joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0200
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x5aa0d0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4a02a1
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4a0297
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4a0297
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x4a0297
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x4a0297
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x4a0297
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x4a0297
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x4a0297
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x4a0297
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x4a0297
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x4a0297
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4a0299
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401fc1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x406318
cmp edx, dword [eax]
je 0x401fe3
add eax, 8
inc ecx
cmp eax, 0x4063a8
jl 0x401fd4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x406318]
jne 0x402111
mov eax, dword [0x4084dc]
cmp eax, 1
je 0x4020eb
test eax, eax
jne 0x402014
cmp dword [0x40604c], 1
je 0x4020eb
cmp edx, 0xfc
je 0x402111
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40204b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004026f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004028a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40208e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004028a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4053b8
push edi
call fcn.00403f40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004026f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402700
lea eax, [ebp - 0xa0]
push 0x405398
push eax
call fcn.00402700
push dword [esi + 0x40631c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402700
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00403eb4
add esp, 0x2c
pop edi
jmp 0x402111
lea eax, [ebp + 8]
lea esi, [esi + 0x40631c]
push 0
push eax
push dword [esi]
call fcn.004028a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401520
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58f3e0
push 0x566724
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
wait
mov dword [ebp - 4], 0
xor ebx, ebx
cmp dword [0x6684a4], 1
sete bl
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x401567
inc dword [0x6e28c4]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
or eax, 0xffffffff
cmp dword [0x6684a4], eax
jne 0x4015d2
xor esi, esi
mov dword [ebp - 0x20], esi
push 0x14
call edi
test ax, ax
jge 0x401599
mov esi, 1
mov dword [ebp - 0x20], esi
mov eax, dword [0x5d3e90]
test eax, eax
je 0x401599
call eax
mov eax, dword [0x711b30]
test eax, eax
je 0x4015b6
mov ecx, 0x711ac8
call fcn.005590b0
mov ecx, 0x702478
call fcn.005590b0
mov ecx, dword [0x6f2a3c]
call fcn.00510200
test esi, esi
je 0x40156d
mov eax, dword [0x5d44a0]
test eax, eax
je 0x40156d
call eax
jmp 0x40156d
test ebx, ebx
je 0x4015dc
dec dword [0x6e28c4]
wait
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406b60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406bbd
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
push ecx
push edx
push eax
push eax
mov eax, dword [ebp - 4]
push str.EnableAutodial
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 8]
push edx
push str._EnableAutodial:__u
call fcn.005585e0
mov eax, dword [ebp - 8]
add esp, 8
test eax, eax
setne al
mov esp, ebp
pop ebp
ret

Function at 0x406f90
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
push 2
mov ecx, 0x60aca0
call fcn.00480860
mov eax, dword [0x710aa8]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 6
push eax
call esi
mov eax, dword [0x5c3d38]
mov ecx, dword [0x7106d0]
or al, 2
push 0
mov dword [0x5c3d38], eax
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [0x5c3d38]
push 0
and al, 0xfd
mov ecx, 0x60aca0
mov dword [0x5c3d38], eax
call fcn.00481840
mov edi, eax
mov eax, dword [0x710aa8]
push 9
push eax
call esi
mov ecx, dword [0x710aa8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x667c94]
call fcn.004a5e30
mov ecx, eax
call fcn.004a1740
test edi, edi
je 0x40703c
mov ecx, 0x60aca0
call fcn.004813f0
test eax, eax
je 0x40703c
push 0
mov ecx, ebx
call fcn.00409fa0
test eax, eax
je 0x40703c
mov ecx, ebx
call fcn.00406e20
mov eax, 1
pop edi
pop esi
pop ebx
ret
push str.mmInterface::Join_using_modem_connection_failed.
call fcn.00558640
add esp, 4
mov ecx, 0x60aca0
call fcn.00480a10
mov ecx, 0x60aca0
call fcn.004808c0
mov ecx, ebx
call fcn.00409d20
push 0
push 0xa
mov ecx, ebx
call fcn.004076c0
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x409fa0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push esi
mov ecx, 0x60aca0
call fcn.00482010
cmp eax, 1
jne 0x409fd9
push str.You_dont_have_the_host_city_installed.
call fcn.00558660
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
mov ecx, 0x60aca0
call fcn.00481fb0
cmp eax, 5
je 0x40a00b
push str.Multiplayer_versions_do_not_match.
call fcn.00558660
add esp, 4
mov ecx, 0x60aca0
call fcn.00481350
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push esi
mov ecx, 0x60aca0
call fcn.004821f0
test eax, eax
jne 0x40a031
mov ecx, 0x60aca0
call fcn.00481350
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
jne 0x40a03f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
mov ecx, 0x60aca0
push eax
call fcn.00481640
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, ebx
call fcn.0040ab30
lea ecx, [ebp - 0xc4]
push ecx
mov ecx, ebx
call fcn.0040a710
test eax, eax
je 0x40a12a
mov ecx, dword [0x66a80c]
call fcn.004c0320
lea esi, [eax + 0x2c]
lea eax, [ebp - 0x68]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40a0bb
test cl, cl
je 0x40a0b7
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40a0bb
add eax, 2
add esi, 2
test cl, cl
jne 0x40a097
xor eax, eax
jmp 0x40a0c0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40a12a
mov ecx, dword [0x66a80c]
lea eax, [ebp - 0x68]
push eax
call fcn.004c0250
lea ecx, [ebp - 0x68]
cmp eax, 0xffffffff
push ecx
je 0x40a16f
push 0x5a55ac
call fcn.00558640
mov ecx, dword [0x66a80c]
add esp, 8
lea edx, [ebp - 0x68]
push edx
call fcn.004c02d0
mov ecx, dword [0x66a80c]
call fcn.004c0320
lea edi, [eax + 0x2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x5d44b0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
mov ecx, ebx
call fcn.0040a4e0
test eax, eax
jne 0x40a161
mov ecx, 0x60aca0
call fcn.00481350
push 0
push 1
mov ecx, ebx
call fcn.004076c0
mov dword [ebx + 0x35794], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x5a55c0
call fcn.00558660
add esp, 8
mov ecx, 0x60aca0
call fcn.00481350
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40a1a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov eax, dword [ebx + 0x9c]
push edi
add eax, 0xbc
push eax
push ecx
mov ecx, 0x60aca0
call fcn.004821f0
test eax, eax
jne 0x40a1e1
mov ecx, 0x60aca0
call fcn.00481350
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
jne 0x40a1ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x10]
mov ecx, 0x60aca0
push edx
call fcn.00481640
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov ecx, ebx
mov dword [eax + 0xc], edx
call fcn.0040ab30
lea eax, [ebp - 0xc4]
mov ecx, ebx
push eax
call fcn.0040a710
test eax, eax
je 0x40a2da
mov ecx, dword [0x66a80c]
call fcn.004c0320
lea esi, [eax + 0x2c]
lea eax, [ebp - 0x68]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40a26b
test cl, cl
je 0x40a267
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40a26b
add eax, 2
add esi, 2
test cl, cl
jne 0x40a247
xor eax, eax
jmp 0x40a270
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40a2da
mov ecx, dword [0x66a80c]
lea eax, [ebp - 0x68]
push eax
call fcn.004c0250
lea ecx, [ebp - 0x68]
cmp eax, 0xffffffff
push ecx
je 0x40a31f
push 0x5a55d8
call fcn.00558640
mov ecx, dword [0x66a80c]
add esp, 8
lea edx, [ebp - 0x68]
push edx
call fcn.004c02d0
mov ecx, dword [0x66a80c]
call fcn.004c0320
lea edi, [eax + 0x2c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x5d44b0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
mov ecx, ebx
call fcn.0040a4e0
test eax, eax
jne 0x40a311
mov ecx, 0x60aca0
call fcn.00481350
push 0
push 1
mov ecx, ebx
call fcn.004076c0
mov dword [ebx + 0x35794], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x5a55ec
call fcn.00558660
add esp, 8
mov ecx, 0x60aca0
call fcn.00481350
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40abf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push esi
lea eax, [ebp - 0x10]
push edi
mov esi, ecx
push eax
call fcn.0040ad70
mov eax, dword [0x6683bc]
cmp eax, 4
ja case.default.0x40ac10
jmp dword [eax*4 + 0x40ad5c]
lea ecx, [ebp - 0x50]
push ecx
push 4
jmp 0x40ac3d
lea edx, [ebp - 0x50]
push edx
push 3
jmp 0x40ac3d
lea eax, [ebp - 0x50]
push eax
push 5
jmp 0x40ac3d
lea ecx, [ebp - 0x50]
push ecx
push 2
jmp 0x40ac3d
lea edx, [ebp - 0x50]
push edx
push 1
mov ecx, esi
call fcn.00408760
mov ecx, dword [0x66a80c]
call fcn.004c0320
mov ecx, dword [esi + 0x38]
add eax, 0x2c
push eax
lea eax, [ebp - 0x50]
add ecx, 0x8c
push eax
push ecx
lea edx, [ebp - 0x150]
push str._s:__s_s
push edx
call fcn.00566480
mov eax, dword [esi + 0x38]
add esp, 0x14
mov eax, dword [eax + 0x118]
cmp eax, 0x67
jne 0x40acab
mov edx, dword [esi + 0x50]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x150]
mov eax, dword [edx + 0xa0]
inc eax
push eax
push 0
push ecx
mov ecx, 0x60aca0
call fcn.00481030
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x68
jne 0x40ad2c
mov edx, dword [0x710aa8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 6
push edx
call edi
mov eax, dword [0x5c3d38]
mov ecx, dword [0x7106d0]
or al, 2
push 0
mov dword [0x5c3d38], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [0x5c3d38]
and ecx, 0xfffffffd
mov dword [0x5c3d38], ecx
mov edx, dword [esi + 0x50]
lea ecx, [ebp - 0x10]
mov eax, dword [edx + 0xa0]
push ecx
inc eax
lea ecx, [ebp - 0x150]
push eax
push 0
push ecx
mov ecx, 0x60aca0
call fcn.00481030
mov edx, dword [0x710aa8]
push 9
push edx
mov esi, eax
call edi
mov eax, dword [0x710aa8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 0x50]
lea ecx, [ebp - 0x10]
push ecx
lea eax, [ebp - 0x150]
mov edx, dword [esi + 0xa0]
add esi, 0xc4
inc edx
mov ecx, 0x60aca0
push edx
push esi
push eax
call fcn.00481030
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x483cb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
mov dword [ebp - 4], ecx
push str.mmCullCity_bangers
call fcn.0055a480
mov esi, dword [0x60b12c]
add esp, 4
push 0x3e4ccccd
push 0xd
call fcn.0050e090
add esp, 4
mov ecx, esi
push eax
call fcn.00482800
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
push str.city__s.bng
push ecx
call fcn.00566480
add esp, 0xc
lea edx, [ebp - 0x40]
push 0x5ad778
push edx
call fcn.00540e70
mov esi, eax
add esp, 8
test esi, esi
je 0x483db3
push ebx
lea eax, [ebp + 8]
push 4
push eax
mov ecx, esi
call fcn.00540540
mov ecx, dword [ebp + 8]
push ecx
push str.__d_bangers_in_city
call fcn.005585e0
mov eax, dword [ebp + 8]
add esp, 8
xor ebx, ebx
test eax, eax
jle 0x483daa
push edi
lea edx, [ebp - 0x20]
push 0x1c
push edx
mov ecx, esi
lea edi, [ebp - 0x60]
call fcn.00540540
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
cmp ecx, eax
jge 0x483d65
mov edx, dword [esi + 4]
xor eax, eax
mov al, byte [edx + ecx]
inc ecx
mov dword [esi + 0xc], ecx
jmp 0x483d6c
mov ecx, esi
call fcn.00540780
mov byte [edi], al
inc edi
test al, al
jne 0x483d4d
mov edx, dword [ebp - 0x1e]
push 0
lea eax, [ebp - 0x10]
push 0
lea ecx, [ebp - 0x1c]
push eax
push ecx
mov ecx, dword [ebp - 0x20]
and edx, 0xffff
lea eax, [ebp - 0x60]
push edx
push 0
and ecx, 0xffff
push eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.004832b0
mov eax, dword [ebp + 8]
inc ebx
cmp ebx, eax
jl 0x483d3d
pop edi
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
pop ebx
call fcn.0055a510
mov ecx, dword [0x60b12c]
push 0x3eae147b
call fcn.00482880
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x483dd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
mov dword [ebp - 4], ecx
push str.mmCullCity_facades
call fcn.0055a480
mov esi, dword [0x60b12c]
add esp, 4
push 0
push 0xe
call fcn.0050e090
add esp, 4
mov ecx, esi
push eax
call fcn.00482800
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24]
push eax
push str.city__s.fcd
push ecx
call fcn.00566480
add esp, 0xc
lea edx, [ebp - 0x24]
push 0x5ad7b8
push edx
call fcn.00540e70
mov esi, eax
add esp, 8
test esi, esi
je 0x483ec2
push ebx
lea eax, [ebp + 8]
push 4
push eax
mov ecx, esi
call fcn.00540540
mov eax, dword [ebp + 8]
xor ebx, ebx
test eax, eax
jle 0x483eb9
push edi
lea ecx, [ebp - 0x70]
push 0x2c
push ecx
mov ecx, esi
lea edi, [ebp - 0x44]
call fcn.00540540
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
cmp ecx, eax
jge 0x483e71
mov edx, dword [esi + 4]
xor eax, eax
mov al, byte [edx + ecx]
inc ecx
mov dword [esi + 0xc], ecx
jmp 0x483e78
mov ecx, esi
call fcn.00540780
mov byte [edi], al
inc edi
test al, al
jne 0x483e59
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x54]
push eax
push ecx
mov ecx, dword [ebp - 0x6e]
lea edx, [ebp - 0x60]
lea eax, [ebp - 0x6c]
push edx
push eax
mov eax, dword [ebp - 0x70]
and ecx, 0xffff
lea edx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp - 4]
push 0
and eax, 0xffff
push edx
push eax
call fcn.004832b0
mov eax, dword [ebp + 8]
inc ebx
cmp ebx, eax
jl 0x483e49
pop edi
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
pop ebx
call fcn.0055a510
mov ecx, dword [0x60b12c]
push 0x3f1c28f6
call fcn.00482880
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48e130
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 8]
push ebx
push esi
cmp ecx, 0xffffffff
push edi
jne 0x48e147
mov ecx, dword [0x5cd880]
mov edx, dword [ebp + 0xc]
cmp edx, 0xffffffff
jne 0x48e160
mov eax, ecx
shl eax, 4
add eax, ecx
lea eax, [eax + eax*2]
mov edx, dword [eax*8 + 0x710c54]
mov eax, ecx
xor edi, edi
shl eax, 4
add eax, ecx
lea esi, [eax + eax*2]
shl esi, 3
mov ebx, dword [esi + 0x710b4c]
cmp ebx, edi
je 0x48e18f
mov eax, dword [0x7119a0]
mov dword [0x5b8688], 2
cmp eax, 0x122
jge 0x48e199
mov dword [0x5b8688], 1
mov eax, ecx
shl eax, 4
add eax, ecx
lea ecx, [edx + eax*2]
add eax, ecx
shl eax, 3
cmp ebx, edi
mov ecx, dword [eax + 0x710b54]
je 0x48e1e7
cmp ecx, 0x400000
jbe 0x48e1c6
mov dword [0x5b8684], 2
jmp 0x48e1d6
mov edx, 0x100000
cmp edx, ecx
sbb eax, eax
neg eax
mov dword [0x5b8684], eax
test byte [esi + 0x710ae8], 2
je 0x48e1fb
mov dword [0x5b8684], edi
jmp 0x48e1fb
cmp word [eax + 0x710b50], 0x200
sbb ecx, ecx
add ecx, 2
mov dword [0x5b8684], ecx
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x20
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x3c00000
jae 0x48e22a
mov eax, dword [0x5d3e64]
mov dword [0x668680], 1
cmp eax, edi
je 0x48e230
mov dword [0x668680], edi
mov eax, dword [0x5b8684]
cmp eax, 1
jle 0x48e24c
cmp ecx, 0x4600000
jae 0x48e24c
mov eax, 1
mov dword [0x5b8684], eax
cmp eax, edi
jle 0x48e25f
cmp ecx, 0x2800000
jae 0x48e25f
xor eax, eax
mov dword [0x5b8684], eax
mov edi, dword [0x7119a0]
cmp ecx, 0x2800000
mov dword [0x667b34], eax
jae 0x48e285
test ebx, ebx
jne 0x48e285
cmp edi, 0xd2
jge 0x48e285
mov ecx, 1
jmp 0x48e287
xor ecx, ecx
xor eax, eax
mov dword [0x5b867c], 1
test ecx, ecx
sete al
cmp edi, 0x154
mov dword [0x5b8670], eax
jle 0x48e2b5
test ebx, ebx
je 0x48e2b5
mov dword [0x5b868c], 0x447a0000
jmp 0x48e2d1
cmp edi, 0xd2
mov dword [0x5b868c], 0x44160000
jg 0x48e2d1
mov dword [0x5b868c], 0x43960000
mov edx, dword [esi + 0x710ae8]
and edx, 2
je 0x48e2f9
fld dword [0x5b868c]
fcomp dword [0x5921f4]
fnstsw ax
test ah, 0x41
jne 0x48e2f9
mov dword [0x5b868c], 0x43e10000
xor eax, eax
cmp dword [0x7125c8], eax
setne al
inc eax
mov dword [0x5b8680], eax
xor eax, eax
fild dword [0x5b8680]
cmp ecx, eax
fstp dword [0x667b18]
je 0x48e326
mov dword [0x667b18], eax
mov dword [0x5b8688], eax
cmp edi, 0xaa
jle 0x48e348
cmp ebx, eax
je 0x48e348
cmp dword [esi + 0x710ad0], eax
je 0x48e348
cmp edx, eax
mov dword [0x5b8674], 1
je 0x48e34d
mov dword [0x5b8674], eax
cmp edi, 0xaa
jle 0x48e36d
cmp ebx, eax
je 0x48e36d
mov ecx, dword [esi + 0x710ad4]
mov dword [0x5b8678], 1
cmp ecx, eax
jne 0x48e372
mov dword [0x5b8678], eax
xor ecx, ecx
cmp edi, 0xaa
setl cl
pop edi
pop esi
mov dword [0x66867c], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0xc]
not ecx
sub edi, ecx
push eax
mov edx, ecx
mov esi, edi
mov edi, ebx
push 0xf003f
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push str.SoftwareMicrosoftMicrosoft_GamesMidtown_Madness1.0
rep movsb byte es:[edi], byte [esi]
push reloc.DSOUND.dll_DirectSoundEnumerateA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48f21e
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push eax
mov eax, dword [ebp + 0xc]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c300
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
mov esi, ecx
mov ecx, dword [0x66a80c]
call fcn.004c0320
add eax, 4
push eax
push str.City___s
call fcn.005585e0
mov ecx, dword [0x66a80c]
add esp, 8
call fcn.004c0320
add eax, 0x54
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00566480
mov ecx, dword [0x66a80c]
add esp, 8
call fcn.004c0320
mov ecx, dword [eax + 0x90]
test ecx, ecx
je 0x49c389
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x60]
push ecx
push str._smmracedata
push edx
call fcn.00566480
add esp, 0xc
lea eax, [ebp - 0x60]
lea ecx, [esi + 0x140]
push eax
call fcn.004c6130
mov ecx, dword [esi + 0x110]
mov ecx, dword [ecx + 8]
call fcn.004abb10
jmp 0x49c3aa
mov edx, dword [esi + 0x110]
mov ecx, dword [edx + 8]
call fcn.004abaf0
cmp dword [esi + 0x90], 2
jne 0x49c3aa
mov dword [esi + 0x90], 3
mov ecx, dword [0x66a80c]
call fcn.004c0320
mov ecx, dword [eax + 0x94]
test ecx, ecx
je 0x49c3f3
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x60]
push eax
push str._smmcircuitdata
push ecx
call fcn.00566480
add esp, 0xc
lea edx, [ebp - 0x60]
lea ecx, [esi + 0xaa8]
push edx
call fcn.004c6130
mov eax, dword [esi + 0x110]
mov ecx, dword [eax + 4]
call fcn.004abb10
jmp 0x49c414
mov ecx, dword [esi + 0x110]
mov ecx, dword [ecx + 4]
call fcn.004abaf0
cmp dword [esi + 0x90], 1
jne 0x49c414
mov dword [esi + 0x90], 3
mov ecx, dword [0x66a80c]
call fcn.004c0320
mov ecx, dword [eax + 0x8c]
test ecx, ecx
je 0x49c45c
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x60]
push edx
push str._smmblitzdata
push eax
call fcn.00566480
add esp, 0xc
lea ecx, [ebp - 0x60]
push ecx
lea ecx, [esi + 0x5f4]
call fcn.004c6130
mov edx, dword [esi + 0x110]
mov ecx, dword [edx]
call fcn.004abb10
jmp 0x49c47d
mov eax, dword [esi + 0x110]
mov ecx, dword [eax]
call fcn.004abaf0
mov eax, dword [esi + 0x90]
test eax, eax
jne 0x49c47d
mov dword [esi + 0x90], 3
push 0
lea ecx, [esi + 0xec]
call fcn.0055adb0
mov ecx, esi
call fcn.0049c4a0
pop esi
mov esp, ebp
pop ebp
ret