joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3930
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b4ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00510c60
xor edi, edi
lea ecx, [esi + 0x58]
mov dword [ebp - 4], edi
call fcn.0055ae40
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 1
call fcn.0055ae40
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 2
call fcn.0055ae40
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 3
call fcn.0055ae40
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.0055ae40
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 5
call fcn.0055ae40
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 6
call fcn.0055ae40
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 7
call fcn.0055ae40
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 8
call fcn.0055ae40
lea ecx, [esi + 0xa0]
mov byte [ebp - 4], 9
call fcn.0055ae40
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 0xa
call fcn.0055ae40
push 0x70
mov byte [ebp - 4], 0xb
mov dword [esi], 0x593058
mov dword [esi + 0xf8], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0x124], 0xffffffff
mov dword [esi + 0xd8], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x128], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0x38], edi
call fcn.0050f560
add esp, 4
mov dword [ebp - 0x14], eax
cmp eax, edi
mov byte [ebp - 4], 0xc
je 0x4a3a5c
mov ecx, eax
call fcn.004aa7f0
jmp 0x4a3a5e
xor eax, eax
mov dword [esi + 0x48], eax
mov eax, 0x3ea8f5c3
push 0x50
mov byte [ebp - 4], 0xb
mov dword [esi + 0x50], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
call fcn.0050f560
mov dword [esi + 0x138], eax
mov eax, dword [esi + 0x14]
add esp, 4
or ah, 4
mov dword [esi + 0x100], 0xffffffff
mov dword [esi + 0x134], edi
push 0x1d1
mov dword [esi + 0x14], eax
call fcn.0050e090
add esp, 4
push eax
call fcn.005680c0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword [esi + 0xcc], eax
mov dword [esi + 0xf0], edi
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a6490
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x667cb8]
test eax, eax
je 0x4a64c4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x667cb8]
test eax, eax
je 0x4a64c4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
mov eax, dword [0x667cb8]
test eax, eax
jne 0x4a64b6
pop esi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4a6560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x710aa8]
push 6
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5affc0
call fcn.005585e0
mov ecx, dword [0x7106d0]
add esp, 4
mov edx, dword [ecx]
push 0
call dword [edx + 0xc]
mov eax, dword [0x710aa8]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov ecx, dword [0x710aa8]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [0x7106d0]
push 0
mov edx, dword [ecx]
call dword [edx + 0xc]
push 0x5affd8
call fcn.005585e0
add esp, 4
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
push eax
push str.CTRL___d
call fcn.005585e0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4a6940
Capabilities:
Create thread
Hide graphical window
Log keystrokes via polling
Terminate process

Disassembly:
mov ecx, dword [0x667c94]
jmp fcn.004a6490

Function at 0x4a6950
Capabilities:
Hide graphical window

Disassembly:
push 0x3c
push str.NAVBAR_line__d
call fcn.005585e0
mov eax, dword [0x710aa8]
add esp, 8
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.Minimize_requested...
call fcn.005585e0
mov ecx, dword [0x7106d0]
add esp, 4
mov edx, dword [ecx]
push 0
call dword [edx + 0xc]
push str.Return_from_minimize.
call fcn.005585e0
add esp, 4
ret
Function at 0x4ad3d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
xor ebx, ebx
xor ecx, ecx
fld dword [esi + 0x84]
mov eax, dword [esi + 0x80]
mov dword [ebp - 4], ecx
fsub qword [0x5937c8]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x9c]
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [esi + 0xac], ecx
fstp dword [ebp - 8]
jle 0x4ad50e
push edi
xor edi, edi
mov dword [ebp - 0x10], ecx
jmp 0x4ad41b
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x67b524]
mov eax, dword [edx + 0x20]
mov edx, dword [eax + ecx + 0x14]
add eax, ecx
test edx, edx
je 0x4ad43b
mov edx, dword [eax + 0x18]
test edx, edx
jne 0x4ad43b
inc dword [esi + 0xac]
mov edx, dword [0x67b524]
mov eax, dword [edx + 0x20]
add eax, ecx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4ad4e2
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x4ad4e2
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x74]
cmp ecx, eax
jge 0x4ad4e2
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0xa8]
cmp edx, eax
jl 0x4ad4cb
fld dword [esi + 0x8c]
fsub qword [0x5937d0]
mov eax, dword [esi + 0x88]
mov edx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 8]
fstp dword [esp]
push eax
push ecx
push edx
mov edx, dword [esi + 0x94]
mov ecx, edi
add ecx, edx
call fcn.004b0d80
mov eax, dword [esi + 0x94]
mov edx, dword [edi + eax]
lea ecx, [edi + eax]
call dword [edx + 0x38]
mov ecx, dword [esi + 0x78]
mov eax, dword [ebp - 4]
fld dword [ebp - 8]
mov dword [ecx + eax*4], ebx
inc eax
fadd dword [esi + 0x8c]
mov dword [ebp - 4], eax
fstp dword [ebp - 8]
jmp 0x4ad4ef
mov edx, dword [esi + 0x94]
mov eax, dword [ebp - 0xc]
inc eax
lea ecx, [edx + edi]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx]
call dword [eax + 0x3c]
jmp 0x4ad4ef
mov ecx, dword [esi + 0x94]
add ecx, edi
mov edx, dword [ecx]
call dword [edx + 0x3c]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x9c]
inc ebx
add edx, 0x1c
add edi, 0xb4
cmp ebx, eax
mov dword [ebp - 0x10], edx
jl 0x4ad418
pop edi
mov eax, dword [0x668398]
mov ecx, esi
mov dword [esi + 0xa4], eax
call fcn.004ad2f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6100
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c1a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push ebx
mov ebx, ecx
push esi
push edi
or ecx, 0xffffffff
mov edi, str.anim
xor eax, eax
lea edx, [ebp - 0x50]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xd0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x5b0640
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0xd0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x150]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
xor edi, edi
lea ecx, [ebp - 0xd0]
push edi
push 0x5b0648
lea edx, [ebp - 0x50]
push ecx
push edx
call fcn.005418b0
add esp, 0x14
test eax, eax
je 0x4b6272
lea eax, [ebp - 0xd0]
lea edx, [ebp - 0x150]
push eax
lea ecx, [ebx + 0x1c]
push edx
call fcn.004b7fc0
mov esi, eax
cmp esi, edi
mov dword [ebx + 0x2680], esi
je 0x4b6272
lea eax, [esi + esi*2]
shl eax, 4
add eax, 4
push eax
call fcn.0050f560
add esp, 4
mov dword [ebp - 0x10], eax
cmp eax, edi
mov dword [ebp - 4], edi
je 0x4b6222
push fcn.004b8280
push 0x4b8260
lea edi, [eax + 4]
push esi
push 0x30
push edi
mov dword [eax], esi
call fcn.00567040
mov eax, dword [ebx + 0x2680]
xor esi, esi
test eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebx + 0x30], edi
jle 0x4b6272
xor edi, edi
push esi
lea ecx, [ebx + 0x1c]
call fcn.004b8200
test eax, eax
je 0x4b6264
mov ecx, dword [ebx + 0x30]
push esi
push eax
add ecx, edi
call fcn.004b82e0
test eax, eax
je 0x4b6264
mov ecx, dword [ebx + 0x30]
add ecx, edi
push ecx
mov ecx, ebx
call fcn.00510de0
mov eax, dword [ebx + 0x2680]
inc esi
add edi, 0x30
cmp esi, eax
jl 0x4b623a
mov ecx, 0x6e28b0
call fcn.0050f050
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
lea ecx, [ebx + 0x34]
call fcn.004b67b0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b86a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c357
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
call fcn.004b8460
mov edi, dword [esi + 0x24]
test edi, edi
je 0x4b86d9
mov ecx, edi
call fcn.004baaa0
push edi
call fcn.0050f580
add esp, 4
push str.citychicago_anim_eltrain.csv
mov ecx, esi
mov dword [esi + 0x24], 0
call fcn.004b8380
test eax, eax
je 0x4b873c
push 0x100
call fcn.0050f560
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
mov dword [ebp - 4], 0
je 0x4b8714
mov ecx, eax
call fcn.004ba9b0
jmp 0x4b8716
xor eax, eax
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
push 0
push 1
push ecx
push edx
push 0
push str.vaboeing
push 0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x24], eax
call fcn.004bab10
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c2d50
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
lea eax, [ebp - 0x20]
push edi
push eax
mov dword [esi + 0xc0], 0x3f800000
mov dword [esi + 0xc4], 0x3f3cac08
mov dword [esi + 0xc8], 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x18]
cmp eax, 0x40
jb 0x4c2dc9
call fcn.004dcbb0
mov edi, eax
call fcn.004dcba0
or edi, eax
call fcn.004dcb90
or edi, eax
call fcn.004dcc00
or edi, eax
call fcn.004dcbf0
or edi, eax
call fcn.004dcbe0
or edi, eax
mov dword [esi + 0xd0], 0x20
mov dword [esi + 0xcc], edi
jmp 0x4c2e4a
cmp eax, 0x30
jb 0x4c2e0c
call fcn.004dcba0
mov edi, eax
call fcn.004dcbb0
not eax
and edi, eax
call fcn.004dcb90
or edi, eax
call fcn.004dcc00
or edi, eax
call fcn.004dcbf0
or edi, eax
call fcn.004dcbe0
or edi, eax
mov dword [esi + 0xd0], 0x10
mov dword [esi + 0xcc], edi
jmp 0x4c2e4a
call fcn.004dcb90
mov edi, eax
call fcn.004dcbb0
not eax
and edi, eax
call fcn.004dcba0
not eax
and edi, eax
call fcn.004dcc00
or edi, eax
call fcn.004dcbf0
or edi, eax
call fcn.004dcbe0
or edi, eax
mov dword [esi + 0xd0], 8
mov dword [esi + 0xcc], edi
mov ecx, 0x32
xor eax, eax
lea edi, [esi + 0xd4]
rep stosd dword es:[edi], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4c8000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
test ecx, ecx
push esi
jne 0x4c801a
or eax, 0xffffffff
mov dword [0x5b21c8], eax
not eax
pop esi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov eax, dword [0x5b21c8]
mov esi, edx
dec edx
test esi, esi
je 0x4c804a
lea esi, [edx + 1]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5b1dc8]
xor eax, edx
inc ecx
dec esi
jne 0x4c802c
mov dword [0x5b21c8], eax
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x4d7fc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov eax, ecx
push esi
shl eax, 0x10
cmp ecx, 0x80
push edi
jle 0x4d7fe0
and eax, 0xff7fffff
or eax, 0x1000000
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea esi, [ebx - 1]
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jne 0x4d8011
push esi
push str.Unknown
push edi
call fcn.00567210
add esp, 0xc
mov byte [ebx + edi - 1], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x4e3500
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
push edi
mov byte [ebp - 0xc7], 0x3a
mov byte [ebp - 0xc6], 0x5c
mov byte [ebp - 0xc5], 0
mov bl, 0x41
lea eax, [ebp - 0xc8]
mov byte [ebp - 0xc8], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x4e3581
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5b6574
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0xc8]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00540e70
add esp, 8
test eax, eax
jne 0x4e3593
inc bl
cmp bl, 0x5a
jbe 0x4e3523
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e4130
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x5949bc
push eax
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4e4201
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4e4201
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4e4201
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push esi
push ebx
push ecx
push eax
mov ecx, edi
call fcn.004e4eb0
test eax, eax
je 0x4e4201
mov edx, dword [edi + 0x84]
mov eax, dword [esi]
push 0x12
mov dword [edx + 8], eax
call fcn.0050f560
mov ecx, dword [edi + 0x84]
add esp, 4
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
push edx
call fcn.0050f560
mov ecx, dword [ebp + 0x10]
mov dword [edi], eax
mov eax, dword [edi + 0x84]
add esp, 4
mov edx, dword [ecx]
mov eax, dword [eax + 0x10]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov dx, word [edx + 0x10]
mov word [eax + 0x10], dx
mov ecx, dword [esi]
mov esi, dword [ebx]
mov edi, dword [edi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x14
Function at 0x50f370
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push esi
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
je 0x50f3a2
shl ecx, 2
mov edx, eax
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 4
neg eax
sbb eax, eax
push edx
and eax, 0x1000
add eax, 0x1000
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov dword [esi + 4], eax
call fcn.0050f440
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x542150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0
add eax, edi
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x542179
mov eax, dword [esi + 8]
sub eax, edi
mov ecx, dword [esi]
lea edx, [ebp + 0xc]
push 0
push edx
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x5570c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [str.Midtown_Madness_]
push 0x10
push eax
push 0x204
call fcn.0050e090
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x557180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea eax, [ebp - 4]
push 0
push eax
push 0
call sub.DDRAW.dll_DirectDrawCreate
test eax, eax
je 0x5571a1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x598158
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
mov eax, dword [ebp - 4]
je 0x5571c6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.005570c0
jmp 0x5571cc
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 8]
push 0x710b3c
push eax
call fcn.005572d0
add esp, 8
mov dword [0x710ac4], eax
mov eax, 1
mov dword [0x710ac8], 0
push 0x20c
mov dword [0x710ac0], eax
mov dword [0x710acc], 0xa6
mov dword [0x710ad0], 0
mov dword [0x710ad4], eax
mov dword [0x710ad8], eax
mov dword [0x710ae0], eax
mov dword [0x710b4c], 0
call fcn.0050e090
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x50
mov edx, ecx
mov esi, edi
mov edi, 0x710aec
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x710ac4]
mov dword [0x711790], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 2
jge 0x55727c
mov ecx, dword [ebp - 8]
push str.Primary_Display
push 0
push ecx
call fcn.005579b0
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
push 0
push 0x557f20
call fcn.00557110
mov eax, dword [0x711790]
add esp, 8
xor esi, esi
test eax, eax
jle 0x5572c5
mov edi, 0x710c54
mov eax, dword [0x7119a0]
push eax
push esi
call fcn.00556510
add esp, 8
mov dword [edi], eax
mov eax, dword [0x711790]
inc esi
add edi, 0x198
cmp esi, eax
jl 0x5572a4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5572d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push esi
mov esi, dword [ebp + 8]
push edi
push esi
xor edi, edi
call fcn.005573c0
add esp, 4
test eax, eax
jne 0x557378
mov eax, dword [esi]
push edi
push edi
push 0x10
push 0x1e0
push 0x280
push esi
call dword [eax + 0x54]
test eax, eax
jne 0x55735b
mov ecx, dword [esi]
push esi
call dword [ecx + 0x68]
test eax, eax
je 0x557343
mov edx, dword [esi]
push esi
call dword [edx + 0x4c]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword [str.Midtown_Madness_]
push edi
push ecx
push 0x207
call fcn.0050e090
add esp, 4
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x710ac0
push esi
call fcn.005574a0
mov edx, dword [esi]
add esp, 8
mov edi, eax
push esi
call dword [edx + 0x4c]
jmp 0x55736e
and eax, 0xffff
push eax
push str.CSW:_640x480x16_failed__hr_d.
call fcn.00558660
add esp, 8
mov eax, dword [esi]
push 8
push 0
push esi
call dword [eax + 0x50]
call fcn.00557480
mov ecx, dword [esi]
lea edx, [ebp - 0x428]
push 0
push edx
push esi
call dword [ecx + 0x6c]
test eax, eax
jne 0x5573aa
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
push edi
push str.CheckSoftwareRendeer___d
call fcn.005585e0
add esp, 8
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x558740
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x558754
push 0
call fcn.005697a0
add esp, 4
lea eax, [ebp + 8]
push eax
push 0x5ce01c
push 3
call dword [0x5cdf68]
add esp, 0xc
pop ebp
ret

Function at 0x558810
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x5cdf50], eax
je 0x558856
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Logging_output_to_file_
call esi
push edi
call esi
push 0x5ce044
call esi
pop esi
pop edi
pop ebp
ret
push str.OUTPUT_LOG_FILE_CREATE_FAILED._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop ebp
ret

Function at 0x559ff0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x55ce90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x55cea7
xor eax, eax
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 8]
lea edx, [ebp + 8]
push ecx
push edx
push 0
lea ecx, [ebp - 4]
push 0
lea edx, [ebp - 0x88]
push ecx
push edx
push eax
mov eax, dword [0x712584]
push eax
mov dword [ebp - 4], 0x80
mov dword [ebp - 8], 4
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x55e640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x14]
push edi
xor edi, edi
push eax
push 0xf003f
push edi
push str.System
push reloc.DSOUND.dll_DirectSoundEnumerateA
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call esi
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push ecx
push 0xf003f
push edi
push str.CurrentControlSet
push edx
call esi
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push edi
push str.Control
push ecx
call esi
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
push edx
push 0xf003f
push edi
push 0x5cef1c
push eax
call esi
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push edi
push 0x5cef2c
push edx
call esi
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x18]
push ecx
push edx
push edi
push str.ComputerName
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call esi
mov edx, dword [ebp - 8]
push edx
call esi
mov eax, dword [ebp - 0xc]
push eax
call esi
mov ecx, dword [ebp - 0x10]
push ecx
call esi
mov edx, dword [ebp - 0x14]
push edx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret