel32.dll_ReadFile]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push edi
call ebp
test eax, eax
jne 0x4122ec
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
cmp dword [esp + 0x14], 4
je 0x412306
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x412388
lea eax, [eax + eax*8]
shl eax, 6
push eax
push 0
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x412336
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [eax + eax*8]
shl edx, 6
push edx
push esi
push edi
call ebp
test eax, eax
jne 0x412363
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea eax, [eax + eax*8]
shl eax, 6
cmp ecx, eax
je 0x41238a
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
xor esi, esi
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x4123a1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov edi, dword [esp + 0x10]
xor ecx, ecx
test edi, edi
mov dword [ebx], edi
mov dword [ebx + 4], esi
jle 0x4123e8
lea eax, [esi + 0x5c]
lea edx, [esi + 0x54]
mov esi, 0x63
cmp dword [edx], 1
jl 0x412395
cmp dword [eax - 8], esi
jg 0x412395
cmp dword [eax], 1
jl 0x412395
mov ebx, dword [eax + 0x64]
mov ebp, dword [eax + 0x60]
sub ebx, ebp
inc ebx
cmp ebx, 1
jl 0x412395
inc ecx
add edx, 0x240
add eax, 0x240
cmp ecx, edi
jl 0x4123bb
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4124a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.00412400
mov eax, dword [esp + 0x1c]
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4124de
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ebx, dword [sym.imp.kernel32.dll_ReadFile]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push esi
call ebx
test eax, eax
jne 0x41250c
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
cmp dword [esp + 0x14], 4
je 0x412526
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x4125b5
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
shl edx, 2
push edx
push 0
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x41255d
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
lea eax, [esp + 0x14]
push 0
push eax
mov eax, dword [esp + 0x18]
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
shl edx, 2
push edx
push edi
push esi
call ebx
test eax, eax
jne 0x41258d
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
mov eax, dword [esp + 0x14]
shl edx, 2
cmp eax, edx
je 0x4125b7
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x4125cc
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
mov dword [ebp + 4], edi
pop edi
mov dword [ebp], eax
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x412630
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.00412400
mov eax, dword [esp + 0x1c]
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41266e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ebx, dword [sym.imp.kernel32.dll_ReadFile]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push edi
call ebx
test eax, eax
jne 0x41269c
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
cmp dword [esp + 0x14], 4
je 0x4126b6
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x412763
mov eax, ecx
shl eax, 6
add eax, ecx
lea eax, [eax + eax*8]
lea eax, [ecx + eax*2]
lea ecx, [eax + eax*2]
shl ecx, 2
push ecx
push 0
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x4126f7
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
mov eax, ecx
push 0
shl eax, 6
add eax, ecx
push edx
lea eax, [eax + eax*8]
lea eax, [ecx + eax*2]
lea ecx, [eax + eax*2]
shl ecx, 2
push ecx
push esi
push edi
call ebx
test eax, eax
jne 0x412731
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ecx, dword [esp + 0x10]
mov eax, ecx
shl eax, 6
add eax, ecx
lea edx, [eax + eax*8]
lea eax, [ecx + edx*2]
mov ecx, dword [esp + 0x14]
lea eax, [eax + eax*2]
shl eax, 2
cmp ecx, eax
je 0x412765
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
xor esi, esi
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x41277c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov edi, dword [esp + 0x10]
xor ecx, ecx
test edi, edi
mov dword [ebp], edi
mov dword [ebp + 4], esi
jle 0x4127bf
lea eax, [esi + 0x64]
lea edx, [esi + 0x4c]
mov esi, 0x63
cmp dword [edx], 1
jl 0x412770
cmp dword [eax - 0x18], esi
jg 0x412770
cmp dword [eax], 1
jl 0x412770
cmp dword [eax + 0x514], 1
jl 0x412770
inc ecx
add edx, 0x36e4
add eax, 0x36e4
cmp ecx, edi
jl 0x412797
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x412870
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.00412400
mov eax, dword [esp + 0x1c]
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4128ae
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov ebx, dword [sym.imp.kernel32.dll_ReadFile]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push esi
call ebx
test eax, eax
jne 0x4128dc
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
cmp dword [esp + 0x14], 4
je 0x4128f6
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x41299a
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, eax
shl ecx, 5
add ecx, eax
shl ecx, 2
push ecx
push 0
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x412934
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, eax
shl ecx, 5
add ecx, eax
shl ecx, 2
push ecx
push edi
push esi
call ebx
test eax, eax
jne 0x41296b
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
lea edx, [eax + eax*2]
shl edx, 4
add edx, eax
shl edx, 5
add edx, eax
mov eax, dword [esp + 0x14]
shl edx, 2
cmp eax, edx
je 0x41299c
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x4129b1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [esp + 0x10]
mov dword [ebp + 4], edi
pop edi
mov dword [ebp], eax
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x414150
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
mov edi, ecx
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x414255
mov ebx, dword [sym.imp.kernel32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 0
push ecx
push 0x18
push edi
push esi
call ebx
test eax, eax
jne 0x4141a8
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, edi
call fcn.004140e0
pop edi
pop esi
pop ebx
ret 4
cmp dword [esp + 0x10], 0x18
je 0x4141c3
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, edi
call fcn.004140e0
pop edi
pop esi
pop ebx
ret 4
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [edi + 0x18]
push 0x28
push eax
push esi
call ebx
test eax, eax
jne 0x4141eb
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, edi
call fcn.004140e0
pop edi
pop esi
pop ebx
ret 4
cmp dword [esp + 0x10], 0x28
je 0x414206
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, edi
call fcn.004140e0
pop edi
pop esi
pop ebx
ret 4
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [edi + 0x40]
push 8
push edx
push esi
call ebx
test eax, eax
jne 0x41422e
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, edi
call fcn.004140e0
pop edi
pop esi
pop ebx
ret 4
mov eax, dword [esp + 0x10]
push esi
cmp eax, 8
je 0x41424b
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, edi
call fcn.004140e0
pop edi
pop esi
pop ebx
ret 4
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x41425c
mov ecx, edi
call fcn.004140e0
pop edi
pop esi
pop ebx
ret 4
Function at 0x433580
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov ecx, 0x47c3d8
call fcn.00403850
test eax, eax
jne 0x43373c
mov eax, dword [0x60d50c]
mov ebp, dword [sym.imp.user32.dll_GetWindowTextA]
lea esi, [ebx + 0xc]
push 0xd
push esi
push eax
call ebp
test eax, eax
jne 0x4335cc
push 0x47cc04
push 0x4751d8
push eax
mov ecx, 0x61c670
call fcn.0040feb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x433601
mov al, byte [esi + edx]
cmp al, 0x80
jae 0x4335ef
cmp al, 0x27
je 0x43362f
cmp al, 0x20
je 0x43362f
jmp 0x4335f0
inc edx
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x4335de
mov ecx, dword [0x60d510]
lea edi, [ebx + 0x19]
push 0xd
push edi
push ecx
call ebp
test eax, eax
jne 0x43364b
push 0x47cc04
push 0x4751c0
push eax
mov ecx, 0x61c670
call fcn.0040feb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x47cc04
push 0x475198
push 0
mov ecx, 0x61c670
call fcn.0040feb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [0x6fa458]
lea edx, [esp + 0x10]
push edx
mov ecx, dword [eax*4 + 0x6fa440]
shl eax, 4
add eax, 0x6fa410
push ecx
push eax
mov ecx, 0x47c3d8
call fcn.00403860
mov eax, dword [esp + 0x10]
cmp eax, 4
ja case.default.0x43367d
jmp dword [eax*4 + 0x433744]
push 0x6e
push edi
push esi
mov ecx, 0x47cc08
call fcn.00408ad0
test eax, eax
jne 0x43373c
push 0x47cc04
push 0x472a08
push 1
mov ecx, 0x61c670
call fcn.0040feb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x47cc04
push 0x472b6c
push 1
mov ecx, 0x61c670
call fcn.0040feb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x47cc04
push 0x472b4c
push 1
mov ecx, 0x61c670
call fcn.0040feb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x47cc04
push 0x472b2c
push 1
mov ecx, 0x61c670
call fcn.0040feb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x47cc04
push 0x472b08
push 0
mov ecx, 0x61c670
call fcn.0040feb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x47cc04
push 0x472ae4
push 1
mov ecx, 0x61c670
call fcn.0040feb0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x436950
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3f0
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
je 0x436b0a
lea eax, [esp + 4]
push eax
call dword [sym.imp.user32.dll_GetCursorPos]
push 0
mov ecx, 0x60d4e0
call fcn.0040ee40
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push ecx
push edx
mov ecx, 0x482218
call fcn.0040afe0
mov ecx, dword [0x60d520]
lea eax, [esp + 0xc]
push 0x3e8
push eax
push ecx
call dword [sym.imp.user32.dll_GetWindowTextA]
mov edx, dword [esi + 0x20]
push 3
add edx, 6
lea eax, [esp + 0x10]
push edx
push eax
mov ecx, 0x60d530
call fcn.0040f9f0
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
sub ecx, eax
lea edx, [esp + 0x14]
add ecx, 0x51
push ecx
push edx
mov ecx, 0x60d530
call fcn.0040fa10
cmp dword [0x60d508], 5
jne 0x436a15
fld dword [0x47c078]
fadd st(0), st(0)
call fcn.004616bc
and eax, reloc.dsound.dll_DirectSoundCreate
jns 0x4369fb
dec eax
or eax, 0xfffffffe
inc eax
jne 0x436a15
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
add eax, 0xa
add ecx, 0x52
push eax
push ecx
mov ecx, 0x47d868
call fcn.0040afe0
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x436a72
mov edx, dword [esp + 8]
mov ecx, dword [esi + 0x20]
mov eax, dword [esp + 4]
push edx
mov edx, dword [esi + 0x1c]
add ecx, 0x2c
push eax
add edx, 0x10
push ecx
push edx
mov ecx, 0x4822f0
call fcn.0040b020
test eax, eax
je 0x436a8a
mov eax, dword [0x61c670]
test eax, eax
jne 0x436a8a
mov eax, dword [0x61c6e8]
test eax, eax
jne 0x436a8a
mov eax, dword [0x61c5f8]
test eax, eax
jne 0x436a8a
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
add eax, 0x2c
add ecx, 0x10
push eax
push ecx
mov ecx, 0x4822f0
jmp 0x436a85
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
add edx, 0x2c
add eax, 0x10
push edx
push eax
mov ecx, 0x482338
call fcn.0040afe0
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x436af2
mov ecx, dword [esp + 8]
mov eax, dword [esi + 0x20]
mov edx, dword [esp + 4]
push ecx
mov ecx, dword [esi + 0x1c]
add eax, 0x2c
push edx
add ecx, 0x39
push eax
push ecx
mov ecx, 0x482260
call fcn.0040b020
test eax, eax
je 0x436b0a
mov eax, dword [0x61c670]
test eax, eax
jne 0x436b0a
mov eax, dword [0x61c6e8]
test eax, eax
jne 0x436b0a
mov eax, dword [0x61c5f8]
test eax, eax
jne 0x436b0a
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
add edx, 0x2c
add eax, 0x39
push edx
push eax
mov ecx, 0x482260
call fcn.0040afe0
pop esi
add esp, 0x3f0
ret
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
add ecx, 0x2c
add edx, 0x39
push ecx
push edx
mov ecx, 0x4822a8
call fcn.0040afe0
pop esi
add esp, 0x3f0
ret
Function at 0x436e10
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x3e8
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
je 0x436f81
mov ecx, dword [0x60d520]
lea eax, [esp + 4]
push 0x3e8
push eax
push ecx
call dword [sym.imp.user32.dll_GetWindowTextA]
test eax, eax
jle 0x436f6e
lea edx, [esp + 4]
push edx
call fcn.00461923
add esp, 4
cmp eax, 1
jl 0x436f6e
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
lea edx, [esp + 4]
mov dword [esi], eax
push edx
mov dword [esi + 4], ecx
call fcn.00461923
mov ecx, dword [esi + 0x14]
add esp, 4
cmp ecx, 0x13
mov dword [esi + 8], eax
ja case.0x436e88.11
xor edx, edx
mov dl, byte [ecx + 0x436fbc]
jmp dword [edx*4 + 0x436f8c]
mov ecx, dword [esi + 4]
mov ecx, dword [ecx*8 + 0x630c74]
cmp ecx, eax
jge case.0x436e88.11
jmp 0x436f64
mov edx, dword [esi + 4]
shl edx, 4
mov ecx, dword [edx + 0x63087c]
cmp ecx, eax
jge case.0x436e88.11
jmp 0x436f64
mov ecx, dword [esi + 4]
mov ecx, dword [ecx*8 + 0x630c98]
cmp ecx, eax
jge case.0x436e88.11
jmp 0x436f64
mov ecx, dword [0x63086c]
cmp ecx, eax
jge case.0x436e88.11
jmp 0x436f64
cmp eax, 0x63
jle case.0x436e88.11
mov dword [esi + 8], 0x63
jmp case.0x436e88.11
mov ecx, dword [0x630c90]
cmp ecx, eax
jge case.0x436e88.11
jmp 0x436f64
mov edx, dword [esi + 4]
shl edx, 4
mov ecx, dword [edx + 0x6fd7e4]
cmp ecx, eax
jge case.0x436e88.11
jmp 0x436f64
mov ecx, dword [0x6fdbd8]
cmp ecx, eax
jge case.0x436e88.11
jmp 0x436f64
mov ecx, dword [0x6fd7d4]
cmp ecx, eax
jge case.0x436e88.11
jmp 0x436f64
mov ecx, dword [esi + 4]
mov dword [esi], 0xffffffff
shl ecx, 4
mov dword [ecx + 0x6fd304], eax
mov edx, dword [esi + 4]
shl edx, 4
mov ecx, dword [edx + 0x6fd304]
lea eax, [edx + 0x6fd304]
test ecx, ecx
jge case.0x436e88.11
mov dword [eax], 0
jmp case.0x436e88.11
mov ecx, dword [0x631004]
cmp ecx, eax
jge case.0x436e88.11
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
push 0xffffffffffffffff
mov ecx, 0x60d508
call fcn.0040f040
mov ecx, esi
call fcn.00435470
pop esi
add esp, 0x3e8
ret
Function at 0x43a0b1
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x43a2d1
mov al, byte [esi + 0x10]
cmp al, bl
jne 0x43a22e
cmp dword [esi + 4], ebx
je 0x43a0ff
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push 0xbd
push 0x21e
mov ecx, 0x482020
mov dword [esi + 4], ebx
call fcn.0040b020
test eax, eax
je 0x43a150
cmp dword [0x60d508], 6
jne 0x43a149
jmp 0x43a13d
cmp dword [esi + 8], ebx
je 0x43a15b
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push 0xbc
push 0x3e1
mov ecx, 0x482020
mov dword [esi + 8], ebx
call fcn.0040b020
test eax, eax
jne 0x43a134
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
cmp dword [0x60d508], 6
jne 0x43a149
push 0xffffffffffffffff
mov ecx, 0x60d508
call fcn.0040f040
mov ecx, esi
call fcn.00438b10
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
cmp dword [esi + 0xc], ebx
je 0x43a2d1
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
push 0x250
push 0x2bd
mov ecx, 0x4888c0
mov dword [esi + 0xc], ebx
call fcn.0040b020
test eax, eax
jne 0x43a194
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
cmp dword [0x60d508], 6
jne 0x43a1a9
push 0xffffffffffffffff
mov ecx, 0x60d508
call fcn.0040f040
mov eax, dword [0x60d524]
lea edi, [esi + 0x14]
push 0x19
push edi
push eax
call dword [sym.imp.user32.dll_GetWindowTextA]
test eax, eax
jne 0x43a1e0
mov cl, byte [0x61c5e4]
push ecx
push 0x475648
mov ecx, 0x6fdcd0
call fcn.00442d70
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
xor eax, eax
lea ecx, [esi + 0x30]
cmp dword [ecx], ebx
jg 0x43a1f2
inc eax
add ecx, 0x10
cmp eax, 5
jl 0x43a1e5
cmp eax, 5
jne 0x43a218
mov dl, byte [0x61c5e4]
mov ecx, 0x6fdcd0
push edx
push 0x475628
call fcn.00442d70
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
push edi
mov ecx, 0x47cc08
call fcn.0040aa20
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
cmp al, 1
jne 0x43a2d1
cmp dword [esi + 4], ebx
je 0x43a287
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push 0xbd
push 0x21e
mov ecx, 0x482020
mov dword [esi + 4], ebx
call fcn.0040b020
test eax, eax
jne 0x43a26b
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov ecx, 0x47cc08
call fcn.0040aab0
mov ecx, esi
call fcn.00438b10
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
cmp dword [esi + 0xc], ebx
je 0x43a2d1
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push 0x250
push 0x2bd
mov ecx, 0x488998
mov dword [esi + 0xc], ebx
call fcn.0040b020
test eax, eax
jne 0x43a2bc
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov ecx, 0x47cc08
call fcn.0040aab0
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x447930
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov eax, dword [esp + 0x14]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
mov dword [esp + 0x30], ecx
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x447a52
mov ebp, dword [sym.imp.kernel32.dll_ReadFile]
lea ecx, [esp + 0x20]
push 0
push ecx
lea edx, [esp + 0x1c]
push 4
push edx
push esi
call ebp
test eax, eax
je 0x447a4b
cmp dword [esp + 0x20], 4
jne 0x447a4b
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.kernel32.dll_GlobalAlloc]
push eax
push 0
call edi
mov ebx, eax
test ebx, ebx
je 0x447a4b
lea ecx, [esp + 0x20]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push esi
call ebp
test eax, eax
jne 0x4479d5
push ebx
call dword [sym.imp.kernel32.dll_GlobalFree]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
cmp dword [esp + 0x20], 4
je 0x4479f6
push ebx
call dword [sym.imp.kernel32.dll_GlobalFree]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
mov eax, dword [esp + 0x10]
push eax
push 0
call edi
mov edi, eax
test edi, edi
jne 0x447a1f
push ebx
call dword [sym.imp.kernel32.dll_GlobalFree]
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push 0
push ecx
push edx
push edi
push esi
call ebp
test eax, eax
je 0x447a3f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x447a5e
push edi
mov edi, dword [sym.imp.kernel32.dll_GlobalFree]
call edi
push ebx
call edi
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x447a81
mov esi, dword [sym.imp.kernel32.dll_GlobalFree]
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push ecx
mov ecx, dword [esp + 0x20]
push edi
push edx
call fcn.00447ad0
test eax, eax
push edi
jne 0x447ab2
mov esi, dword [sym.imp.kernel32.dll_GlobalFree]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
call dword [sym.imp.kernel32.dll_GlobalFree]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xc
ret 4