joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cc9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
sub esp, 0x60
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x48], 0
mov eax, dword [ebp]
push eax
call fcn.005d5710
fldz
fldz
fld dword [eax + 4]
movzx eax, byte [0x7e46fe]
fstp dword [esp + 8]
fld dword [0x69d39c]
imul eax, eax, 0x1cc
pop ecx
add eax, 0x7e4688
lea esi, [eax + 0x2f0]
add eax, 0x2fc
mov edx, esi
fmul dword [edx + 8]
fadd dword [eax + 8]
fstp st(1)
fld dword [0x69d39c]
fmul dword [edx + 4]
fadd dword [eax + 4]
fstp st(2)
fld dword [0x69d39c]
fmul dword [edx]
fadd dword [eax]
fstp dword [esp + 0x14]
fld st(1)
fstp dword [esp + 0x18]
fst dword [esp + 0x1c]
fld dword [esi]
fstp dword [esp + 8]
fld dword [esi + 4]
fstp dword [esp + 0xc]
fld dword [esi + 8]
fstp dword [esp + 0x10]
fcompp
lea ecx, [esp + 8]
call fcn.004dfea0
fld dword [esp + 8]
fmul dword [esp + 4]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x48]
push 0
fstp dword [esp + 0xc]
fld dword [esp + 0x10]
fmul dword [esp + 8]
push 0
push 0
fstp dword [esp + 0x18]
fld dword [esp + 0x1c]
fmul dword [esp + 0x10]
push 0
push 1
fstp dword [esp + 0x24]
fld dword [esp + 0x1c]
fadd dword [esp + 0x28]
push 1
push 1
fstp dword [esp + 0x24]
fld dword [esp + 0x28]
fadd dword [esp + 0x34]
lea edi, [esp + 0x24]
push 1
fstp dword [esp + 0x2c]
fld dword [esp + 0x30]
fadd dword [esp + 0x3c]
push ecx
push eax
lea eax, [esp + 0x3c]
push edi
push eax
fstp dword [esp + 0x40]
call fcn.004d92d0
add esp, 0x30
test al, al
je 0x5ccb98
lea esi, [esp + 0x20]
lea edi, [esp + 0x4c]
movsd dword es:[edi], dword [esi]
push 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x5c]
lea esi, [esp + 0x60]
lea edx, [esp + 0x50]
push esi
push eax
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.005778b0
add esp, 0x14
test al, al
je 0x5ccb98
fld dword [esp + 0x4c]
fstp dword [ebx]
fld dword [esp + 0x50]
fstp dword [ebx + 4]
fld dword [esp + 0x54]
fstp dword [ebx + 8]
fld dword [esp + 0x58]
fmul dword [0x69d414]
mov eax, dword [esp + 0x78]
add ebp, 7
fstp dword [eax]
lea eax, [esp + 0x20]
push dword [0x69d408]
push 0
push dword [0x69d398]
push 1
push 0
push 1
push 0
push 0
push dword [0x69d490]
push dword [0x69d494]
push eax
push 0xff
push 0
push 0
push 0x80
push ebp
call fcn.005427a0
add esp, 0x40
mov al, 1
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret 8
xor al, al
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret 8
Function at 0x5d6430
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
mov esi, ecx
push ebp
sub esp, 0x108
cmp byte [esi + 0x56], 0
mov ebp, dword [esp + 0x118]
je 0x5d6521
cmp ebp, 0x4c8
jae 0x5d6521
movzx ebx, byte [esp + 0x11c]
mov eax, dword [ebx*4 + 0x978668]
test eax, eax
je 0x5d6482
push 1
push eax
call dword [0x6f25bc]
mov eax, dword [ebx*4 + 0x978668]
push eax
call dword [0x6f25c0]
cmp ebp, 0x66
jae 0x5d6490
add esi, 0x30c08
push esi
jmp 0x5d64a7
cmp ebp, 0x67
jae 0x5d64a0
lea ecx, [esi + 0x30a00]
push ecx
jmp 0x5d64a7
lea edx, [esi + 0x30b04]
push edx
lea eax, [esp + 8]
push eax
call fcn.00642560
pop ecx
pop ecx
mov eax, ebp
lea ecx, [eax*8]
lea ecx, [ecx + ecx*2]
add ecx, eax
lea eax, [esp + 4]
add ecx, 0x69dc78
push ecx
push eax
call fcn.006425b0
mov eax, dword [0x978550]
lea edx, [esp + 0xc]
pop ecx
pop ecx
push 0
push edx
push eax
call dword [0x6f25c4]
mov dword [ebx*4 + 0x978668], eax
mov eax, dword [ebx*4 + 0x978668]
test eax, eax
je 0x5d6514
push 1
push eax
call dword [0x6f25c8]
mov eax, dword [ebx*4 + 0x978668]
push 1
push eax
call dword [0x6f25d4]
jmp 0x5d6521
call dword [0x6f25d8]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 0x108
pop ebp
pop esi
pop ebx
ret 8

Function at 0x5d6800
Capabilities:
Print debug messages

Disassembly:
mov edx, dword [esp + 8]
push ebx
cmp edx, 0x7f
mov ebx, dword [esp + 8]
jbe 0x5d6813
mov edx, 0x7f
mov eax, ebx
lea eax, [ebx - 0x1c]
test eax, eax
ja 0x5d6823
jmp dword [eax*4 + 0x6a5710]
pop ebx
ret 8
Function at 0x5d6980
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov byte [esp], 0
lea eax, [ebx - 0x1c]
mov esi, ebx
test eax, eax
ja 0x5d69a7
jmp dword [eax*4 + 0x6a5718]
cmp edx, 0x20c
jae 0x5d69f6
movzx eax, byte [esp + 0x44]
cmp byte [eax + 0xa10978], 0
jne 0x5d69d0
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov esi, edx
mov edi, dword [eax*4 + 0x7e45d8]
lea esi, [esi + esi*4]
lea edi, [edi + edi*4]
mov ebp, dword [ecx + esi*4 + 0x15c]
sub ebp, dword [ecx + edi*4 + 0x15c]
add ebp, dword [eax*4 + 0x94b788]
jmp 0x5d6a30
xor esi, esi
movzx eax, byte [0xa10b52]
nop
mov edi, eax
sub edi, esi
dec edi
cmp edx, dword [edi*4 + 0x9751d0]
jne 0x5d6a17
mov ebp, dword [edi*4 + 0xa0d208]
jmp 0x5d6a1d
inc esi
cmp esi, 3
jb 0x5d6a00
cmp esi, 3
jne 0x5d6a30
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
cmp byte [esp], 0
je 0x5d6a70
mov ebx, dword [ebx*4 + 0x9b4854]
test ebx, ebx
je 0x5d6a60
lea edx, [edx + edx*4]
mov eax, dword [ecx + edx*4 + 0x160]
push eax
push ebp
push ebx
call dword [0x6f2620]
add esp, 0x28
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov edi, edx
mov dword [esp + 4], 1
mov dword [esp + 8], ebp
lea edi, [edi + edi*4]
lea edi, [edi*4]
mov dword [esp + 0x18], 1
mov eax, dword [ecx + edi + 0x160]
lea ebp, [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + edi + 0x164]
mov dword [esp + 0x10], eax
mov eax, dword [ebx*4 + 0x94b1a0]
push ebp
push eax
mov dword [esp + 0x1c], 0x10
call dword [0x6f2624]
test eax, eax
jne 0x5d6ae0
call dword [0x6f25d8]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor al, al
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov al, 1
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x5d87f0
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push ebp
sub esp, 0x458
mov ebx, dword [esp + 0x468]
push 0
call dword [0x6f2694]
lea eax, [esp + 4]
push eax
push 0x67e9c8
push 1
push 0
push 0x67e9d8
call dword [0x6f2698]
test eax, eax
jl 0x5d8907
lea eax, [esp + 0x24c]
push eax
mov eax, dword [esp + 8]
mov esi, dword [eax]
push 0x67e9e8
push eax
call dword [esi]
test eax, eax
jl 0x5d88fd
lea eax, [esp + 0x250]
push 0x104
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x24c]
lea ecx, [esp + 0x250]
mov ebp, dword [eax]
push 0
push ecx
push eax
call dword [ebp + 0x14]
test eax, eax
jl 0x5d88f0
mov eax, dword [esp + 4]
mov ebp, dword [eax]
push 0x13
push 0
push eax
call dword [ebp + 0x4c]
test eax, eax
jl 0x5d88f0
lea eax, [esp + 0x148]
push ebx
push eax
call fcn.00642560
lea eax, [esp + 0x10]
pop ecx
lea edx, [esp + 0x14c]
pop ecx
push 2
push eax
mov eax, dword [esp + 0xc]
mov ebx, dword [eax]
push 0x104
push edx
push eax
call dword [ebx + 0xc]
test eax, eax
jl 0x5d88f0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x46c]
lea ecx, [esp + 0x148]
push ecx
push eax
call fcn.00642560
pop ecx
pop ecx
add esp, 0x458
mov al, 1
pop ebp
pop esi
pop ebx
ret
mov eax, dword [esp + 0x24c]
mov ebx, dword [eax]
push eax
call dword [ebx + 8]
mov eax, dword [esp + 4]
mov ebx, dword [eax]
push eax
call dword [ebx + 8]
xor al, al
add esp, 0x458
pop ebp
pop esi
pop ebx
ret
Function at 0x5f83b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
push ebp
sub esp, 0x20
cmp byte [esi], 0
je 0x5f85d4
cmp dword [esp + 0x34], 0
jl 0x5f85d4
cmp dword [esp + 0x34], 0xfa
jge 0x5f85d4
mov edi, dword [esp + 0x34]
imul edi, edi, 0x28
cmp byte [esi + edi + 0x1f18], 0
je 0x5f85d4
cmp word [esp + 0x38], 0xcc
jae 0x5f85d4
cmp dword [esi + edi + 0x1f10], 4
jne 0x5f8445
cmp dword [esi + 0x4b2c], 0x28
jge 0x5f85d4
mov ax, word [esp + 0x38]
mov word [esi + edi + 0x1f1a], ax
mov byte [esi + edi + 0x1f34], 1
mov edx, dword [esi + 0x4b2c]
inc dword [esi + 0x4b2c]
mov eax, dword [esp + 0x34]
mov dword [esi + edx*4 + 0x4a8c], eax
jmp 0x5f85d4
mov eax, dword [esp + 0x34]
mov byte [esp + 8], 0
mov edx, eax
mov dword [esp + 0x18], eax
mov ecx, edx
lea eax, [ecx + edx*4]
mov ecx, eax
mov dword [esp + 0x18], eax
lea eax, [ecx*4]
mov ebx, eax
mov dword [esp + 0x18], eax
mov al, byte [esi + edi + 0x1f34]
movzx ebp, word [esp + 0x38]
mov byte [esp + 0x1c], al
mov al, byte [esp + 0x1c]
mov byte [esp + 0xc], al
jmp 0x5f858a
movzx ecx, word [esi + ebx*2 + 0x1f1a]
mov al, byte [ebp + 0x6be8b8]
mov dl, byte [ecx + 0x6be8b8]
cmp dl, al
jbe 0x5f8585
cmp byte [esp + 8], 3
jae 0x5f853c
movzx ebx, byte [esp + 8]
mov ebp, 3
sub ebp, ebx
inc ebx
lea eax, [ebp + ebp]
push eax
movzx eax, byte [esp + 0xc]
mov dword [esp + 8], eax
lea ecx, [eax + eax]
mov dword [esp + 0x18], esi
add dword [esp + 0x18], edi
lea eax, [ebx + ebx]
add ecx, dword [esp + 0x18]
add eax, dword [esp + 0x18]
add ecx, 0x1f1a
add eax, 0x1f1a
push ecx
push eax
call fcn.0064db70
lea ebp, [ebp*4]
shl dword [esp + 0x10], 2
mov eax, dword [esp + 0x10]
add esp, 0xc
add eax, dword [esp + 0x14]
push ebp
mov dword [esp + 8], eax
add dword [esp + 8], 0x1f24
lea ebx, [ebx*4]
add ebx, dword [esp + 0x18]
add ebx, 0x1f24
push dword [esp + 8]
push ebx
call fcn.0064db70
add esp, 0xc
movzx ecx, byte [esp + 8]
mov ax, word [esp + 0x38]
mov ebp, ecx
add ebp, dword [esp + 0x18]
mov word [esi + ebp*2 + 0x1f1a], ax
mov eax, dword [esp + 0x34]
lea eax, [eax + eax*4]
add eax, eax
fld dword [esp + 0x3c]
add eax, ecx
fstp dword [esi + eax*4 + 0x1f24]
cmp byte [esi + edi + 0x1f34], 4
jae 0x5f857b
inc byte [esi + edi + 0x1f34]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
inc ebx
inc byte [esp + 8]
mov al, byte [esp + 8]
cmp al, byte [esp + 0xc]
jb 0x5f8490
cmp byte [esp + 0x1c], 4
jae 0x5f85d4
movzx edx, byte [esp + 8]
mov ax, word [esp + 0x38]
mov ebp, edx
add ebp, dword [esp + 0x18]
mov word [esi + ebp*2 + 0x1f1a], ax
mov eax, dword [esp + 0x34]
lea eax, [eax + eax*4]
add eax, eax
fld dword [esp + 0x3c]
add eax, edx
fstp dword [esi + eax*4 + 0x1f24]
inc byte [esi + edi + 0x1f34]
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x600ae0
Capabilities:
Get keyboard layout
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
call dword [sym.imp.kernel32.dll_GetSystemDefaultLCID]
movzx ebx, ax
and ebx, 0x3ff
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
movzx ebp, ax
push 0
and ebp, 0x3ff
call dword [sym.imp.user32.dll_GetKeyboardLayout]
movzx esi, ax
and esi, 0x3ff
call dword [sym.imp.kernel32.dll_GetSystemDefaultLCID]
movzx ecx, ax
mov dword [esp + 4], ecx
sar dword [esp + 4], 0xa
call dword [sym.imp.kernel32.dll_GetUserDefaultLCID]
movzx edi, ax
push 0
sar edi, 0xa
call dword [sym.imp.user32.dll_GetKeyboardLayout]
movzx eax, ax
sar eax, 0xa
cmp ebx, 7
je 0x600b51
cmp ebp, 7
je 0x600b51
cmp esi, 7
jne 0x600b66
mov byte [0x68dd68], 0
mov byte [0x869689], 0
mov byte [0xa10ab8], 1
cmp ebx, 0xc
je 0x600b75
cmp ebp, 0xc
je 0x600b75
cmp esi, 0xc
jne 0x600b8a
mov byte [0x68dd68], 0
mov byte [0x869689], 0
mov byte [0xa10b95], 1
cmp dword [esp + 4], 3
je 0x600b9b
cmp edi, 3
je 0x600b9b
cmp eax, 3
jne 0x600ba2
mov byte [0xa10b99], 1
cmp ebp, 7
jne 0x600bb0
mov eax, 7
jmp 0x600bf5
cmp ebp, 0xc
jne 0x600bc0
mov eax, 0xc
jmp 0x600bf5
cmp ebp, 0xa
jne 0x600bd0
mov eax, 0xa
jmp 0x600bf5
cmp ebp, 0x10
jne 0x600be0
mov eax, 0x10
jmp 0x600bf5
cmp edi, 3
jne 0x600bf0
mov eax, 0xffffff9d
jmp 0x600bf5
mov eax, 9
mov edx, eax
sub eax, 7
cmp eax, 9
mov dword [0x86967c], ebx
ja case.0x600c05.8
jmp dword [eax*4 + 0x6d690c]
mov dword [0x869680], 1
jmp 0x600c4a
mov dword [0x869680], 2
jmp 0x600c4a
mov dword [0x869680], 4
jmp 0x600c4a
mov dword [0x869680], 3
jmp 0x600c4a
mov dword [0x869680], 0
mov ecx, 0x94b220
call fcn.005850b0
mov ecx, 0x94b220
call fcn.005854f0
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x601770
Capabilities:
Hide graphical window

Disassembly:
push ebx
sub esp, 0x10
push 0
call fcn.0064e0e0
pop ecx
mov ecx, 0x869630
call fcn.004a394d
call fcn.00642ae0
push 0
push 0x16
mov dword [0x974b74], 0
mov ebx, eax
call fcn.00602ee0
mov edx, dword [0x9b48f4]
mov eax, dword [esp + 0x20]
mov dword [0x783ef4], 1
mov dword [0x783ee8], ebx
mov dword [0x783eec], eax
mov eax, dword [edx]
pop ecx
pop ecx
push eax
push 0x15
call fcn.00602ee0
test eax, eax
pop ecx
pop ecx
jne 0x6017d5
xor eax, eax
jmp 0x60181d
mov eax, dword [0x9b48dc]
mov dword [esp], 0
mov dword [esp + 8], eax
lea eax, [esp]
push eax
mov ecx, dword [0x9b48e0]
push 0
mov dword [esp + 0x14], ecx
mov dword [0x974b74], 1
mov dword [esp + 0xc], 0
mov dword [0x783ef4], 0
call fcn.00602ee0
mov eax, 1
pop ecx
pop ecx
test eax, eax
jne 0x601870
mov dword [0x9b48f0], 1
mov edx, dword [0x9b48f4]
mov eax, dword [edx]
push 0
push eax
call dword [sym.imp.user32.dll_ShowWindow]
mov ecx, 0x94b220
push 0
push str.WIN_TTL
call fcn.00584f30
mov ecx, 0x94b220
push eax
push str.WIN_RSZ
call fcn.00584f30
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxW]
add esp, 0x10
pop ebx
ret
mov ecx, 0x869630
call fcn.004a3a13
add esp, 0x10
pop ebx
ret
Function at 0x601e80
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 8
push str.DDRAW.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x601eb0
push str.Couldnt_LoadLibrary_DDraw_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
push str.DirectDrawCreateEx
push ebx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
jne 0x601ee0
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Couldnt_GetProcAddress_DirectDrawCreateEx_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
lea eax, [esp + 4]
push 0
push 0x67ec9c
push eax
push 0
call ebp
test eax, eax
jge 0x601f10
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Couldnt_DirectDrawCreateEx_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 4]
mov ebp, dword [eax]
push eax
call dword [ebp + 8]
push str.D3D8.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
jne 0x601f50
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_D3D8.DLL_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x700
pop ebp
pop edi
pop esi
pop ebx
ret
push str.dpnhpast.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x601f90
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebp
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_dpnhpast.dll_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret
push str.D3D9.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x601fd0
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebp
call dword [sym.imp.kernel32.dll_FreeLibrary]
push str.Couldnt_LoadLibrary_D3D9.DLL_r_n
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
add esp, 8
mov eax, 0x801
pop ebp
pop edi
pop esi
pop ebx
ret
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
push ebp
call dword [sym.imp.kernel32.dll_FreeLibrary]
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, 0x900
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x602240
Capabilities:
Create directory
Persist via run registry key
Query or enumerate registry value

Disassembly:
push esi
push edi
sub esp, 0x10
mov dword [esp + 4], 0
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x60230d
mov dword [esp + 8], 0x100
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push 0x783ef8
push eax
mov eax, dword [esp + 0x10]
push 0
push str.Personal
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x602302
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push str.GTA_Vice_City_User_Files
push 0x783ef8
call fcn.006425b0
pop ecx
pop ecx
push 0
push 0x2000080
push 3
push 0
push 1
push 0x80000000
push 0x783ef8
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x6022f0
push 0
push 0x783ef8
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
jmp 0x6022f7
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
add esp, 0x10
mov eax, 0x783ef8
pop edi
pop esi
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edi, 0x783ef8
mov esi, str.data
movsd dword es:[edi], dword [esi]
mov eax, 0x783ef8
movsb byte es:[edi], byte [esi]
add esp, 0x10
pop edi
pop esi
ret
Function at 0x61d430
Capabilities:
Delete file

Disassembly:
push ebx
mov dword [0x9753c4], 0
sub esp, 0x108
mov ebx, dword [esp + 0x110]
movsx eax, bl
mov dword [esp], ecx
inc eax
push eax
lea eax, [esp + 8]
push 0x97509c
push str._s_i.b
push eax
call fcn.00648c10
lea eax, [esp + 0x14]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
movsx edx, bl
lea eax, [edx*8]
lea eax, [edx + eax*4]
lea eax, [eax + edx*2]
mov word [eax*4 + 0x8121f8], 0
mov al, 1
add esp, 0x108
pop ebx
ret 4
Function at 0x639268
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
jmp 0x6392ad
pop edi
pop esi
pop ebx
leave
ret

Function at 0x63a5d8
Capabilities:
Link many functions at runtime

Disassembly:
lea esi, [0x6e1818]
push esi
mov eax, dword [0x6e1408]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x6e182d], eax
mov dword [0x6e10f5], 1
mov eax, 0x4000
push eax
lea eax, [0x6e1333]
push eax
lea eax, [0x6e10e1]
push eax
lea esi, [0x6e15cf]
call dword [esi]
cmp eax, 0xffffffff
jne 0x63a624
mov dword [0x6e10f5], 0
cmp dword [0x6e10f5], 0
je 0x63a69a
mov eax, 0x4000
push eax
lea eax, [0x6e1333]
push eax
lea eax, [0x6e10ca]
push eax
lea esi, [0x6e15cf]
call dword [esi]
cmp eax, 0xffffffff
je 0x63a69a
lea eax, [0x6e10ca]
push eax
call dword [0x6e11f3]
mov dword [0x6e10ed], eax
cmp eax, 0
je 0x63a69a
lea edx, [0x6e10f9]
push edx
push eax
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x63a69a
mov dword [0x6e114b], eax
mov eax, dword [0x6e10ed]
lea edx, [0x6e1130]
push edx
push eax
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x63a69a
mov dword [0x6e114f], eax
jmp 0x63a712
mov eax, 0x4000
push eax
lea eax, [0x6e1333]
push eax
lea eax, [0x6e10d7]
push eax
lea esi, [0x6e15cf]
call dword [esi]
cmp eax, 0xffffffff
je 0x63a707
lea eax, [0x6e10d7]
push eax
call dword [0x6e11f3]
mov dword [0x6e10f1], eax
cmp eax, 0
je 0x63a707
lea edx, [0x6e1115]
push edx
push eax
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x63a707
mov dword [0x6e114b], eax
mov eax, dword [0x6e10f1]
lea edx, [0x6e113e]
push edx
push eax
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x63a707
mov dword [0x6e114f], eax
jmp 0x63a71d
mov dword [0x6e1153], 0
ret
mov dword [0x6e1153], 1
ret
mov dword [0x6e1153], 2
ret

Function at 0x63aa35
Capabilities:
Packed with generic packer

Disassembly:
pushal
push eax
push ecx
push edx
test ax, 1
je 0x63aa52
push ecx
push edx
call dword [0x6e1763]
cmp eax, 0
je 0x63aa52
pop edx
pop ecx
pop eax
stc
jmp 0x63aa6d
pop edx
pop ecx
pop eax
test ax, 2
je 0x63aa6c
push ecx
push edx
call dword [0x6e1775]
cmp ax, 0
je 0x63aa6c
stc
jmp 0x63aa6d
clc
popal
ret
Function at 0x63b8a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov ecx, dword [eax]
push edi
mov edi, dword [esp + 0x14]
lea ebp, [eax + 8]
mov dword [esp + 0x14], 0xc
mov edx, dword [edi + 4]
add edx, ecx
mov ecx, dword [edi]
mov dword [edi + 4], edx
mov edx, dword [eax + 4]
add ecx, edx
mov dword [edi], ecx
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
mov esi, ebx
mov edx, ebx
shr esi, 4
xor edx, ecx
and esi, 0x1f
mov ecx, 0x20
mov eax, edx
sub ecx, esi
add ebp, 8
shr eax, cl
mov ecx, esi
shl edx, cl
mov ecx, 0x20
or eax, edx
mov edx, dword [ebp - 8]
sub eax, edx
mov edx, eax
mov dword [edi + 4], eax
shr edx, 7
and edx, 0x1f
xor eax, ebx
sub ecx, edx
mov esi, eax
shr esi, cl
mov ecx, edx
mov edx, dword [ebp - 4]
shl eax, cl
or esi, eax
mov eax, dword [esp + 0x14]
add esi, edx
dec eax
mov dword [edi], esi
mov dword [esp + 0x14], eax
jne 0x63b8ca
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x63b929
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
lea ebp, [eax + 0x60]
mov dword [esp + 0x14], 0xc
mov ebx, dword [edi + 4]
mov edx, dword [edi]
mov ecx, dword [ebp + 4]
mov esi, ebx
shr esi, 7
sub edx, ecx
and esi, 0x1f
mov ecx, 0x20
mov eax, edx
sub ecx, esi
sub ebp, 8
shl eax, cl
mov ecx, esi
shr edx, cl
or eax, edx
xor eax, ebx
mov dword [edi], eax
mov ecx, dword [ebp + 8]
mov edx, eax
shr edx, 4
lea esi, [ebx + ecx]
and edx, 0x1f
mov ecx, 0x20
mov ebx, esi
sub ecx, edx
shl ebx, cl
mov ecx, edx
shr esi, cl
or ebx, esi
xor ebx, eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [edi + 4], ebx
mov dword [esp + 0x14], eax
jne 0x63b940
mov eax, dword [esp + 0x18]
mov esi, dword [edi]
mov ecx, ebx
mov edx, dword [eax + 4]
sub esi, edx
mov dword [edi], esi
mov eax, dword [eax]
sub ecx, eax
mov dword [edi + 4], ecx
pop edi
pop esi
pop ebp
pop ebx
ret