joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a2fa0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.0059d8e0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x5a2fef
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x5a2fef
mov edx, dword [sym.imp.MSVCRT.dll__iob]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
add edx, 0x40
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vfprintf]
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x104]
push 0xff
push edx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x5a30f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x5a30ae
lea eax, [ebp - 4]
push eax
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x5a30ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x5a30ae
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x5a30ae
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.0059d8e0
lea ecx, [ebp - 4]
mov edi, esp
push ecx
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x5a30ae
mov edx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [edx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
je 0x5a30f3
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea ecx, [ebp - 4]
push 0
push ecx
push 0
push 1
push 0
push 0
mov esi, eax
push 0
lea eax, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea edx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5dd790
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x5dd806
test edi, edi
je 0x5dd7ac
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call dword [sym.imp.MSVCRT.dll__errno]
mov edx, 0x4000
mov ecx, edi
mov dword [eax], 0
mov eax, dword [esi + 0x40]
sar edx, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push edx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
jne 0x5dd7eb
mov ecx, dword [esi + 0x40]
test byte [ecx + 0xc], 0x20
je 0x5dd7eb
mov dword [esi + 0x38], 0xffffffff
mov edx, dword [esi + 4]
add edx, eax
mov dword [esi + 4], edx
mov eax, edx
mov edx, dword [esi + 0x44]
cmp eax, 2
mov dword [esi], edx
jae 0x5dd806
mov dword [esi + 0x58], eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi]
mov edx, dword [0x639cb8]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, edx
jne 0x5dd922
mov ecx, dword [0x639cbc]
xor edx, edx
mov dl, byte [eax + 1]
cmp edx, ecx
jne 0x5dd922
mov ecx, dword [esi + 4]
add eax, 2
add ecx, 0xfffffffe
push esi
mov dword [esi + 4], ecx
mov dword [esi], eax
call fcn.005dd930
push esi
mov edi, eax
call fcn.005dd930
add esp, 8
cmp edi, 8
mov ebx, eax
jne 0x5dd917
test bl, 0xe0
jne 0x5dd917
mov edi, 6
push esi
call fcn.005dd930
add esp, 4
dec edi
jne 0x5dd865
test bl, 4
je 0x5dd8a8
push esi
call fcn.005dd930
push esi
mov edi, eax
call fcn.005dd930
shl eax, 8
add edi, eax
add esp, 8
mov eax, edi
dec edi
test eax, eax
je 0x5dd8a8
push esi
call fcn.005dd930
add esp, 4
cmp eax, 0xffffffff
je 0x5dd8a8
mov ecx, edi
dec edi
test ecx, ecx
jne 0x5dd893
test bl, 8
je 0x5dd8cc
push esi
call fcn.005dd930
add esp, 4
test eax, eax
je 0x5dd8cc
cmp eax, 0xffffffff
je 0x5dd8cc
push esi
call fcn.005dd930
add esp, 4
test eax, eax
jne 0x5dd8ba
test bl, 0x10
je 0x5dd8f0
push esi
call fcn.005dd930
add esp, 4
test eax, eax
je 0x5dd8f0
cmp eax, 0xffffffff
je 0x5dd8f0
push esi
call fcn.005dd930
add esp, 4
test eax, eax
jne 0x5dd8de
test bl, 2
je 0x5dd906
mov edi, 2
push esi
call fcn.005dd930
add esp, 4
dec edi
jne 0x5dd8fa
mov edx, dword [esi + 0x3c]
pop edi
neg edx
sbb edx, edx
and edx, 0xfffffffd
mov dword [esi + 0x38], edx
pop esi
pop ebx
ret
mov dword [esi + 0x38], 0xfffffffd
pop edi
pop esi
pop ebx
ret
mov dword [esi + 0x58], 1
pop edi
pop esi
pop ebx
ret
Function at 0x5dd930
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5dd941
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
jne 0x5dd990
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x5dd98b
mov edx, dword [esi + 0x40]
mov dword [esi + 0x3c], 1
or eax, 0xffffffff
test byte [edx + 0xc], 0x20
je 0x5dd9a2
mov dword [esi + 0x38], eax
pop esi
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi + 4]
xor ecx, ecx
dec eax
mov dword [esi + 4], eax
mov eax, dword [esi]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
mov eax, ecx
pop esi
ret
Function at 0x5ddd10
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x5dddd7
cmp byte [esi + 0x5c], 0x77
jne 0x5dddd7
mov ebp, dword [esp + 0x18]
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x10]
mov edi, 0x4000
sub edi, eax
je 0x5ddd64
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x5dddbb
mov edx, dword [esi + 0x48]
mov dword [esi + 0x10], 0x4000
mov dword [esi + 0xc], edx
test ebx, ebx
jne 0x5dddc6
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x68]
add ecx, eax
push ebp
push esi
mov dword [esi + 0x68], ecx
call fcn.005ded50
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x68]
add esp, 8
sub ebx, ecx
test edi, edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x68], ebx
jne 0x5ddd97
cmp eax, 0xfffffffb
jne 0x5ddd97
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x5ddda5
cmp dword [esi + 0x38], 1
je 0x5ddda5
xor ebx, ebx
jmp 0x5dddaa
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x5ddd33
cmp eax, 1
jne 0x5dddc6
jmp 0x5ddd33
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebp
pop ebx
ret
mov esi, dword [esi + 0x38]
pop edi
mov eax, esi
dec eax
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x4018f0
Capabilities:
Create thread

Disassembly:
sub esp, 0x20
mov ecx, 0x10
xor eax, eax
push ebx
push edi
mov edi, 0x43cd18
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x401916
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
mov ebx, dword [sym.imp.ole32.dll_CoCreateInstance]
push 0x43cd1c
push 0x4302e8
push 3
push 0
push 0x42ff48
call ebx
test eax, eax
jge 0x40193d
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [0x43cd1c]
push 0
push 0
push 0x43cd18
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jge 0x40195d
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x43cd38], eax
jne 0x40197a
pop edi
pop ebx
add esp, 0x20
ret
push 0x43cd40
push 0
push 0x43cd18
push 0x401fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x43cd3c], eax
jne 0x4019a4
pop edi
pop ebx
add esp, 0x20
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x43cd1c]
mov ecx, dword [0x43cd38]
push 0
push 0
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x50]
test eax, eax
jge 0x4019cd
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [0x43cd1c]
push 0x4300a8
push eax
mov edx, dword [eax]
call dword [edx + 0x58]
test eax, eax
jge 0x4019e9
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor eax, eax
lea edi, [esp + 8]
push 0
rep stosd dword es:[edi], eax
mov eax, dword [0x43cd18]
lea edx, [esp + 0xc]
push 0x43cd24
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x28], 1
mov dword [0x43cd48], 1
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], 0x22
mov ecx, dword [eax]
push edx
push 0x42e3c8
push eax
call dword [ecx + 0x14]
test eax, eax
jge 0x401a48
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [0x43cd24]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jge 0x401a61
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [0x43cd1c]
mov ecx, dword [0x43cd24]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x60]
test eax, eax
jge 0x401a7f
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [0x43cd1c]
mov ecx, dword [0x43cd24]
push 1
push ecx
mov edx, dword [eax]
push 0
push eax
call dword [edx + 0x68]
test eax, eax
jge 0x401aa1
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
push 0x43cd28
push 0x430288
push 3
push 0
push 0x430048
call ebx
test eax, eax
jge 0x401ac2
pop edi
xor eax, eax
pop ebx
add esp, 0x20
ret
mov edx, dword [esp + 0x2c]
pop edi
mov dword [0x43cd34], edx
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x402490
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
mov cl, byte [eax]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x120]
or cl, byte [edi]
jne 0x4024b8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
lea edx, [esp + 0x14]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00407600
mov ebx, dword [esp + 0x12c]
add esp, 8
xor eax, eax
test ebx, 0x80000000
je 0x4024e8
mov eax, 1
push 0
push 0x80
push 3
push 0
push eax
lea ecx, [esp + 0x28]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402577
mov edi, dword [esp + 0x128]
test edi, edi
je 0x40253b
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x40253b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x108
ret
mov edi, dword [esp + 0x12c]
test edi, edi
je 0x40256a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x40256a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
push 0x5c
push edi
call fcn.00421eb0
add esp, 8
test eax, eax
je 0x402589
lea edi, [eax + 1]
mov al, byte [0x459958]
test al, al
je 0x4025f3
mov ebp, dword [esp + 0x12c]
mov esi, 0x459958
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x11c]
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x14]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [esp + 0x128]
push 0
push ebp
push edx
push ebx
lea eax, [esp + 0x24]
push edi
push eax
call fcn.00428520
add esp, 0x18
cmp eax, 0xffffffff
jne 0x4025f6
mov esi, dword [esp + 0x10]
add esi, 0x104
mov dword [esp + 0x10], esi
cmp byte [esi], 0
jne 0x4025a2
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x402d00
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
mov cl, byte [eax]
push esi
mov esi, dword [esp + 0x114]
or cl, byte [esi]
jne 0x402d22
xor eax, eax
pop esi
add esp, 0x108
ret
lea edx, [esp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 8]
push esi
push eax
call fcn.00407600
add esp, 8
lea ecx, [esp + 8]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402d6a
xor eax, eax
pop esi
add esp, 0x108
ret
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
lea edx, [esp + 4]
push 0
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402d94
pop esi
add esp, 0x108
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x108
ret
Function at 0x402f50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x10c]
lea eax, [esp]
push edx
push eax
call fcn.00407600
add esp, 8
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
add esp, 0x104
ret

Function at 0x403140
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
call fcn.00421fb9
and eax, 0x800000ff
jns 0x403157
dec eax
or eax, 0xffffff00
inc eax
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
test edi, edi
jle 0x403182
push ebx
mov cl, byte [edx]
mov ebx, ecx
xor cl, al
and ebx, 0xff
xor cl, 0xf4
xor ebx, 0xd3
mov byte [edx], cl
add esi, ebx
inc edx
dec edi
jne 0x403164
pop ebx
xor al, 0xb1
xor esi, 0x4bc57d21
mov byte [edx], al
mov dword [edx + 4], esi
pop edi
pop esi
ret

Function at 0x4031a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
mov dl, byte [ecx + edi]
xor dl, 0xb1
test edi, edi
jle 0x4031ce
mov al, byte [ecx]
xor al, dl
xor al, 0xf4
mov byte [ecx], al
and eax, 0xff
xor eax, 0xd3
add esi, eax
inc ecx
dec edi
jne 0x4031b6
mov edx, dword [ecx + 4]
xor esi, 0x4bc57d21
xor eax, eax
cmp esi, edx
pop edi
pop esi
sete al
ret

Function at 0x403420
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x158
mov cl, byte [eax]
push esi
mov esi, dword [esp + 0x164]
or cl, byte [esi]
jne 0x403442
xor eax, eax
pop esi
add esp, 0x158
ret
push edi
lea edx, [esp + 0x5c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x5c]
push esi
push eax
call fcn.00407600
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 8
lea ecx, [esp + 0x5c]
push 0x4320f4
push ecx
call esi
mov edx, dword [esp + 0x16c]
lea eax, [esp + 0x5c]
push edx
push eax
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x18]
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0x44
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [esp + 0x30], ecx
push ecx
lea ecx, [esp + 0x7c]
push ecx
push 0
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x158
ret
Function at 0x403e90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 0x3a
push 0x5680a0
call fcn.00421ef0
mov esi, dword [esp + 0x128]
mov edi, dword [esp + 0x124]
mov ebx, dword [esp + 0x120]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 8
test eax, eax
je 0x403ed6
push 0x5680a0
push esi
push edi
push ebx
call ebp
cmp eax, esi
jne 0x403f11
mov al, byte [0x5ae62c]
test al, al
je 0x403f0f
lea eax, [esp + 0x10]
push 0x5ae62c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push 0x5680a0
push ecx
call fcn.00407600
add esp, 8
lea edx, [esp + 0x10]
push edx
push esi
push edi
push ebx
call ebp
cmp eax, esi
jne 0x403f11
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x403f20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push 0x3a
push 0x5680a0
call fcn.00421ef0
mov edi, dword [esp + 0x12c]
mov esi, dword [esp + 0x128]
mov ebx, dword [esp + 0x124]
mov ebp, dword [esp + 0x120]
add esp, 8
test eax, eax
je 0x403f71
push 0x5680a0
push edi
push esi
push 0x43cd9c
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x403fb9
mov al, byte [0x5ae62c]
test al, al
je 0x403fb4
lea eax, [esp + 0x10]
push 0x5ae62c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push 0x5680a0
push ecx
call fcn.00407600
add esp, 8
lea edx, [esp + 0x10]
push edx
push edi
push esi
push 0x43cd9c
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x403fb9
mov byte [esi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x404070
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push 0x104
push ecx
push 0x43cd9c
push edx
push 0x4320f8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret
Function at 0x4048b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x456a0c]
sub esp, 0x110
test al, al
je 0x40494d
push 0x456a0c
lea eax, [esp + 0x10]
push 0x432218
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp]
lea edx, [esp + 0xc]
push ecx
push 0x20019
push 0
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40494d
mov edx, dword [esp]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push 0x5ae424
push ecx
push 0
push str.InstPath
push edx
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404942
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x110
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x110
ret
Function at 0x404960
Capabilities:
Get common file path
Get disk information

Disassembly:
sub esp, 0x244
push ebx
push ebp
push esi
push edi
push 0x456b10
call fcn.00407730
call fcn.004048b0
push 0x43cd9c
push 0x5ae424
call fcn.00407600
add esp, 0xc
push 0x5ae528
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x43cd9c
push 0x5ae528
call fcn.00407600
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 8
push str.autoexec.scn
push 0x5ae730
call ebx
push 0x5ae730
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
js 0x4049f5
mov cl, 0x5c
cmp byte [eax + 0x5ae730], cl
je 0x4049f1
mov byte [eax + 0x5ae730], 0
dec eax
jns 0x4049cf
lea eax, [eax + 0x4342f1]
push eax
push str.autoexec.scn
call ebx
jmp 0x404a0c
test eax, eax
jge 0x404a05
lea eax, [eax + 0x4342f1]
push eax
push str.autoexec.scn
call ebx
jmp 0x404a0c
mov byte [eax + 0x5ae730], 0
mov al, byte [0x5ae730]
test al, al
je 0x404a27
push 0x43cd9c
push 0x5ae730
call fcn.00407600
add esp, 8
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov byte [0x4343f4], 0x41
push 0x4343f4
lea ecx, [esp + 0x14]
push 0x432234
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call ebp
cmp eax, 5
jne 0x404a8d
push 0x5aeb44
push 0x4343f4
lea eax, [esp + 0x18]
push 0x43222c
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x114]
lea edx, [esp + 0x10]
push ecx
push edx
call edi
cmp eax, 0xffffffff
jne 0x404a9f
mov al, byte [0x4343f4]
inc al
cmp al, 0x5a
mov byte [0x4343f4], al
jle 0x404a40
jmp 0x404aaf
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [0x4343f4], 0x5a
jle 0x404adf
push 0x4343f4
mov byte [0x4343f4], 0x51
call fcn.00429140
add esp, 4
test eax, eax
jne 0x404ad3
mov dword [0x5ae41c], eax
mov byte [0x4343f4], al
jmp 0x404b06
mov dword [0x5ae41c], 1
jmp 0x404af6
push 0x4343f4
mov dword [0x5ae41c], 1
call fcn.00429140
add esp, 4
push 0x432228
push 0x4343f4
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x104
push 0x5ae838
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x43cd9c
push 0x5ae838
call fcn.00407600
add esp, 8
push 0x5ae93c
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x43cd9c
push 0x5ae93c
call fcn.00407600
push 0x43cd9c
push 0x5aea40
call fcn.00407600
add esp, 0x10
push str.20000823
push 0x43c793
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x244
ret
Function at 0x404bc0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call fcn.00404960
mov eax, dword [0x5ae3f8]
xor esi, esi
cmp eax, esi
je 0x404be9
call fcn.00404840
test eax, eax
jne 0x404be9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x43c79b], 0x20
call fcn.00404b70
test eax, eax
jne 0x404c00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x434440], esi
je 0x404c12
call fcn.00401080
mov dword [0x434440], eax
xor edi, edi
push edi
call fcn.00418860
add esp, 4
inc edi
cmp edi, 0x12
jl 0x404c14
mov ecx, 0x3e8
xor eax, eax
mov edi, 0x469d58
mov dword [0x4560d0], esi
rep stosd dword es:[edi], eax
mov ecx, 0x3e8
mov edi, 0x564cf8
rep stosd dword es:[edi], eax
mov ecx, 0xfa
mov edi, 0x457550
rep stosd dword es:[edi], eax
mov ecx, 0x3e800
mov edi, 0x46acf8
rep stosd dword es:[edi], eax
mov ecx, 0x101
mov edi, 0x5681ac
rep stosd dword es:[edi], eax
mov ecx, 0x101
mov edi, 0x567c98
rep stosd dword es:[edi], eax
mov ecx, pe_nt_image_headers32
mov edi, 0x456100
rep stosd dword es:[edi], eax
mov eax, 0x456d34
or ecx, 0xffffffff
mov dword [eax - 4], esi
mov dword [eax], ecx
add eax, 8
cmp eax, 0x457534
jl 0x404c87
mov eax, 0x458d44
mov dword [eax - 4], esi
mov dword [eax], esi
mov dword [eax + 4], ecx
add eax, 0xc
cmp eax, 0x459944
jl 0x404c9b
mov ecx, pe_nt_image_headers32
xor eax, eax
mov edi, 0x456500
mov dword [0x5af1c8], eax
rep stosd dword es:[edi], eax
mov dword [0x5af1cc], eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
shl ecx, 0x20
or ecx, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ecx
fild qword [ebp - 8]
fmul qword [0x42e3b8]
fst qword [0x5af1c8]
fcomp qword [0x42e3b0]
fnstsw ax
test ah, 0x40
jne 0x404d7b
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
lea edx, [ebp - 0x10]
mov ebx, eax
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call edi
sub eax, ebx
cmp eax, 0x1f4
jae 0x404d26
call edi
sub eax, ebx
cmp eax, 0x1f4
jb 0x404d1b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ecx
fild qword [ebp - 8]
fdiv qword [0x5af1c8]
fabs
fcom qword [0x42e3a8]
fnstsw ax
test ah, 1
jne 0x404d65
fcomp qword [0x42e3a0]
fnstsw ax
test ah, 0x41
jne 0x404d7b
jmp 0x404d67
fstp st(0)
mov dword [0x5af1c8], 0
mov dword [0x5af1cc], 0
xor edx, edx
pushfd
pop eax
xor eax, 0x200000
push eax
popfd
pushfd
pop ebx
cmp eax, ebx
jne 0x404d99
mov eax, 1
cpuid
and edx, 0x800000
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
mov eax, 1
cmp ecx, esi
je 0x404db5
cmp dword [0x434668], esi
je 0x404db5
mov dword [0x5af1bc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret