joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401660
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x2f
push esi
call fcn.00401cf0
add esp, 8
test eax, eax
je 0x4016c1
add esi, 0x104
inc eax
push edi
push eax
push str.c:windows_temp_s
push esi
call fcn.00401c91
push 0x4080a0
push esi
call fcn.00401c7e
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4016b7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push edi
push eax
push 1
push ecx
call fcn.00401b54
push edi
call fcn.00401afe
add esp, 0x14
push 5
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
ret

Function at 0x401770
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
push ebx
push edi
push 0x800
call fcn.00401942
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x401796
pop edi
pop ebx
add esp, 0x104
ret 0x10
mov ecx, 0x200
xor eax, eax
mov edi, ebx
push 0x104
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
push 0x5c
push ecx
call fcn.00401cf0
add esp, 8
test eax, eax
jne 0x4017dc
push ebx
call fcn.004018d9
add esp, 4
xor eax, eax
pop edi
pop ebx
add esp, 0x104
ret 0x10
push str.xinit.exe
push ebx
call fcn.00406cc0
add esp, 8
test eax, eax
jne 0x401804
push ebx
call fcn.004018d9
add esp, 4
xor eax, eax
pop edi
pop ebx
add esp, 0x104
ret 0x10
lea edx, [esp + 8]
push esi
push edx
push str.__s_
push ebx
call fcn.00401c91
mov edi, dword [esp + 0x128]
add esp, 0xc
test edi, edi
je 0x401848
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 1
call fcn.00401942
mov esi, eax
add esp, 4
test esi, esi
je 0x401871
mov ecx, esi
call fcn.004010b0
push esi
call fcn.004018d9
add esp, 4
push ebx
call fcn.004018d9
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
add esp, 0x104
ret 0x10

Function at 0x14b6bb0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14b6bba
pushal
call 0x14b6bc0
pop ebp
sub ebp, 0x10
sub ebp, 0x10b6bb0
jmp 0x14b6bd6
mov eax, 0x10b6bb0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f9
mov edx, 0xb793a437
xor byte [eax], dl
inc eax
dec ecx
jne 0x14b6bed
jmp 0x14b6c00
mov esp, 0xbbebcfa
aaa
aaa
aaa
mov dh, 0xf6
iretd
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x563022d8
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x591e32d2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x419150
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x496873
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push 0xb
mov esi, ecx
xor ebx, ebx
push str.shieldGlowP
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00403bd0
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esp + 0x34], ebx
call dword [eax + 0x40]
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x30], 0xffffffff
jb 0x4191ba
mov edx, dword [esp + 0x10]
push edx
call fcn.00461bad
add esp, 4
push 0x130
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
call fcn.00461221
add esp, 4
mov dword [esp + 8], eax
cmp eax, ebx
mov dword [esp + 0x30], 1
je 0x4191f2
push 1
mov ecx, eax
call fcn.004409c0
jmp 0x4191f4
xor eax, eax
mov edx, dword [esi]
push eax
mov ecx, esi
mov dword [esp + 0x34], 0xffffffff
mov dword [esi + 0x11c], eax
call dword [edx + 0xdc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x1e
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0x4a245c
mov byte [ecx + 4], bl
call fcn.00403bd0
mov ecx, dword [esi + 0x11c]
call fcn.004407b0
mov ecx, dword [esi + 0x11c]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x60]
mov ecx, dword [esi + 0x11c]
push esi
push ebx
call fcn.00440740
push 4
mov ecx, esi
call fcn.0043e100
mov ecx, dword [esp + 0x28]
mov byte [esi + 0x12c], 1
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret

Function at 0x4196a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x496890
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x4bb98c]
push ebx
push esi
mov dword [esp + 0x24], eax
mov esi, ecx
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.00403ae0
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
mov byte [esp + 0x30], 1
jae 0x419700
lea eax, [esp + 0xc]
push ebx
push ebx
push ebx
push eax
mov ecx, esi
call fcn.00407680
cmp dword [esp + 0x20], 0x10
jb 0x41971f
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00461bad
add esp, 4
cmp dword [esp + 0x50], 0x10
pop esi
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
mov dword [esp + 0x1c], 0xf
pop ebx
jb 0x419745
mov edx, dword [esp + 0x34]
push edx
call fcn.00461bad
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1c]
call fcn.00461d91
add esp, 0x2c
ret 0x1c
Function at 0x41d4f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x496ed9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ebp, [esi + 0x10]
mov ecx, ebp
mov dword [esp + 0x24], ebx
call fcn.0043f050
lea ecx, [esi + 0x18]
mov byte [esp + 0x24], 1
call fcn.0043f050
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 2
call fcn.0043f050
lea edi, [esi + 0x3c]
mov ecx, edi
mov byte [esp + 0x24], 3
call fcn.0043f050
push 0x40400000
push 0x3f800000
lea ecx, [esp + 0x1c]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [ebp], ebx
mov dword [esi + 0x20], 0x41a00000
mov dword [esi + 0x24], 0x43c80000
mov dword [esi + 0x38], 0xbf800000
call fcn.0043f080
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], edx
pop edi
mov dword [esi + 0x5c], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x41d50a
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x496ed9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ebp, [esi + 0x10]
mov ecx, ebp
mov dword [esp + 0x24], ebx
call fcn.0043f050
lea ecx, [esi + 0x18]
mov byte [esp + 0x24], 1
call fcn.0043f050
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 2
call fcn.0043f050
lea edi, [esi + 0x3c]
mov ecx, edi
mov byte [esp + 0x24], 3
call fcn.0043f050
push 0x40400000
push 0x3f800000
lea ecx, [esp + 0x1c]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov dword [ebp], ebx
mov dword [esi + 0x20], 0x41a00000
mov dword [esi + 0x24], 0x43c80000
mov dword [esi + 0x38], 0xbf800000
call fcn.0043f080
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x1c]
mov dword [edi + 4], edx
pop edi
mov dword [esi + 0x5c], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x42d2c0
Capabilities:
Access peb ldr_data
Check os version
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x497d44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
mov eax, dword [0x4bb98c]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x90], eax
call fcn.0043c220
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
xor ebx, ebx
push 0x20
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.SoftwareGameHouseFeedingFrenzy
mov dword [esp + 0xc4], ebx
mov byte [ecx + 4], bl
call fcn.00403bd0
push 0x80000002
lea ecx, [esp + 0x30]
call fcn.0043c250
cmp al, bl
jne 0x42d381
lea ecx, [esp + 0xc]
call fcn.0043c230
push 0x25
push str.Screen_saver_not_installed_correctly.
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403bd0
push 1
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4], 1
call fcn.00416a80
push 0x4b4410
lea ecx, [esp + 0x3c]
push ecx
call fcn.00461bc6
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x49d606
mov byte [ecx + 4], bl
call fcn.00403bd0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x10
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.SaverInstallPath
mov byte [esp + 0xdc], 2
mov byte [ecx + 4], bl
call fcn.00403bd0
lea edx, [esp + 0xac]
push edx
lea ecx, [esp + 0x48]
mov byte [esp + 0xd8], bl
call fcn.0043c630
mov eax, dword [esp + 0x88]
push ebx
push 0x49d606
push eax
push ebx
lea ecx, [esp + 0x84]
mov byte [esp + 0xac], 3
call fcn.00402d40
test eax, eax
jne 0x42d44f
lea ecx, [esp + 0xc]
call fcn.0043c230
push 0x2a
push str.Screen_saver_couldnt_find_data_resources.
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403bd0
push 1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4], 4
call fcn.00416a80
push 0x4b4410
lea edx, [esp + 0x3c]
push edx
call fcn.00461bc6
mov eax, dword [esi + 0x110]
cmp eax, ebx
mov dword [esi + 0x48], eax
jl 0x42d461
cmp eax, 5
jle 0x42d464
mov dword [esi + 0x48], ebx
cmp dword [esp + 0x8c], 0x10
mov eax, dword [esp + 0x78]
jae 0x42d476
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0xc]
call fcn.0043c230
cmp dword [esp + 0x8c], 0x10
jb 0x42d49d
mov eax, dword [esp + 0x78]
push eax
call fcn.00461bad
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
mov dword [esp + 0x9c], 0xffffffff
call fcn.00444ee0
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x90]
call fcn.00461d91
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x42d2e1
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x497d44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
mov eax, dword [0x4bb98c]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x90], eax
call fcn.0043c220
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
xor ebx, ebx
push 0x20
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.SoftwareGameHouseFeedingFrenzy
mov dword [esp + 0xc4], ebx
mov byte [ecx + 4], bl
call fcn.00403bd0
push 0x80000002
lea ecx, [esp + 0x30]
call fcn.0043c250
cmp al, bl
jne 0x42d381
lea ecx, [esp + 0xc]
call fcn.0043c230
push 0x25
push str.Screen_saver_not_installed_correctly.
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403bd0
push 1
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4], 1
call fcn.00416a80
push 0x4b4410
lea ecx, [esp + 0x3c]
push ecx
call fcn.00461bc6
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x49d606
mov byte [ecx + 4], bl
call fcn.00403bd0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x6c], esp
push 0x10
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.SaverInstallPath
mov byte [esp + 0xdc], 2
mov byte [ecx + 4], bl
call fcn.00403bd0
lea edx, [esp + 0xac]
push edx
lea ecx, [esp + 0x48]
mov byte [esp + 0xd8], bl
call fcn.0043c630
mov eax, dword [esp + 0x88]
push ebx
push 0x49d606
push eax
push ebx
lea ecx, [esp + 0x84]
mov byte [esp + 0xac], 3
call fcn.00402d40
test eax, eax
jne 0x42d44f
lea ecx, [esp + 0xc]
call fcn.0043c230
push 0x2a
push str.Screen_saver_couldnt_find_data_resources.
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403bd0
push 1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0xa4], 4
call fcn.00416a80
push 0x4b4410
lea edx, [esp + 0x3c]
push edx
call fcn.00461bc6
mov eax, dword [esi + 0x110]
cmp eax, ebx
mov dword [esi + 0x48], eax
jl 0x42d461
cmp eax, 5
jle 0x42d464
mov dword [esi + 0x48], ebx
cmp dword [esp + 0x8c], 0x10
mov eax, dword [esp + 0x78]
jae 0x42d476
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0xc]
call fcn.0043c230
cmp dword [esp + 0x8c], 0x10
jb 0x42d49d
mov eax, dword [esp + 0x78]
push eax
call fcn.00461bad
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
mov dword [esp + 0x9c], 0xffffffff
call fcn.00444ee0
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x90]
call fcn.00461d91
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x430f30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x498158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [0x4bb98c]
push ebx
push esi
mov dword [esp + 0x30], eax
push edi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], ebx
call fcn.0043c220
push 0x21
mov edi, 0xf
push str.SoftwareGameHouseFeedingFrenzy_
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 1
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403bd0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 2
call fcn.00405880
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x40]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00403ae0
push reloc.DSOUND.dll_DirectSoundCreate
lea ecx, [esp + 0x30]
call fcn.0043c250
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 9
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.foodCount
mov byte [ecx + 4], bl
call fcn.00403bd0
lea ecx, [esp + 0x2c]
call fcn.0043c380
lea ecx, [esp + 0xc]
mov dword [esi], eax
call fcn.0043c230
mov eax, dword [esp + 0x30]
mov esi, 0x10
cmp eax, esi
jb 0x43101d
mov eax, dword [esp + 0x1c]
push eax
call fcn.00461bad
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x40], bl
call fcn.00444ee0
cmp dword [esp + 0x60], esi
jb 0x431049
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.00461bad
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x34]
call fcn.00461d91
pop edi
pop esi
pop ebx
add esp, 0x38
ret 0x1c
Function at 0x431070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x498158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [0x4bb98c]
push ebx
push esi
mov dword [esp + 0x30], eax
push edi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], ebx
call fcn.0043c220
push 0x21
mov edi, 0xf
push str.SoftwareGameHouseFeedingFrenzy_
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 1
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00403bd0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], 2
call fcn.00405880
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x40]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00403ae0
push reloc.DSOUND.dll_DirectSoundCreate
lea ecx, [esp + 0x30]
call fcn.0043c250
mov eax, dword [esi]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 9
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.foodCount
mov byte [ecx + 4], bl
call fcn.00403bd0
lea ecx, [esp + 0x2c]
call fcn.0043c560
lea ecx, [esp + 0xc]
call fcn.0043c230
mov eax, dword [esp + 0x30]
mov esi, 0x10
cmp eax, esi
jb 0x43115d
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00461bad
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x40], bl
call fcn.00444ee0
cmp dword [esp + 0x60], esi
jb 0x431189
mov edx, dword [esp + 0x4c]
push edx
call fcn.00461bad
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x34]
call fcn.00461d91
pop edi
pop esi
pop ebx
add esp, 0x38
ret 0x1c
Function at 0x439db0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4989e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.0043f050
mov ecx, dword [esi + 0x128]
mov eax, dword [ecx]
lea edx, [esp + 0x14]
xor ebx, ebx
push edx
mov dword [esp + 0x44], ebx
call dword [eax + 0x16c]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edx
call fcn.00444ee0
mov ecx, dword [esi + 0x128]
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
call dword [eax + 0x16c]
fld dword [eax]
fcomp dword [0x4aa084]
mov byte [esp + 0xb], 1
fnstsw ax
test ah, 0x41
je 0x439e2f
mov byte [esp + 0xb], bl
lea ecx, [esp + 0x14]
call fcn.00444ee0
mov al, byte [esp + 0xb]
mov ecx, dword [esi + 0x128]
cmp al, bl
mov eax, dword [ecx]
je 0x439e68
call dword [eax + 0x12c]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
mov ecx, eax
call fcn.0043f2b0
fmul dword [0x49d598]
fsubr dword [esp + 0xc]
jmp 0x439e86
call dword [eax + 0x12c]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
mov ecx, eax
call fcn.0043f2b0
fmul dword [0x49d598]
fadd dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
fstp dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov eax, dword [esi]
push ecx
push edx
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call dword [eax + 0x1c0]
mov edx, dword [eax]
mov dword [esp + 0xc], edx
mov eax, dword [eax + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
call fcn.00444ee0
push 0xc
push str.levelUpBurst
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00403bd0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebx
push ebx
push ecx
mov ecx, dword [esi + 0x2c4]
push edx
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x54], 1
call fcn.0044a6a0
cmp dword [esp + 0x34], 0x10
mov byte [esp + 0x40], bl
jb 0x439f12
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00461bad
add esp, 4
push 7
push str.levelUp
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.00403bd0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push ebx
push ebx
push edx
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esi + 0x2c4]
mov byte [esp + 0x54], 2
call fcn.0044a6a0
cmp dword [esp + 0x34], 0x10
jb 0x439f67
mov edx, dword [esp + 0x20]
push edx
call fcn.00461bad
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov dword [esp + 0x40], 0xffffffff
call fcn.00444ee0
mov ecx, dword [esp + 0x38]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x43c380
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x498dd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [ecx + 4]
test al, al
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], 0
jne 0x43c3d2
cmp eax, 0x10
jb 0x43c3bd
mov eax, dword [esp + 0x1c]
push eax
call fcn.00461bad
add esp, 4
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x20
push edi
mov edi, dword [esp + 0x38]
cmp eax, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 4
jae 0x43c3ec
lea eax, [esp + 0x20]
push esi
lea edx, [esp + 8]
push edx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x43c431
call fcn.00441c90
cmp dword [esp + 0x38], 0x10
mov ecx, dword [esp + 0x24]
jae 0x43c41f
lea ecx, [esp + 0x24]
mov edx, dword [eax]
push esi
push ecx
push str.Unable_to_query_DWORD_registry_value:__s__Error:__d__n
push eax
call dword [edx + 0x68]
add esp, 0x10
jmp 0x43c435
mov edi, dword [esp + 0xc]
cmp dword [esp + 0x38], 0x10
pop esi
jb 0x43c44a
mov eax, dword [esp + 0x20]
push eax
call fcn.00461bad
add esp, 4
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x20

Function at 0x43c460
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x498dc0
push eax
mov dword fs:[0], esp
push ebp
push esi
push edi
mov ebp, ecx
mov al, byte [ebp + 4]
test al, al
mov dword [esp + 0x14], 1
jne 0x43c4ac
call fcn.00441c90
mov edx, dword [eax]
sub esp, 0x1c
mov edi, esp
push str.Unable_to_write_reg_value__s__registry_key_not_open_n
mov ecx, 7
lea esi, [esp + 0x3c]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [edx + 0x68]
add esp, 0x24
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x3c]
mov edi, 0x10
cmp eax, edi
jae 0x43c4c1
lea ecx, [esp + 0x3c]
cmp dword [esp + 0x34], edi
mov eax, dword [esp + 0x20]
jae 0x43c4cf
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x4c]
inc edx
push edx
push ecx
push 1
push 0
push eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x43c50e
call fcn.00441c90
cmp dword [esp + 0x34], edi
mov ecx, dword [esp + 0x20]
jae 0x43c4fe
lea ecx, [esp + 0x20]
mov edx, dword [eax]
push esi
push ecx
push str.Unable_to_write_reg_value__s__Error:__d__n
push eax
call dword [edx + 0x68]
add esp, 0x10
cmp dword [esp + 0x34], edi
jb 0x43c521
mov eax, dword [esp + 0x20]
push eax
call fcn.00461bad
add esp, 4
cmp dword [esp + 0x50], edi
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
jb 0x43c549
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00461bad
add esp, 4
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 0x38
Function at 0x43c560
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x498dd8
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov ebx, ecx
mov al, byte [ebx + 4]
test al, al
mov dword [esp + 0x14], 0
jne 0x43c5ac
call fcn.00441c90
mov edx, dword [eax]
sub esp, 0x1c
mov edi, esp
push str.Unable_to_write_reg_value__s__registry_key_not_open_n
mov ecx, 7
lea esi, [esp + 0x3c]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [edx + 0x68]
add esp, 0x24
mov eax, dword [esp + 0x34]
mov edi, 0x10
cmp eax, edi
mov eax, dword [esp + 0x20]
jae 0x43c5c1
lea eax, [esp + 0x20]
mov edx, dword [ebx]
push 4
lea ecx, [esp + 0x3c]
push ecx
push 4
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x43c5ff
call fcn.00441c90
cmp dword [esp + 0x34], edi
mov ecx, dword [esp + 0x20]
jae 0x43c5ef
lea ecx, [esp + 0x20]
mov edx, dword [eax]
push esi
push ecx
push str.Unable_to_write_reg_value__s__Error:__d__n
push eax
call dword [edx + 0x68]
add esp, 0x10
cmp dword [esp + 0x34], edi
jb 0x43c612
mov eax, dword [esp + 0x20]
push eax
call fcn.00461bad
add esp, 4
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x20