joyce8/EMBER2024-capa huggingface dataset:
Function at 0x527b08
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x527dfa
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x440eac]
call fcn.00440fac
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x527d2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0044104c
xor ecx, ecx
mov edx, 0x527e10
mov eax, dword [ebp - 8]
call fcn.004410b4
test al, al
je 0x527bf7
lea edx, [ebp - 0x158]
mov eax, dword [0x53ab08]
mov eax, dword [eax]
call fcn.0049102c
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.00409524
mov edx, dword [ebp - 0x154]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00441630
lea edx, [ebp - 0x15c]
mov eax, dword [0x53ab08]
mov eax, dword [eax]
call fcn.0049102c
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0xc]
call fcn.00404684
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x344]
call fcn.004d1b4c
mov eax, dword [ebp - 8]
call fcn.0044101c
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0044104c
xor ecx, ecx
mov edx, 0x527e48
mov eax, dword [ebp - 8]
call fcn.004410b4
test al, al
je 0x527d0f
lea ecx, [ebp - 0xc]
mov edx, 0x527e68
mov eax, dword [ebp - 8]
call fcn.00441630
mov eax, dword [ebp - 0xc]
mov edx, 0x527e80
call fcn.00404684
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x348]
call fcn.004d1b4c
lea ecx, [ebp - 0xc]
mov edx, 0x527e8c
mov eax, dword [ebp - 8]
call fcn.00441630
mov eax, dword [ebp - 0xc]
mov edx, 0x527e80
call fcn.00404684
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34c]
call fcn.004d1b4c
lea ecx, [ebp - 0xc]
mov edx, 0x527ea0
mov eax, dword [ebp - 8]
call fcn.00441630
mov eax, dword [ebp - 0xc]
mov edx, 0x527e80
call fcn.00404684
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
call fcn.004d1b4c
lea ecx, [ebp - 0xc]
mov edx, 0x527eb4
mov eax, dword [ebp - 8]
call fcn.00441630
mov eax, dword [ebp - 0xc]
mov edx, 0x527e80
call fcn.00404684
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x358]
call fcn.004d1b4c
lea ecx, [ebp - 0x10]
mov edx, 0x527ecc
mov eax, dword [ebp - 8]
call fcn.00441630
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 0x10]
call fcn.004089c4
cmp dword [ebp - 0x160], 0
jne 0x527d0f
lea eax, [ebp - 0x10]
mov edx, 0x527edc
call fcn.00404310
mov eax, dword [ebp - 8]
call fcn.0044101c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x527d34
mov eax, dword [ebp - 8]
call fcn.00403444
ret
Function at 0x52a528
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404728
xor eax, eax
push ebp
push 0x52a5e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004088b4
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, 0x52a5fc
call fcn.004088b4
mov eax, dword [ebp - 0x10]
pop edx
call fcn.0040487c
test eax, eax
jg 0x52a5a0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004088b4
mov eax, dword [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0x52a60c
call fcn.004088b4
mov eax, dword [ebp - 0x18]
pop edx
call fcn.0040487c
test eax, eax
jle 0x52a5cd
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x52a61c
call fcn.00409de4
push 0
mov eax, dword [ebp - 8]
call fcn.00404738
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52a5ef
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040429c
ret
Function at 0x52dde8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x52ddf0
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x52decd
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040aaf0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 4]
mov eax, 0x52dee4
call fcn.0040b76c
lea edx, [ebp - 0x14]
mov eax, dword [0x53ab08]
mov eax, dword [eax]
call fcn.0049102c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004094f0
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x52df00
call fcn.00404584
mov eax, dword [ebp - 8]
call fcn.004092ac
test al, al
jne 0x52de5f
mov eax, dword [ebp - 8]
call fcn.004096ec
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x28]
mov ecx, 1
mov eax, 0x52df14
call fcn.00409de4
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.004042cc
mov ecx, dword [ebx]
lea eax, [ebp - 0xc]
mov edx, 0x52df3c
call fcn.00404584
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404738
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ded4
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040429c
ret

Function at 0x530504
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x5305be
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x440eac]
call fcn.00440fac
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53059c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0044104c
mov cl, 1
mov edx, 0x5305d4
mov eax, dword [ebp - 4]
call fcn.004410b4
test al, al
je 0x530586
lea edx, [ebp - 0xc]
mov eax, dword [0x53ab08]
mov eax, dword [eax]
call fcn.0049102c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409524
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00441350
mov eax, dword [0x53a6ac]
mov byte [eax + 0xc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5305a3
mov eax, dword [ebp - 4]
call fcn.00403444
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x65774cbb
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x72d720e9
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4034d0
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword [0x662114]
test eax, eax
jne 0x403519
mov ecx, dword [esp + 4]
lea eax, [esp + 4]
push eax
push 4
push ecx
push 0x403490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x662114], eax
je 0x403519
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [0x662114]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x403f60
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor edx, edx
xor ecx, ecx
mov al, byte [esi]
mov dword [esp + 4], edx
test al, al
je 0x403f97
push ebx
mov edx, ecx
and edx, 3
mov bl, byte [esp + edx + 8]
lea edx, [esp + edx + 8]
xor bl, al
mov al, byte [ecx + esi + 1]
inc ecx
mov byte [edx], bl
test al, al
jne 0x403f75
mov eax, dword [esp + 8]
pop ebx
pop esi
pop ecx
ret
mov eax, edx
pop esi
pop ecx
ret

Function at 0x404090
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x7d0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4040a0
push esi
lea eax, [esp + 4]
push edi
push eax
call fcn.0061b730
mov al, byte [esp + 0xc]
mov esi, dword [esp + 0x7e0]
add esp, 4
or ecx, 0xffffffff
cmp al, 0x22
jne 0x4040ef
lea edi, [esp + 9]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xd]
push ecx
push esi
call fcn.006099f0
push 0x22
push esi
call fcn.006097b0
add esp, 0x14
jmp 0x404118
lea edi, [esp + 8]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 8]
push ecx
push edx
push esi
call fcn.006099f0
push str..exe
push esi
call fcn.00609720
add esp, 0x14
test eax, eax
je 0x40411b
mov byte [eax], 0
push 0x5c
push esi
call fcn.006098b0
add esp, 8
test eax, eax
pop edi
pop esi
je 0x404139
mov byte [eax + 1], 0
mov al, 1
add esp, 0x7d0
ret
xor al, al
add esp, 0x7d0
ret
Function at 0x40a830
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
cmp edx, 0xffffffff
push edi
mov ebx, ecx
je 0x40a956
mov eax, dword [ebx + 8]
lea ebp, [ebx + 8]
test eax, eax
je 0x40a85c
cmp edx, dword [eax + 8]
je 0x40a956
mov eax, dword [eax]
test eax, eax
jne 0x40a84d
mov esi, dword [ebx + 4]
test esi, esi
je 0x40a956
mov eax, dword [esi]
test eax, eax
je 0x40a878
mov dword [esi], 0
mov dword [ebx + 4], eax
jmp 0x40a87f
mov dword [ebx + 4], 0
test esi, esi
je 0x40a956
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 0x18]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x20]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x24]
mov byte [esi + 4], cl
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
mov edi, dword [ebp]
mov eax, edi
xor edx, edx
test eax, eax
je 0x40a8c2
cmp byte [eax + 4], cl
jbe 0x40a8cc
mov edx, eax
mov eax, dword [eax]
test eax, eax
jne 0x40a8b1
test edx, edx
jne 0x40a8dd
push esi
mov ecx, ebp
call fcn.0040aa20
jmp 0x40a8e3
test edx, edx
jne 0x40a8d7
mov dword [esi], edi
mov dword [ebp], esi
jmp 0x40a8e3
mov ecx, dword [edx]
mov dword [esi], ecx
jmp 0x40a8e1
mov eax, dword [edx]
mov dword [esi], eax
mov dword [edx], esi
mov al, byte [ebx + 0x10]
test al, al
je 0x40a956
mov al, byte [ebx + 0x11]
mov edi, dword [esp + 0x14]
test al, al
jne 0x40a905
cmp edi, 0xc8
jae 0x40a956
cmp edi, 0xcc
jbe 0x40a956
call fcn.00403600
test al, al
je 0x40a91e
cmp edi, 0xc8
jb 0x40a91e
cmp edi, 0xcb
jb 0x40a933
mov ecx, ebx
mov dword [esi + 0x18], 0
call fcn.0040a960
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
push 1
call fcn.00403610
push eax
mov dword [esi + 0x18], eax
call fcn.00403640
mov ecx, dword [esi + 0x18]
push ecx
call fcn.00403630
add esp, 0xc
mov dword [esi + 0x18], 0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x40c150
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x61ba9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x21c]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x44], eax
mov al, byte [esp + 0x484]
cmp al, 0xff
je 0x40c18c
mov byte [ebx + 0x1a], al
cmp byte [0x66271c], 1
jne 0x40c19c
xor al, al
jmp 0x40cf8d
push ebp
mov ebp, dword [esp + 0x484]
push 0
push 0
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x1c]
mov dword [ebx + 0x10], 0
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x38]
mov dword [esp + 0x38], eax
mov al, byte [esp + 0x488]
fild dword [esp + 0x38]
cmp al, 0xff
fdivr dword [0x622854]
fstp dword [0x662710]
je 0x40c1eb
push ebp
mov ecx, ebx
call fcn.0040cfb0
jmp 0x40ced2
mov edx, dword [ebp]
push 0xad513247
push 0xad513247
push 8
lea ecx, [esp + 4]
push ecx
mov ecx, ebp
call dword [edx + 0x14]
pop eax
cmp eax, 0x65747341
jne 0x40c214
pop eax
cmp eax, 0x20786972
je 0x40c230
push 0x10
push 0
push str.The_LVL_hasnt_been_patched_for_modding__nUse_the_XXL_Editor_by_AdrienTD_to_fix_it.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xf5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp]
lea eax, [ebx + 0xc]
push 4
push eax
mov ecx, ebp
call dword [edx + 0x14]
mov eax, 0x40ce7f
jmp eax
xor edi, edi
mov eax, dword [edi + 0x6457e8]
mov edx, dword [ebx + 4]
push 2
lea ecx, [eax + eax*2]
mov al, byte [esp + 0x48c]
cmp al, 0xff
lea esi, [edx + ecx*4]
jne 0x40cefe
mov eax, dword [ebp]
lea ecx, [esi + 6]
push ecx
mov ecx, ebp
call dword [eax + 0x14]
jmp 0x40cf0a
mov edx, dword [ebp]
lea eax, [esi + 4]
push eax
mov ecx, ebp
call dword [edx + 0x14]
mov edx, dword [ebp]
add esi, 8
push 4
push esi
mov ecx, ebp
call dword [edx + 0x14]
lea eax, [ebx + 0x10]
mov ecx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48c]
push eax
mov eax, dword [edi + 0x6457e8]
push ecx
push ebp
lea edx, [eax + eax*2]
mov eax, dword [ebx + 4]
lea ecx, [eax + edx*4]
call fcn.0040ac90
test eax, eax
je 0x40cf4a
add edi, 4
cmp edi, 0x3c
jb 0x40ced4
mov al, byte [0x66271c]
pop ebp
cmp al, 1
jne 0x40cf58
xor al, al
jmp 0x40cf8d
mov edi, dword [esp + 0x44]
xor esi, esi
mov eax, dword [esi + 0x6457e8]
mov ecx, dword [esp + 0x484]
push ecx
push edi
lea edx, [eax + eax*2]
mov eax, dword [ebx + 4]
lea ecx, [eax + edx*4]
call fcn.0040add0
add esi, 4
cmp esi, 0x3c
jb 0x40cf5e
cmp byte [0x66271c], 1
setne al
mov ecx, dword [esp + 0x470]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x470
ret 0xc
Function at 0x412660
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub esp, 0x418
mov eax, dword [0x6621f4]
push ebx
push ebp
push esi
mov ecx, dword [eax + 0x34]
push edi
mov edi, dword [esp + 0x42c]
xor bl, bl
mov edx, dword [ecx + 0x3c]
mov eax, 3
mov dword [esp + 0x24], edx
jmp 0x41268d
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x412858
mov eax, dword [esp + 0x24]
push 0x3f800000
push 0
push 3
mov ecx, dword [eax + 8]
push 3
push 0x400000c8
mov edx, dword [ecx]
call dword [edx + 0x74]
cmp eax, 3
mov dword [esp + 0x1c], eax
jne 0x41284f
mov eax, dword [0x6475e0]
mov ecx, dword [0x6475c4]
xor eax, 0x38cc
xor ecx, 0x38cc
add eax, edi
add ecx, edi
mov dword [esp + 0x20], eax
xor edx, edx
lea eax, [esp + 0x28]
mov esi, edx
shl esi, 8
mov dword [eax], esi
mov esi, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec esi
mov dword [eax], ebx
jne 0x4126ef
inc edx
add eax, 4
cmp edx, 0xff
jbe 0x4126e3
mov eax, ecx
xor ebp, ebp
sub eax, edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, ebp
jbe 0x41277e
mov esi, dword [edx*4 + 0x6478b0]
xor esi, 0x6920
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp esi, ebx
jb 0x412779
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add esi, 0xf8
cmp ebx, esi
jae 0x41277e
mov eax, dword [esp + 0x14]
mov esi, ecx
sub esi, eax
mov eax, dword [esp + 0x10]
add eax, esi
mov esi, dword [eax]
sub esi, edi
mov dword [eax], esi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x412731
mov esi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x19]
mov bl, byte [esi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x28]
mov ebx, dword [esp + 0x18]
shl ebx, 8
xor edx, ebx
inc esi
inc ebp
mov dword [esp + 0x18], edx
cmp ebp, 0xf8
jb 0x412780
xor edx, edx
test eax, eax
jbe 0x4127f9
mov esi, dword [edx*4 + 0x6478b0]
xor esi, 0x6920
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp esi, ebx
jb 0x4127f4
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add eax, 0xf8
cmp esi, eax
jae 0x4127f9
mov eax, dword [esp + 0x14]
mov esi, ecx
sub esi, eax
mov eax, dword [esp + 0x10]
add eax, esi
mov esi, dword [eax]
add esi, edi
mov dword [eax], esi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x4127ad
mov eax, dword [0x6475c4]
mov ecx, dword [esp + 0x18]
xor eax, 0x38cc
mov edx, edi
and ecx, 0xffff
add edx, eax
lea esi, [ecx + edx - 0xf748]
call dword [esp + 0x20]
push 0x9eb13c2e
push 0x4ca11b
call esi
cmp eax, 1
sete bl
cmp bl, 1
jne 0x412689
mov eax, dword [0x6475e4]
xor eax, 0x38cc
add eax, edi
call eax
cmp eax, 1
mov eax, dword [esp + 0x1c]
sete bl
cmp bl, 1
jne 0x41268d
test bl, bl
jne 0x412868
cmp eax, 1
jne 0x41287a
push 0
call fcn.0060a26d
cmp bl, 1
jne 0x41287a
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x418
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x418
ret
Function at 0x42d220
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x61c0c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
push fcn.00408140
push fcn.0047a880
lea edi, [esi + 0x20]
push 4
push 8
push edi
mov dword [esp + 0x28], 2
call fcn.00609f12
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov byte [esi + 0x1c], al
mov byte [esi + 0x1d], al
mov dword [edi], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi], 0x623670
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x452ea0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61caa4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x624758
mov eax, dword [0x6621f4]
push fcn.00408140
push 6
lea ecx, [esi + 0x4f0]
push 0x10
push ecx
mov dword [esp + 0x24], 8
mov dword [eax + 0x68], 0
call fcn.00609f94
push fcn.00408140
push 0xd
lea edx, [esi + 0x33c]
push 0xc
push edx
mov byte [esp + 0x24], 7
call fcn.00609f94
push fcn.00408140
push 0xd
lea eax, [esi + 0x2a0]
push 0xc
push eax
mov byte [esp + 0x24], 6
call fcn.00609f94
push fcn.00408140
push 0xd
lea ecx, [esi + 0x204]
push 0xc
push ecx
mov byte [esp + 0x24], 5
call fcn.00609f94
push fcn.00408140
push 0xd
lea edx, [esi + 0x168]
push 0xc
push edx
mov byte [esp + 0x24], 4
call fcn.00609f94
mov dword [esi + 0x40], 0x6224ec
mov edi, dword [esi + 0x28]
test edi, edi
mov byte [esp + 0x14], 2
je 0x452f7e
call fcn.00403540
mov ecx, dword [0x662100]
push edi
call fcn.00401250
call fcn.00403560
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi], 0x6224ec
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x459820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61cb58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x24]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x30]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
push ecx
fld dword [eax]
fsub dword [esp + 0xc]
fstp dword [esp + 0x34]
fld dword [eax + 4]
fsub dword [esp + 0x10]
fst dword [esp + 0x30]
fmul dword [esp + 0x30]
fld dword [esp + 0x34]
fmul dword [esp + 0x34]
faddp st(1)
fstp dword [esp]
call fcn.005917c0
fstp dword [esp + 0x18]
fld dword [0x6222d4]
fdiv dword [esp + 0x18]
add esp, 4
fld dword [esp + 0x30]
fmul st(1)
fxch st(1)
fmul dword [esp + 0x2c]
fstp dword [esp + 0x2c]
fmul dword [0x622c20]
fstp dword [esp + 0x30]
fld dword [esp + 0x2c]
fmul dword [0x622c20]
mov dword [esp + 0x2c], 0
fstp dword [esp + 0x18]
fld dword [0x622c20]
fcomp dword [esp + 0x14]
mov dword [esp + 0x24], 0
fnstsw ax
test ah, 0x41
jp 0x45998d
mov bl, byte [esp + 0x34]
fld dword [esp + 0x2c]
fadd dword [0x622c20]
fstp dword [esp + 0x2c]
fld dword [esp + 0x30]
fadd dword [esp + 8]
fstp dword [esp + 8]
fld dword [esp + 0x18]
fadd dword [esp + 0xc]
fstp dword [esp + 0xc]
fld dword [esp + 8]
call fcn.00608fb4
fld dword [esp + 0xc]
mov byte [esp + 0x10], al
call fcn.00608fb4
cmp bl, 1
mov byte [esp + 0x11], al
jne 0x45994f
lea eax, [esp + 0x10]
lea ecx, [esi + 0x1c]
push eax
call fcn.0045b7e0
add eax, 0x665240
cmp byte [eax], bl
je 0x459974
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
test bl, bl
jne 0x459974
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esi + 0x1c]
call fcn.0045b7e0
add eax, 0x665240
mov al, byte [eax]
mov dl, al
or dl, 0x7f
cmp al, dl
je 0x45993a
cmp al, 0x7f
je 0x45993a
fld dword [esp + 0x2c]
fadd dword [0x622c20]
fcomp dword [esp + 0x14]
fnstsw ax
test ah, 0x41
jnp 0x4598df
mov ecx, dword [esp + 0x1c]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x479a40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20
push esi
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0x20019
push 0
push 0
push 0
push str.SOFTWAREMicrosoftDirectX
push 0x80000002
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 8]
test eax, eax
je 0x479b13
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push str.Version
push eax
call edi
test eax, eax
jne 0x479b13
cmp dword [esp + 0x14], 1
jne 0x479b13
mov eax, dword [esp + 0x10]
test eax, eax
mov esi, eax
je 0x479acf
call fcn.00403540
mov ecx, dword [0x662100]
add esi, 3
and esi, 0xfffffffc
push esi
call fcn.00401130
mov esi, eax
call fcn.00403560
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push esi
push eax
push 0
push str.Version
push ecx
call edi
mov edx, dword [esp + 8]
mov edi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x479b1b
test esi, esi
je 0x479b13
call fcn.00403540
mov ecx, dword [0x662100]
push esi
call fcn.00401250
call fcn.00403560
pop edi
mov al, 1
pop esi
add esp, 0x20
ret
lea eax, [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
push str._d._d._d._d
push esi
call fcn.0060aacb
add esp, 0x18
cmp eax, 4
jne 0x479ba0
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x479ba0
mov eax, dword [esp + 0x18]
xor edx, edx
mov ecx, 0xa
push ebx
div ecx
mov ebx, 0xa
mov ecx, edx
xor edx, edx
div ebx
test ecx, ecx
pop ebx
jne 0x479b83
mov eax, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x10]
push edx
push str.DirectX__d._d
push eax
push edi
call fcn.00403ff0
add esp, 0x14
jmp 0x479ba0
add ecx, 0x60
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x38]
push ecx
push str.DirectX__d._d_c
push edx
push edi
call fcn.00403ff0
add esp, 0x18
test esi, esi
je 0x479bba
call fcn.00403540
mov ecx, dword [0x662100]
push esi
call fcn.00401250
call fcn.00403560
mov eax, dword [esp + 0xc]
cmp eax, 9
jae 0x479bcb
pop edi
xor al, al
pop esi
add esp, 0x20
ret
jne 0x479b13
cmp dword [esp + 0x18], 0x386
jae 0x479b13
pop edi
xor al, al
pop esi
add esp, 0x20
ret