joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40daf1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40db8e
push ebx
push esi
call fcn.0040daba
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040da4e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40db3b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40db8d
push edi
push eax
call fcn.0040c43b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40db5b
call fcn.0040c596
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40db8c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040da4e
add esp, 0x20
test eax, eax
jne 0x40db7a
push edi
call fcn.0040c596
jmp 0x40db82
push ebx
call fcn.0040c596
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40e99c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4170e8
push 0x4170e0
push str.FlsAlloc
push 0x1f
call fcn.0040e8b8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e9d0
push dword [ebp + 8]
mov ecx, esi
call dword [0x4151bc]
call esi
jmp 0x40e9d6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ea1a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4170f8
push 0x4170f0
push str.FlsGetValue
push 0x21
call fcn.0040e8b8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ea51
push dword [ebp + 8]
mov ecx, esi
call dword [0x4151bc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40ea59
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417100
push 0x4170f8
push str.FlsSetValue
push 0x22
call fcn.0040e8b8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ea93
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4151bc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4138b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4138dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4138dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x4030fb
Capabilities:
Accept command line arguments
Check os version
Get file system object information

Disassembly:
sub esp, 0x184
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x8001
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], str.Error_writing_temporary_file._Make_sure_your_temp_folder_is_valid.
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x18], 0x20
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x403144
push ebx
call fcn.00405f28
cmp eax, ebx
je 0x403144
push 0xc00
call eax
mov esi, str.UXTHEME
push esi
call fcn.00405eba
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x403149
push 0xd
call fcn.00405f28
push 0xb
call fcn.00405f28
mov dword [0x423f44], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov dword [0x423ff8], eax
push ebx
lea eax, [esp + 0x38]
push 0x160
push eax
push ebx
push 0x41f4f0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push str.NSIS_Error
push 0x423740
call fcn.00405b98
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebp, 0x42a000
push eax
push ebp
call fcn.00405b98
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [0x42a000], 0x22
mov dword [0x423f40], eax
mov eax, ebp
jne 0x4031dc
mov byte [esp + 0x14], 0x22
mov eax, 0x42a001
push dword [esp + 0x14]
push eax
call fcn.004056b6
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [esp - 0x27], eax
xchg byte [edx - 0x2148f012], ch
jmp 0x4031fc
or eax, 0xe75c69f8
mov ebp, eax
lea ebp, [0x6c6af90c]
imul eax, esi, 0x4ce0414c
lea eax, [0x46d3400a]
mov esi, ebp
imul ecx, esi
movsx ebx, bx
push 0x33060
mov esi, edx
pop edx
mov ebx, 0xf7765f2f
mov ah, cl
xor edx, 0x590d
test ch, 0xc8
movsx esi, ch
add eax, 0x296bdf78
add edi, edx
mov eax, 0x26348274
test bh, 0xef
imul eax, edi, 0x5e50c0c1
mov dh, 0x4e
dec eax
jno 0x403255
dec ecx
cmp eax, 0x509d
jne 0x403266
sub eax, 0xb232e4d7
cmp eax, 0xa53c3da9
xchg dl, bl
mov bl, 0xef
adc bh, al
cmp edx, 0xe56c
jb 0x40327a
movzx ebp, cl
xchg edx, ecx
jmp edi
Function at 0x4014d0
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x6b1164]
movzx ecx, word [eax + 0x125]
push ecx
lea edx, [esp + 0x10]
push str.._data_aiconfig__d.dat
push edx
call fcn.00565b90
push 0x583620
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00565b49
mov eax, dword [esp + 0x20]
add esp, 0x18
test eax, eax
je 0x401556
push eax
push 1
push 0x1c64
add edi, 0xea
push edi
call fcn.005659fc
mov edx, dword [esp + 0x18]
push edx
call fcn.00565831
add esp, 0x14
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.00565c32
add esp, 0x48
ret
Function at 0x404640
Capabilities:
Create directory
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
xor esi, esi
lea ebx, [edi + 1]
lea ebp, [edi + 5]
call fcn.00404230
mov dword [eax + esi*4 + 0x28e], ebx
call fcn.00404230
mov dword [eax + esi*4 + 0x1d2], edi
cmp esi, ebp
jge 0x404693
call fcn.00404230
mov dword [eax + esi*4 + 0x14a], edi
call fcn.00404230
mov dword [eax + esi*4 + 0x19e], edi
call fcn.00404230
mov dword [eax + esi*4 + 0x25a], ebx
cmp esi, 4
jge 0x4046bc
call fcn.00404230
mov dword [eax + esi*4 + 0x15e], edi
call fcn.00404230
mov dword [eax + esi*4 + 0x1b2], edi
call fcn.00404230
mov dword [eax + esi*4 + 0x26e], ebp
cmp esi, 2
jge 0x404709
call fcn.00404230
mov dword [eax + esi*4 + 0x16e], edi
call fcn.00404230
mov dword [eax + esi*4 + 0x176], edi
call fcn.00404230
mov dword [eax + esi*4 + 0x1c2], edi
call fcn.00404230
mov dword [eax + esi*4 + 0x27e], ebp
call fcn.00404230
mov dword [eax + esi*4 + 0x1ca], edi
call fcn.00404230
mov dword [eax + esi*4 + 0x286], ebp
add esi, ebx
cmp esi, 6
jl 0x404653
call fcn.00404230
mov dword [eax + 0x23e], 0x1e
call fcn.00404230
mov dword [eax + 0x17e], ebx
call fcn.00404230
mov dword [eax + 0x182], ebx
call fcn.00404230
mov esi, 0xfa
mov dword [eax + 0x226], esi
call fcn.00404230
mov dword [eax + 0x22a], esi
call fcn.00404230
mov dword [eax + 0x186], ebx
call fcn.00404230
mov dword [eax + 0x18a], ebx
call fcn.00404230
mov dword [eax + 0x24e], ebx
call fcn.00404230
mov esi, 3
mov dword [eax + 0x252], esi
call fcn.00404230
mov dword [eax + 0x18e], ebx
call fcn.00404230
mov dword [eax + 0x12a], ebx
call fcn.00404230
mov dword [eax + 0xee], edi
call fcn.00404230
mov dword [eax + 0xf2], edi
call fcn.00404230
mov dword [eax + 0xf6], edi
call fcn.00404230
mov dword [eax + 0x192], edi
call fcn.00404230
mov dword [eax + 0x196], edi
call fcn.00404230
mov dword [eax + 0x216], ebp
call fcn.00404230
mov dword [eax + 0x21e], ebp
call fcn.00404230
mov dword [eax + 0x21a], ebp
call fcn.00404230
mov dword [eax + 0x256], esi
call fcn.00404230
mov dword [eax + 0x202], ebp
call fcn.00404230
mov dword [eax + 0x19a], edi
call fcn.00404230
mov dword [eax + 0xfa], edi
call fcn.00404230
mov dword [eax + 0x10a], ebx
call fcn.00404230
mov dword [eax + 0x10e], ebx
call fcn.00404230
mov dword [eax + 0x116], ebx
call fcn.00404230
mov dword [eax + 0x11e], ebx
call fcn.00404230
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x2a6], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp fcn.004014d0
Function at 0x404e20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x6b1164]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x125]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00565b90
push 0x1c64
lea edi, [esi + 0xea]
push 0
push edi
call fcn.00565680
push 0x5836e0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00565b49
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x404ef8
push eax
push 1
push 0x1c64
push edi
call fcn.00566115
mov edx, dword [esp + 0x18]
push edx
call fcn.00565831
add esp, 0x14
call fcn.00404230
mov eax, dword [eax + 0x226]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x404ebb
fadd dword [0x583660]
fstp dword [esi + 0xde]
call fcn.00404230
mov ecx, dword [eax + 0x22a]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x404ee1
fadd dword [0x583660]
pop edi
fstp dword [esi + 0xe6]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00565c32
add esp, 0x4c
ret
mov ecx, esi
call fcn.00404640
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00565c32
add esp, 0x4c
ret

Function at 0x404e33
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x6b1164]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x125]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00565b90
push 0x1c64
lea edi, [esi + 0xea]
push 0
push edi
call fcn.00565680
push 0x5836e0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00565b49
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x404ef8
push eax
push 1
push 0x1c64
push edi
call fcn.00566115
mov edx, dword [esp + 0x18]
push edx
call fcn.00565831
add esp, 0x14
call fcn.00404230
mov eax, dword [eax + 0x226]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x404ebb
fadd dword [0x583660]
fstp dword [esi + 0xde]
call fcn.00404230
mov ecx, dword [eax + 0x22a]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x404ee1
fadd dword [0x583660]
pop edi
fstp dword [esi + 0xe6]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00565c32
add esp, 0x4c
ret
mov ecx, esi
call fcn.00404640
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00565c32
add esp, 0x4c
ret
Function at 0x40aa20
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push 0x40a9a0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6a2cf4], eax
ret 4
Function at 0x40ae10
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x35c
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push ebp
push 0x104
lea eax, [esp + 0x260]
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x25c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40ae46
mov ecx, dword [str.mfl.dat]
mov edx, dword [0x5839d4]
mov dword [eax], ecx
mov cl, byte [0x5839d8]
mov dword [eax + 4], edx
lea edx, [esp + 0x25c]
push 0x583978
push edx
mov byte [eax + 8], cl
call fcn.00565b32
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40aea5
push eax
call fcn.00565831
add esp, 4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.00565c32
add esp, 0x35c
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x160]
push eax
push 0x104
call edi
lea eax, [esp + 0x160]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40aec4
mov ecx, dword [str.Resource.bin]
mov edx, dword [0x5839c4]
mov dword [eax], ecx
mov ecx, dword [0x5839c8]
mov dword [eax + 4], edx
mov edx, dword [0x5839cc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.00566ac1
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.00566ac1
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40af04
lea edx, [esp + 0x160]
push edx
push 0x104
call edi
lea edi, [esp + 0x160]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40af80
mov ecx, 6
mov esi, str.ResourceSkillArea.bsad
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea esp, [esp]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.00566ac1
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.00566ac1
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40afb0
push ebx
call fcn.00565831
mov ecx, dword [esp + 0x36c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00565c32
add esp, 0x35c
ret
Function at 0x40b040
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov ecx, 0x6a4a90
call fcn.00424280
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6a2ce8], ebp
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x6db648]
xor edx, edx
mov eax, esi
div dword [0x6dabd4]
mov eax, dword [0x6dabd8]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40b09d
cmp dword [edx], esi
je 0x40b0e1
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x40b092
push 0
push ebp
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6a2ae8
push 0x6a28e8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6a2cec], esi
test esi, esi
jne 0x40b0fd
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40b09d
mov eax, dword [edx + 8]
push 0
push ebp
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x40b0b2
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6a2d20
call fcn.0040c6e0
cmp dword [0x6b2f08], 0
push 0
mov ecx, 0x6a2d20
push 0
jne 0x40b14e
push 1
call fcn.0040c550
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push 2
call fcn.0040c550
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40b8f0
Capabilities:
Create directory
Delete file

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push esi
call fcn.0040aa20
mov eax, dword [esp + 0x2c]
mov dword [0x6a27a0], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b931
test dl, dl
je 0x40b92d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b931
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b911
xor eax, eax
jmp 0x40b936
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40b957
push 0
push str.Error__
push 0x583b04
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
call fcn.0040ac90
test eax, eax
je 0x40b94e
push esi
call fcn.0040aa20
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x583af0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x6c0650
call fcn.0050f4e0
push str._____________________Client_Start______________________
push 0x6c0650
call fcn.0050f4e0
push str._______________________________________________________
push 0x6c0650
call fcn.0050f4e0
add esp, 0x18
call fcn.0040ac00
mov ecx, 0x6c1c28
call fcn.00519350
push 0x6daaa8
push 0x6a2ae8
call fcn.00565b90
push 0x6daaa8
push 0x6a28e8
call fcn.00565b90
push esi
call fcn.0040b880
add esp, 0x14
mov ecx, 0x6c1c28
call fcn.0051b940
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6be8c8
call fcn.004e3730
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6be8c8
call fcn.004e42b0
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6be8c8
call fcn.004e2400
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6be8c8
call fcn.004e38d0
mov ecx, 0x6b06f0
call fcn.00432180
mov eax, dword [esp + 0x30]
push eax
push esi
call fcn.0040b040
add esp, 8
test eax, eax
jne 0x40ba54
call fcn.0040aca0
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x40ba8b
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
jmp 0x40ba68
mov ecx, 0x6a2d20
call fcn.0040ca60
cmp eax, 0xffffffff
jne 0x40ba68
call fcn.0040aca0
mov eax, dword [esp + 0x14]
pop edi
pop ebx
pop esi
add esp, 0x1c
ret 0x10
Function at 0x41eeb0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x130
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov esi, dword [esp + 0x13c]
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp esi, ebx
je 0x41f062
cmp byte [esi], bl
je 0x41f062
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41f062
mov edx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x41ef34
mov dword [esp + 0xc], 0x64
push edi
xor edi, edi
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
jbe 0x41f050
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea esp, [esp]
xor eax, eax
push edi
push str._04u
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
lea eax, [esp + 0x38]
push 5
push eax
call fcn.0041f330
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41f029
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0x104
call ebp
test eax, eax
je 0x41efcf
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41f029
push esi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41efec
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41f029
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.Characteristics
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 4
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41f047
mov esi, dword [esp + 0x2c]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x41ef50
mov edx, dword [esp + 0x18]
pop ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x41f064
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
pop ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x41f064
xor eax, eax
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
call fcn.00565c32
add esp, 0x130
ret 4