joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
mov ebx, 0x1f4
push eax
push ebx
push 2
push 0
push 0
push 0x10
mov esi, ecx
call fcn.004018f0
mov edi, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push eax
call edi
push 0x7d0
mov ecx, esi
call fcn.004011e9
mov ecx, esi
call fcn.0040119d
test al, al
je 0x401282
lea eax, [ebp - 4]
mov ecx, esi
push eax
push ebx
push 2
push 0
push 0xf060
push 0x112
call fcn.004018f0
push eax
call edi
push 0x3e8
mov ecx, esi
call fcn.004011e9
mov ecx, esi
call fcn.0040119d
test al, al
je 0x4012b0
lea eax, [ebp - 4]
mov ecx, esi
push eax
push ebx
push 2
push 0
push 0
push 0x12
call fcn.004018f0
push eax
call edi
push 0x3e8
mov ecx, esi
call fcn.004011e9
mov ecx, esi
call fcn.0040119d
test al, al
je 0x4012de
lea eax, [ebp - 4]
mov ecx, esi
push eax
push ebx
push 2
push 0
push 0
push 2
call fcn.004018f0
push eax
call edi
push 0x3e8
mov ecx, esi
call fcn.004011e9
mov esi, dword [esi + 0x10]
test esi, esi
je 0x4012ee
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401a85
Capabilities:
Get common file path

Disassembly:
sub esp, 0x140
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040238f
xor eax, eax
mov ebx, 0x104
mov dword [esi + 0x130], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea eax, [esi + 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
call fcn.00401bb1
mov ecx, esi
call fcn.004022ee
lea edi, [esi + 0x24]
push ebx
push edi
call fcn.00401b97
mov ebx, 0x4133a8
push ebx
push edi
call fcn.00407570
add esp, 0x10
jmp 0x401af6
push ebx
push edi
call fcn.00407570
inc eax
push eax
push edi
call fcn.00407cc0
push ebx
push edi
call fcn.00407570
add esp, 0x18
test eax, eax
jne 0x401add
mov ebx, 0x4133a4
push ebx
push edi
call fcn.00407570
pop ecx
pop ecx
jmp 0x401b23
push ebx
push edi
call fcn.00407570
inc eax
push eax
push edi
call fcn.00407cc0
push ebx
push edi
call fcn.00407570
add esp, 0x18
test eax, eax
jne 0x401b0a
push edi
call fcn.00407c40
lea eax, [eax + esi + 0x21]
mov dword [esp], 0x4133a0
push eax
call fcn.00407cc0
pop ecx
lea eax, [esp + 0x10]
pop ecx
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401b60
push str.RAW_001.exe
push edi
call fcn.00407cc0
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push edi
mov ecx, esi
call fcn.004023aa
lea eax, [esi + 0x128]
mov ecx, esi
push eax
call fcn.004023a6
push eax
push esi
push str.RAW_002.wdt
mov ecx, esi
call fcn.004010b4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x140
ret
Function at 0x401eb8
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x4c]
push ebx
push eax
mov edi, ecx
call fcn.00407de0
push dword [edi + 0x130]
lea eax, [ebp - 0xc48]
mov dword [ebp - 0x4c], esi
push dword [ebp + 8]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [edi + 0x134]
push eax
push ebx
push 4
push ebx
push ebx
lea eax, [ebp - 0xc48]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
push dword [edi + 0x18]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x401fe6
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 8], ebx
push dword [esi]
push dword [esi + 8]
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
test eax, eax
je 0x401f8a
push dword [edi + 0x128]
lea ecx, [ebp - 0x448]
call fcn.0040502c
cmp dword [esi], ebx
mov dword [ebp + 8], ebx
jbe 0x401f97
lea ecx, [ebp - 0x448]
call fcn.00401172
mov ecx, dword [esi + 8]
mov edx, dword [ebp + 8]
add ecx, edx
sub byte [ecx], al
inc edx
cmp edx, dword [esi]
mov dword [ebp + 8], edx
jb 0x401f6b
jmp 0x401f97
push str.Could_not_Read_encrypted_EXE.
push ebx
call fcn.004050fb
pop ecx
pop ecx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push dword [esi]
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
cmp dword [0x417598], ebx
je 0x401fdd
mov ecx, edi
call fcn.00402065
push str.The_integration_header_was_not_valid._The_process_memory_was_mapped_incorrectly.
push dword [edi + 0x18]
call fcn.00401ff6
pop ecx
push eax
call fcn.004050fb
push dword [edi + 0x18]
call fcn.00401d9d
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x402065
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
lea edi, [ebx + 8]
mov eax, dword [edi]
test eax, eax
je 0x402088
push eax
call esi
and dword [edi], 0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x402096
push eax
call esi
and dword [ebx + 0xc], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404875
mov ecx, eax
call fcn.004048f7
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.DLL_ResetEvent]
call esi
push dword [ebp - 4]
call esi
push 2
push 0
push 2
push edi
mov ecx, ebx
call fcn.004011e5
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
push dword [ebp - 8]
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x402109
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x808]
push str.GameWrapper:_Duplicate_Pause_Event_failed__last_error__x_n
push eax
call fcn.00407e38
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push 2
push 0
lea eax, [ebx + 0xc]
push 2
push eax
mov ecx, ebx
call fcn.004011e5
push eax
push dword [ebp - 4]
call esi
push eax
call edi
pop edi
pop esi
test eax, eax
pop ebx
jne 0x402152
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x808]
push str.GameWrapper:_Duplicate_Timeout_Event_failed__last_error__x_n
push eax
call fcn.00407e38
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
leave
ret

Function at 0x402213
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
push 0x100
mov dword [ebp + 8], edi
push dword [ebx + 0x2c]
call fcn.00401023
push eax
push edi
call fcn.00401d40
add esp, 0x10
test eax, eax
jne 0x402248
xor al, al
jmp 0x4022e9
movzx ecx, word [esi + 0x14]
mov edi, eax
sub edi, dword [ebp + 8]
and dword [ebp + 8], 0
lea edx, [ecx + esi + 0x18]
movzx ecx, word [esi + 6]
test ecx, ecx
mov dword [ebp - 4], ecx
jle 0x402282
mov ecx, dword [edx + 0x14]
cmp edi, ecx
jb 0x402274
mov esi, dword [edx + 0x10]
add esi, ecx
cmp edi, esi
jb 0x402282
add edx, 0x28
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 4]
jl 0x402264
mov ecx, dword [edx + 0xc]
sub ecx, dword [edx + 0x14]
mov edx, dword [ebx + 0xc]
add ecx, dword [edx + 0x34]
add ecx, edi
mov dword [0x417594], ecx
cmp dword [eax + 0x100], 0x100
jne 0x4022c3
cmp byte [eax + 0x105], 0
jne 0x4022c3
add ecx, 0x100
mov dword [0x41759c], 0xc
mov dword [0x417598], ecx
jmp 0x4022e7
add ecx, 0x104
push 0x18
mov dword [0x417598], ecx
mov eax, dword [eax + 0x100]
pop ecx
mov dword [0x41759c], eax
cmp eax, ecx
jb 0x4022e7
mov dword [0x41759c], ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4023aa
Capabilities:
Get file size

Disassembly:
sub esp, 0x110
push ebx
xor ebx, ebx
cmp dword [ecx + 4], ebx
mov dword [esp + 0x10], ecx
jne 0x40248e
push ebp
push esi
push edi
push ebx
mov edi, dword [sym.imp.KERNEL32.DLL_CreateFileA]
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [esp + 0x13c]
call edi
mov esi, eax
push str.Game_files_are_corrupt__please_re_install_game_and_try_again.
cmp esi, 0xffffffff
setne al
push eax
call fcn.004050fb
pop ecx
pop ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetFileSize]
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
mov dword [esp + 0x1c], eax
call ebp
and dword [esp + 0x14], 0
mov eax, dword [str.Background.jpg]
mov esi, 0x41354c
jmp 0x402476
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call edi
push dword [esi]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
push str.file__s_missing_
push eax
call fcn.00407e38
cmp dword [esp + 0x1c], 0xffffffff
lea eax, [esp + 0x2c]
push eax
setne al
push eax
call fcn.004050fb
add esp, 0x14
push 0
push dword [esp + 0x14]
call ebx
push dword [esp + 0x10]
add dword [esp + 0x18], eax
call ebp
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x40241f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add ecx, eax
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebp
mov al, 1
pop ebx
add esp, 0x110
ret 4

Function at 0x40249a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, dword [ebp + 0x10]
push ebx
push eax
mov dword [edi], eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, dword [ebp + 0xc]
cmp eax, 0xffffffff
push str.Could_not_get_file_size
mov dword [esi], eax
setne al
push eax
call fcn.004050fb
push dword [esi]
call fcn.004074a5
add esp, 0xc
lea ecx, [ebp + 8]
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], ebx
push ebx
push ecx
push dword [esi]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x40250b
mov eax, dword [esi]
cmp eax, dword [ebp + 8]
jne 0x40250b
mov bl, 1
push str.There_was_an_error_in_reading_the_file_contents_into_memory.
push ebx
call fcn.004050fb
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4025af
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
or dword [eax], 0xffffffff
or dword [eax + 0x10], 0xffffffff
or dword [eax + 8], 0xffffffff
push edi
xor edi, edi
mov dword [eax + 4], edi
mov dword [eax + 0x14], edi
mov esi, dword [ecx + 0x28]
mov dword [ebp + 0xc], edi
mov dword [eax + 0xc], esi
movzx edx, word [ecx + 0x14]
lea edx, [edx + ecx + 0x18]
movzx ecx, word [ecx + 6]
cmp ecx, edi
mov dword [ebp + 8], ecx
jbe 0x402612
mov ecx, dword [edx + 0x10]
mov edi, dword [edx + 8]
cmp edi, ecx
jae 0x4025f6
mov ecx, edi
mov edi, dword [edx + 0xc]
cmp esi, edi
jb 0x402604
lea ebx, [edi + ecx]
cmp esi, ebx
jb 0x402629
inc dword [ebp + 0xc]
add edx, 0x28
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 8]
jb 0x4025ea
push str.Error_calculating_file_offset__what_type_of_PE_file_is_this___
push 0
call fcn.004050fb
pop ecx
xor al, al
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
sub esi, edi
mov dword [eax], ebx
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov edx, dword [edx + 0x14]
add edx, esi
sub ecx, esi
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
mov al, 1
jmp 0x402622

Function at 0x40308d
Capabilities:
Create thread
Print debug messages

Disassembly:
push esi
mov esi, ecx
fld dword [esi + 0x18]
fcomp dword [0x4102a4]
fnstsw ax
test ah, 0x41
je 0x4030bf
call fcn.004069a0
test al, al
jne 0x4030bf
push 0
push str.Demo_Expired
push str.Thank_you_for_playing__your_demo_has_expired._nBuy_now_to_upgrade_instantly.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret
mov ecx, esi
call fcn.00403817
call fcn.00401029
mov ecx, eax
call fcn.0040119d
test al, al
jne 0x4030bd
call fcn.00401029
mov ecx, eax
call fcn.0040105e
mov ecx, esi
call fcn.004030f5
test al, al
je 0x4030bd
mov ecx, esi
pop esi
jmp fcn.00403281
Function at 0x4030f5
Capabilities:
Create process on windows
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x950
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0xc], ecx
call fcn.00407de0
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 0x50], esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 2
push 1
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x403173
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x950]
push str.GameWrapper:_Duplicate_Thread_Failed__last_error__x_n
push eax
call fcn.00407e38
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
jmp 0x403276
push 2
push 1
lea eax, [ebp - 8]
push 0x100001
push eax
call esi
push eax
call fcn.00401029
mov ecx, eax
call fcn.004011e5
push eax
call esi
push eax
call edi
test eax, eax
jne 0x4031cf
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x950]
push str.GameWrapper:_Duplicate_Game_Failed__last_error__x_n
push eax
call fcn.00407e38
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x403276
push dword [ebp - 8]
mov edi, str.0x_08x
lea eax, [ebp - 0x150]
push edi
push eax
call fcn.00407e38
mov esi, dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
push str.GAME_HANDLE
call esi
push dword [ebp - 4]
lea eax, [ebp - 0x150]
push edi
push eax
call fcn.00407e38
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
push str.WRAPPER_HANDLE
call esi
mov eax, dword [ebp - 0xc]
add eax, 0x48
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
push str.RAW_003.wdt
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x40327a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x950]
push str.GameWrapper:_Create_Process_Failed__last_error__x_n
push eax
call fcn.00407e38
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 8]
call esi
xor al, al
jmp 0x40327c
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403817
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov byte [esi + 0x15], 1
push dword [0x417b60]
call edi
call fcn.00401029
mov ecx, eax
call fcn.004018f0
mov ebx, eax
test ebx, ebx
je 0x4038c1
and byte [esi + 0x14], 0
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 1
push ebx
call edi
lea edi, [esi + 4]
cmp dword [edi], 0
jne 0x40386d
cmp dword [esi + 0xc], 0
je 0x4038c1
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4038c1
mov eax, dword [esi + 0xc]
cmp dword [ebp - 8], eax
jne 0x40389b
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [edi]
jne 0x40389b
mov ecx, dword [ebp - 4]
cmp ecx, dword [esi + 0x10]
jne 0x40389b
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [esi + 8]
je 0x4038c1
mov ecx, dword [esi + 8]
mov esi, dword [esi + 0x10]
mov edx, dword [edi]
sub esi, ecx
push 1
sub eax, edx
push esi
push eax
push ecx
push edx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x10
push 0
push edi
call fcn.00407de0
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403aa6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
fld dword [ebp + 8]
fcomp dword [0x4102a4]
fnstsw ax
test ah, 5
jp 0x403abe
fldz
fstp dword [ebp + 8]
push edi
call fcn.00403b04
mov edi, eax
test edi, edi
je 0x403b01
push esi
xor esi, esi
push esi
call fcn.004027d3
add byte [ebp + esi + 8], al
inc esi
cmp esi, 4
pop ecx
jb 0x403acd
lea eax, [ebp + 8]
push 4
push eax
push 4
push 0
push dword [ebp + 0xc]
call fcn.004027ee
pop ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebp
ret
Function at 0x4044fa
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push dword [0x417b60]
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esi + 0x30]
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp byte [esi], al
je 0x40458c
mov dword [ebp - 4], eax
call fcn.00406d40
test eax, eax
jle 0x4045a5
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x2c]
push eax
call fcn.00406dc0
mov esi, eax
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
pop ecx
push 0xcc0020
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
inc dword [ebp - 4]
call fcn.00406d40
cmp dword [ebp - 4], eax
jl 0x40453c
pop edi
jmp 0x4045a5
push 0xcc0020
push eax
push eax
push ebx
push dword [esi + 0x28]
push dword [esi + 0x2c]
push eax
push eax
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
push dword [0x417b60]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop esi
pop ebx
leave
ret

Function at 0x4047fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
fldz
push ebx
push esi
fstp dword [ebp - 4]
call fcn.00403b04
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x40485d
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
push dword [ebp + 8]
call fcn.004027ee
pop ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40484f
push esi
call fcn.004027d3
sub byte [ebp + esi - 4], al
inc esi
cmp esi, 4
pop ecx
jb 0x40483c
jmp 0x404856
mov dword [ebp - 4], 0x47a8c000
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fld dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x4048f7
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x800
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateEventA]
cmp dword [esi + 0x5c], ebx
jne 0x404944
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x5c], eax
jne 0x404944
call ebp
push eax
lea eax, [esp + 0x14]
push str.GameWrapper:_Create_Pause_Event_Failed__last_error__x_n
push eax
call fcn.00407e38
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
cmp dword [esi + 0x60], ebx
jne 0x404977
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x60], eax
jne 0x404977
call ebp
push eax
lea eax, [esp + 0x14]
push str.GameWrapper:_Create_Timeout_Event_Failed__last_error__x_n
push eax
call fcn.00407e38
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ecx, dword [esp + 0x814]
mov eax, dword [esi + 0x5c]
pop edi
mov dword [ecx], eax
mov eax, dword [esi + 0x60]
mov ecx, dword [esp + 0x814]
pop esi
pop ebp
pop ebx
mov dword [ecx], eax
add esp, 0x800
ret 8

Function at 0x404d38
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404def
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x404d7b
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x404def
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
cmp esi, ebx
je 0x404d72
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
cmp eax, ebx
jne 0x404d9e
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
jmp 0x404d72
lea ecx, [ebp - 8]
push ebx
push ecx
mov dword [ebp - 8], ebx
push dword [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0xc], ebx
je 0x404def
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jge 0x404dea
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x404def
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x404def
cmp dword [ebp + 8], ebx
jne 0x404df3
xor al, al
jmp 0x404e2a
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, ebx
je 0x404e02
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
push 0x4102d0
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
test eax, eax
jl 0x404e1f
cmp dword [esi], ebx
je 0x404e1f
mov bl, 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405a90
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
cmp esi, esp
call fcn.0040887a
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp esi, esp
call fcn.0040887a
test eax, eax
jne 0x405adb
xor al, al
jmp 0x405add
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x40
cmp ebp, esp
call fcn.0040887a
mov esp, ebp
pop ebp
ret

Function at 0x405af0
Capabilities:
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x494
push ebx
push esi
push edi
lea edi, [ebp - 0x494]
mov ecx, 0x125
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.00407cc0
add esp, 8
push 0x410400
lea eax, [ebp - 0x104]
push eax
call fcn.00407cd0
add esp, 8
mov byte [ebp - 0x105], 1
mov esi, esp
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp esi, esp
call fcn.0040887a
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
je 0x405c2b
mov eax, dword [ebp - 0x248]
and eax, 0x10
test eax, eax
jne 0x405c06
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x350]
push ecx
call fcn.00407cc0
add esp, 8
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x350]
push ecx
call fcn.00407cd0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x454]
push ecx
call fcn.00407cc0
add esp, 8
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x454]
push ecx
call fcn.00407cd0
add esp, 8
lea eax, [ebp - 0x454]
push eax
call fcn.00405a90
add esp, 4
mov esi, esp
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x350]
push ecx
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
cmp esi, esp
call fcn.0040887a
test eax, eax
jne 0x405c06
mov byte [ebp - 0x105], 0
mov esi, esp
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp esi, esp
call fcn.0040887a
test eax, eax
jne 0x405b6c
mov esi, esp
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp esi, esp
call fcn.0040887a
mov al, byte [ebp - 0x105]
pop edi
pop esi
pop ebx
add esp, 0x494
cmp ebp, esp
call fcn.0040887a
mov esp, ebp
pop ebp
ret