joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d90
Capabilities:
Decompress data using quicklz

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, ebx
jle 0x408f95
call fcn.00433830
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
lea esi, [edx*4 + 0x8012e0]
call fcn.0048eb50
mov edx, eax
mov cl, al
sar edx, 4
and cl, 0xf
and dl, 0x1f
add cl, 0x10
add dl, 0x30
mov byte [esi + 0x20], 1
mov byte [esi + 0x22], 0x80
mov byte [esi + 0x23], cl
mov byte [esi + 0x21], bl
mov byte [esi + 0x25], 0x60
mov byte [esi + 0x26], dl
mov byte [esi + 0x24], bl
mov byte [esi + 0x2a], 2
mov byte [esi + 0x2b], 4
mov byte [esi + 0x2d], 9
mov byte [esi + 0x2c], 9
mov byte [esi + 0x2e], 2
mov ecx, dword [edi]
mov dword [esi], ecx
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov ecx, dword [edi + 8]
mov edx, eax
mov dword [esi + 8], ecx
and edx, 0xfff
mov ecx, eax
sub edx, 0x800
mov byte [esi + 0x1b], 0x22
sar eax, 3
mov word [esi + 0xe], dx
mov edx, dword [esp + 0x18]
and eax, 0x7ff
mov word [esi + 0x16], bx
sar ecx, 7
lea eax, [eax + edx - 0x400]
and ecx, 0x1f
and eax, 0xfff
mov word [esi + 0x12], cx
mov byte [esi + 0x1f], bl
movsx edx, word [eax*4 + 0x4b34d0]
mov cx, word [eax*4 + 0x4b34d2]
neg edx
sar cx, 2
sar edx, 2
dec ebp
mov word [esi + 0x10], cx
mov word [esi + 0xc], dx
jne 0x408da6
mov ebp, dword [esp + 0x1c]
cmp ebp, ebx
jle 0x408f95
mov dword [esp + 0x14], ebp
call fcn.00433830
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
lea esi, [edx*4 + 0x8012e0]
call fcn.0048eb50
mov cl, al
mov byte [esi + 0x20], 1
and cl, 0xf
mov byte [esi + 0x22], 0x80
mov dl, cl
mov byte [esi + 0x21], bl
add dl, 0x10
mov byte [esi + 0x25], 0x60
mov byte [esp + 0x1c], dl
mov byte [esi + 0x23], dl
mov edx, eax
mov byte [esi + 0x24], bl
sar edx, 4
and dl, 0x1f
mov byte [esi + 0x2a], 2
add dl, 0x30
mov byte [esi + 0x2b], 4
mov byte [esi + 0x26], dl
mov byte [esi + 0x2d], 9
mov byte [esi + 0x2c], 9
mov byte [esi + 0x2e], 2
mov edx, dword [edi]
mov ebp, eax
mov dword [esi], edx
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov edx, eax
and edx, 0xfff
sub edx, 0x800
mov word [esi + 0xe], dx
mov edx, eax
sar edx, 7
and edx, 0x1f
sar ebp, 3
test al, 1
mov word [esi + 0x12], dx
mov word [esi + 0x14], bp
je 0x408f25
mov dl, 0xf0
sub dl, cl
mov byte [esi + 0x1e], dl
jmp 0x408f2c
mov cl, byte [esp + 0x1c]
mov byte [esi + 0x1e], cl
mov edx, dword [esp + 0x18]
and ebp, 0x7ff
sar eax, 5
and al, 7
mov byte [esi + 0x1c], 3
add al, 4
mov byte [esi + 0x1b], 0x22
mov byte [esi + 0x18], al
mov byte [esi + 0x1a], al
shr al, 1
mov byte [esi + 0x19], al
lea eax, [edx + ebp - 0x400]
and eax, 0xfff
mov word [esi + 0x16], 0x1a
mov byte [esi + 0x1f], bl
movsx edx, word [eax*4 + 0x4b34d0]
mov cx, word [eax*4 + 0x4b34d2]
mov eax, dword [esp + 0x14]
neg edx
sar cx, 2
sar edx, 2
dec eax
mov word [esi + 0x10], cx
mov word [esi + 0xc], dx
mov dword [esp + 0x14], eax
jne 0x408e85
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x453890
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
movsx eax, bp
push edi
lea ecx, [eax + eax*2]
lea ecx, [eax + ecx*4]
lea edx, [ecx + ecx*8]
mov ecx, dword [0x7fe16c]
lea eax, [eax + edx*8]
lea eax, [eax + eax*2]
mov dx, word [ecx + eax*2 + 0xc]
lea esi, [ecx + eax*2]
movsx eax, dx
shl eax, 6
mov cx, word [eax + 0x52b746]
mov word [esi + 0x14], cx
mov edi, dword [0x533938]
movsx ecx, cx
lea ecx, [ecx + ecx*4]
mov cx, word [edi + ecx*8 + 0x18]
mov word [esi + 0x16], cx
mov edi, dword [0x533938]
movsx ecx, word [esi + 0x14]
lea ecx, [ecx + ecx*4]
mov cx, word [edi + ecx*8 + 6]
xor edi, edi
mov word [esi + 0x10], cx
mov word [esi + 0xe], cx
mov ecx, dword [esi + 0x15ea]
mov word [esi + 0x12], di
and ecx, 0xffff8120
mov word [esi + 0x50], di
mov dword [esi + 0x15ea], ecx
and ch, 0xfe
mov word [esi + 0x4c], di
mov word [esi + 0x20], di
mov word [esi + 0x1e], di
mov word [esi + 0x3a], di
mov word [esi + 0x38], di
mov word [esi + 0x36], di
mov word [esi + 0x34], di
mov bx, word [eax + 0x52b748]
or ecx, 0x20
cmp dx, 0x16e
mov word [esi + 0x22], bx
mov dword [esi + 0x15ea], ecx
mov word [esi + 0x26], di
je 0x453969
cmp dx, 0x164
je 0x453969
cmp dx, 0x161
je 0x453969
mov dword [esi + 8], 0xffffffff
jmp 0x453970
mov dword [esi + 8], 1
cmp dx, 0x158
jne 0x45397e
mov dword [esi + 8], 5
cmp dx, 0x159
jne 0x45398c
mov dword [esi + 8], 0x647
mov dx, word [esi + 0x28]
mov dword [esi + 4], edi
mov ebx, edx
mov word [esi + 0x30], di
and ebx, 0x100
mov word [esi + 0x32], di
test bx, bx
mov dword [esi + 0x3c], edi
je 0x4539ba
or ecx, 6
add edx, 0xffffff00
mov word [esi + 0x28], dx
jmp 0x4539c6
test byte [eax + 0x52b752], 2
je 0x4539cc
or ecx, 6
mov dword [esi + 0x15ea], ecx
mov ax, word [esi + 0x28]
mov edx, eax
and edx, 0x3e00
cmp dx, 0x3e00
jne 0x453a04
add eax, 0xffffc200
push ebp
or ah, 0x40
mov word [esi + 0x28], ax
call fcn.00453c10
mov eax, dword [esi + 0x15ea]
add esp, 4
and al, 0xfb
or al, 2
mov dword [esi + 0x15ea], eax
movsx eax, word [esi + 0x18]
lea ecx, [eax + eax*8]
lea edx, [eax + ecx*4]
mov eax, dword [0x533934]
mov cx, word [eax + edx*4 + 0x48]
lea ebx, [eax + edx*4]
mov word [esi + 0x1a], cx
mov eax, dword [ebx + 0x14]
mov word [ebx + 0x48], bp
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
sub edx, eax
movsx eax, word [ebx + 0x28]
sar edx, 0xa
imul edx, eax
mov eax, dword [ebx + 0x1c]
sub ecx, eax
mov eax, dword [ebx + 8]
sar ecx, 0xa
add edx, ecx
movsx ecx, byte [eax + edx*8 + 5]
lea eax, [eax + edx*8]
shl ecx, 8
mov dword [esi], ecx
mov dx, word [eax + 2]
movsx eax, word [esi + 0xc]
shr edx, 4
and edx, 0x7ff
shl eax, 6
mov word [esi + 0x24], dx
mov eax, dword [eax + 0x52b72c]
cmp eax, edi
je 0x453a7a
push ebp
call eax
add esp, 4
mov ecx, dword [ebx + 0x2c]
or eax, 0xffffffff
mov dword [esi + 0x6e], eax
mov dword [esi + 0x15ce], eax
lea edx, [esi + 0x72]
lea eax, [esi + 0xb1c]
mov dword [esi + 0x15d2], edi
mov dword [esi + 0x15c6], edi
mov dword [esi + 0x15ca], edi
mov dword [esi + 0x5e], ecx
mov dword [esi + 0x15e2], edx
mov dword [esi + 0x15e6], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x46bf70
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
mov edi, dword [0x4bfcfc]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x4bfcd0], eax
call esi
mov dword [0x4bfcd4], eax
mov eax, dword [0x4bfcd0]
push edi
push str.Set_notifies_for_position__lu
push 8
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
call fcn.00499ec0
add esp, 0xc
mov esi, 1
mov ecx, dword [esp + esi*8 + 4]
mov edx, dword [0x4bfcd0]
mov dword [esp + esi*8 + 0x10], edx
lea eax, [ecx + edi]
push eax
push str.Set_notifies_for_positions__lu
push 8
mov dword [esp + esi*8 + 0x18], eax
call fcn.00499ec0
add esp, 0xc
inc esi
cmp esi, 4
jl 0x46bfc1
mov edi, dword [esp + esi*8 + 4]
mov eax, dword [0x4bfcd4]
lea ecx, [esp + 8]
dec edi
push ecx
push 0
push 0
push 0x46ca20
push 0
push 0
mov dword [esp + esi*8 + 0x1c], edi
mov dword [esp + esi*8 + 0x24], 0xffffffff
mov dword [esp + esi*8 + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x4bfcd8], eax
jne 0x46c036
push str.Create_Notification_Thread_failed
push 1
call fcn.00499ec0
add esp, 8
mov eax, dword [0x4bfd2c]
lea ecx, [esp + 0xc]
push ecx
push 5
mov edx, dword [eax]
push eax
call dword [edx + 0xc]
mov esi, eax
test esi, esi
je 0x46c081
mov edx, dword [0x4bfcd0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [0x4bfcd4]
push eax
call edi
mov eax, esi
pop edi
mov dword [0x4bfcd4], 0
mov dword [0x4bfcd0], 0
pop esi
add esp, 0x2c
ret
push str.Setup_Notifications_OK
push 8
call fcn.00499ec0
add esp, 8
mov eax, esi
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x473f50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
push ebx
push str.LoadTextureInfos
push 2
call fcn.00499ec0
mov eax, dword [0x533278]
add eax, 3
mov dword [0x533278], eax
mov ebx, dword [eax]
add eax, 4
push ebx
push str.Texture_Infos_:__d
push 5
mov dword [0x533278], eax
call fcn.00499ec0
lea eax, [ebx + ebx*8]
push 0
lea ecx, [ebx + eax*2]
add ecx, ecx
push ecx
call fcn.0048ebf0
add esp, 0x1c
mov dword [0x533990], eax
test ebx, ebx
jle 0x474125
push ebp
push esi
push edi
xor eax, eax
mov ebp, ebx
mov edx, dword [0x533278]
mov ecx, 9
mov esi, edx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x533990]
add edx, 0x26
movsw word es:[edi], word [esi]
mov dword [0x533278], edx
mov dx, word [esp + 0x14]
mov word [eax + ecx], dx
mov ecx, dword [esp + 0x16]
mov esi, dword [0x533990]
mov edx, ecx
and edx, 0x7fff
mov word [eax + esi + 2], dx
mov edx, dword [esp + 0x18]
xor edx, ecx
add eax, 0x26
and edx, 0x7fff
xor edx, ecx
mov ecx, dword [0x533990]
mov word [eax + ecx - 0x22], dx
mov edx, dword [esp + 0x1a]
and edx, 0xffff
mov ecx, dword [0x533990]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x1c]
fild dword [esp + 0x10]
and edx, 0xffff
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x1e]
fmul dword [0x4a7314]
and edx, 0xffff
fstp dword [eax + ecx - 0x20]
fild dword [esp + 0x10]
mov ecx, dword [0x533990]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
fmul dword [0x4a7314]
and edx, 0xffff
fstp dword [eax + ecx - 0x1c]
fild dword [esp + 0x10]
mov ecx, dword [0x533990]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x22]
fmul dword [0x4a7314]
and edx, 0xffff
fstp dword [eax + ecx - 0x18]
fild dword [esp + 0x10]
mov ecx, dword [0x533990]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x24]
fmul dword [0x4a7314]
and edx, 0xffff
fstp dword [eax + ecx - 0x14]
fild dword [esp + 0x10]
mov ecx, dword [0x533990]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x26]
fmul dword [0x4a7314]
and edx, 0xffff
fstp dword [eax + ecx - 0x10]
fild dword [esp + 0x10]
mov ecx, dword [0x533990]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x28]
fmul dword [0x4a7314]
and edx, 0xffff
dec ebp
fstp dword [eax + ecx - 0xc]
fild dword [esp + 0x10]
mov ecx, dword [0x533990]
mov dword [esp + 0x10], edx
fmul dword [0x4a7314]
fstp dword [eax + ecx - 8]
fild dword [esp + 0x10]
mov ecx, dword [0x533990]
fmul dword [0x4a7314]
fstp dword [eax + ecx - 4]
jne 0x473fab
pop edi
pop esi
pop ebp
push ebx
call fcn.00473520
mov edx, dword [0x7537c4]
dec edx
push edx
push str.Created__d_Texture_Pages
push 5
call fcn.00499ec0
add esp, 0x10
mov al, 1
pop ebx
add esp, 0x2c
ret
Function at 0x474b20
Capabilities:
Create thread

Disassembly:
sub esp, 0x50
push str.S_LoadLevelFile
push 2
call fcn.00499ec0
mov eax, dword [esp + 0x5c]
mov edx, dword [0x7fd1cc]
xor ecx, ecx
add esp, 8
mov cx, word [edx + eax*2]
mov eax, dword [0x7fd16c]
add ecx, eax
lea edx, [esp]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x474b4d
push edi
lea edi, [esp + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [str..TR4]
mov cl, byte [0x4b0934]
dec edi
push 0x53328c
lea edx, [esp + 8]
push 0
push edx
mov dword [edi], eax
push 0x4746d0
push 0
mov dword [0x53327c], 1
push 0
mov byte [edi + 4], cl
mov dword [0x533284], 0
call fcn.0049e5b2
add esp, 0x18
mov dword [0x533288], eax
pop edi
call fcn.00482721
nop
nop
nop
nop
mov eax, 1
add esp, 0x50
ret

Function at 0x475630
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x74
mov ecx, 0x14
xor eax, eax
push ebp
push esi
push edi
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
lea ecx, [esp + 0x30]
push eax
push str.savegame._d
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x30]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
je 0x4757c6
mov ecx, 0x14
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
mov al, byte [0x7fd170]
xor ecx, ecx
xor edx, edx
push ebx
mov cl, byte [eax + 0x7fd1a0]
mov eax, dword [0x7fd154]
mov dx, word [eax + ecx*2]
mov eax, dword [0x7fd198]
add edx, eax
lea ecx, [esp + 0x34]
push edx
push 0x4b09b0
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x34]
push 0
push edx
push 0x4b
push eax
push esi
call edi
lea ecx, [esp + 0x10]
push 0
push ecx
push 4
push 0x535484
push esi
call edi
mov eax, 0x88888889
mov ebx, 0x15180
mul dword [0x7f7732]
mov ecx, edx
push 0
shr ecx, 4
mov eax, ecx
cdq
idiv ebx
mov dword [esp + 0x18], eax
mov ebx, edx
mov eax, 0x91a2b3c5
imul ebx
add edx, ebx
mov ebx, 0x3c
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 0x1c], edx
mov ecx, 0x3c
cdq
idiv ecx
mov ecx, edx
cdq
idiv ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
lea edx, [esp + 0x14]
push edx
push 2
push eax
push esi
call edi
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x20]
push 2
push edx
push esi
call edi
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x24]
push 2
push ecx
push esi
call edi
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x28]
push 2
push eax
push esi
call edi
lea ecx, [esp + 0x10]
push 0
push ecx
push 0x3dfb
push 0x7f75a0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x535484]
lea eax, [esp + 0x24]
push edx
push 0x4b09ac
push eax
call ebp
mov eax, dword [0x535484]
add esp, 0xc
inc eax
mov dword [0x535484], eax
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x74
ret
Function at 0x4757d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x5c
lea ecx, [esp + 0xc]
push esi
push eax
push str.savegame._d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x10]
push 0
push 0x80
push 3
push 0
push 0
push DirectSoundCreate
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x475881
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x68]
push 0
push eax
lea ecx, [esp + 0x1c]
push 0x4b
push ecx
push esi
call edi
lea edx, [esp + 0x68]
push 0
push edx
lea eax, [esp + 0x10]
push 4
push eax
push esi
call edi
lea ecx, [esp + 0x68]
push 0
push ecx
lea edx, [esp + 0x14]
push 4
push edx
push esi
call edi
lea eax, [esp + 0x68]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push esi
call edi
lea edx, [esp + 0x68]
push 0
push edx
push 0x3dfb
push 0x7f75a0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x5c
ret
xor eax, eax
pop esi
add esp, 0x5c
ret
Function at 0x47e730
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x9c
push esi
push edi
mov edi, dword [esp + 0xac]
test edi, edi
je 0x47e868
mov esi, dword [esp + 0xa8]
test esi, esi
je 0x47e868
mov eax, dword [esi]
push ebx
push ebp
push esi
call dword [eax + 0x6c]
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
test ebp, ebp
jne 0x47e777
push str.createcompatible_dc_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esp + 0x18]
push ecx
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esp + 0xc0]
test eax, eax
jne 0x47e7a3
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xc0], edx
mov eax, dword [esp + 0xc4]
test eax, eax
jne 0x47e7b9
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc4], eax
mov ecx, dword [esi]
lea edx, [esp + 0x30]
push edx
push esi
mov dword [esp + 0x38], 0x7c
mov dword [esp + 0x3c], 6
call dword [ecx + 0x58]
mov al, byte [0x7538fd]
xor edi, edi
xor ebx, ebx
test al, al
js 0x47e7f7
mov esi, dword [0x7538c1]
test al, 2
je 0x47e7f7
mov edi, dword [0x7538ed]
mov ebx, dword [0x7538f1]
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [eax + 0x44]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x47e852
mov edx, dword [esp + 0xc4]
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xbc]
push 0xcc0020
push edx
mov edx, dword [esp + 0xc0]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x24]
push ebp
push eax
push ecx
push ebx
push edi
push edx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x68]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x9c
ret
pop edi
mov eax, 0x80004005
pop esi
add esp, 0x9c
ret

Function at 0x47e880
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push 0x2000
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.USER32.dll_LoadImageA]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x47e8d0
push 0x2010
push eax
push eax
push eax
push edi
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x47e8d0
push str.handle_is_null_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov eax, 0x80004005
pop ebx
ret
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
push esi
push eax
call fcn.0047e730
mov edi, eax
add esp, 0x18
test edi, edi
je 0x47e8f7
push str.ddcopybitmap_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4829a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [0x670d0c]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push edi
push ecx
push 0
mov esi, 4
push ebx
push edx
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4829e7
cmp dword [esp + 0x18], esi
jne 0x4829e7
cmp dword [esp + 0xc], esi
jne 0x4829e7
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x1c]
push esi
push ebx
call fcn.00482950
add esp, 8
mov dword [edi], esi
xor al, al
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x482a00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push esi
mov esi, dword [esp + 0x10]
lea ecx, [esp + 8]
push eax
mov eax, dword [0x670d0c]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push esi
push eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x482a56
cmp dword [esp + 0x10], 4
jne 0x482a56
cmp dword [esp + 4], 4
jne 0x482a56
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x14]
test eax, eax
setne cl
mov byte [edx], cl
mov al, 1
pop esi
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x1c]
push ebx
push esi
call fcn.00482970
mov eax, dword [esp + 0x20]
add esp, 8
mov byte [eax], bl
pop ebx
xor al, al
pop esi
add esp, 8
ret
Function at 0x48d330
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.WinRunCheck
push 2
call fcn.00499ec0
mov esi, dword [esp + 0x10]
add esp, 8
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x48d383
mov edx, dword [esp + 0xc]
push esi
push edx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x48d37f
push 0
push 0
push 6
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x499e50
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 4]
push 0x100000
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x49a034], eax
ret
Function at 0x49f18b
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x49f196
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
insb byte es:[edi], dx
jne 0x49f201
imul ebp, dword [esi + 0x5f], 0x78656c46
imul esp, dword [edx + 0x6c], 0x74615065
arpl word [eax + 0x65], bp
jb 0x49f1db
insb byte es:[edi], dx
insb byte es:[edi], dx
add al, ch
cli
jnp 0x49f1b5
add byte [eax - 0x2b752dcd], dl
mov dword [0x7e6db8], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x7e6db4], ecx
shl ecx, 8
add ecx, edx
mov dword [0x7e6db0], ecx
shr eax, 0x10
mov dword [0x7e6dac], eax
call 0x6df694f0
jle 0x49f1e2
push 1
call fcn.004a05f6
pop ecx
test eax, eax
jne 0x49f1f6
push 0x1c
call fcn.0049f2b8
pop ecx
call fcn.004a2ac0
test eax, eax
jne 0x49f207
push 0x10
call fcn.0049f2b8
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004a2904
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x8113e4], eax
call fcn.004a3826
mov dword [0x7e6d20], eax
call fcn.004a35d9
call fcn.004a3520
call fcn.004a2c2e
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004a34c8
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x49f256
movzx eax, word [ebp - 0x2c]
jmp 0x49f259
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004a2c5b
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004a2d4e
pop ecx
pop ecx
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d01c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x40d028
push 0x40d024
push 0x40d020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x40d028]
push dword [0x40d024]
push dword [0x40d020]
mov dword [0x40d014], esp
call fcn.00401a4d
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push str.error:__s_n
call fcn.0040909e
add esp, 8
push 0
call sub.CRTDLL.DLL_exit
add esp, 4
pop ebp
ret