joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407c70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x62faa8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push edi
mov eax, dword [0x708dfc]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
fldz
lea ecx, [esp + 0x14]
fst dword [esi]
mov dword [esi + 8], 0
fstp dword [esi + 4]
call fcn.0045fb50
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0
call fcn.0045fce0
movzx eax, word [esp + 0x5c]
push 0x6dabb4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x407dad
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x407dad
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
lea ecx, [esp + 0x1c]
call fcn.0045fea0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.0045fd10
push eax
lea ecx, [esp + 0x1c]
call fcn.0045fd40
mov ecx, dword [0x710714]
push eax
add ecx, 0x50
call fcn.005bd820
push eax
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileInMemory
test eax, eax
jne 0x407dad
mov ecx, dword [0x710714]
call fcn.005cd180
push 1
push 1
push 0x16
push 4
push 4
mov ecx, eax
mov dword [esi + 8], eax
call fcn.005ced80
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push edx
call fcn.005cebf0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0
push eax
mov eax, dword [ecx + 0x44]
call eax
fild dword [esp + 0x60]
mov ecx, dword [esp + 0x40]
fild dword [esp + 0x40]
test ecx, ecx
jge 0x407d8e
fadd dword [0x6dc95c]
fdivp st(1)
mov edx, dword [esp + 0x44]
fstp dword [esi]
fild dword [esp + 0x64]
fild dword [esp + 0x44]
test edx, edx
jge 0x407da8
fadd dword [0x6dc95c]
fdivp st(1)
fstp dword [esi + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x54], 0xffffffff
call fcn.0045fc00
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x4c
ret 0xc
Function at 0x4093d0
Capabilities:
Delete file
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x708dfc]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
push ebp
lea eax, [esp + 0x14]
mov ebx, ecx
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.005bb9c0
add esp, 0xc
test al, al
je 0x40940f
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x10e]
je 0x4094f5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6da334
push esi
call fcn.005e1950
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x409450
push esi
lea eax, [esp + 0x1c]
push str.Cant_replace_file__s_nPlease_delete_this_file_manually
push eax
call fcn.00401ac0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
mov eax, edi
call fcn.00408890
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.0045fd10
push eax
mov ecx, ebx
call fcn.0045fd40
push eax
push esi
lea ecx, [edi + 0x4e0]
call fcn.005c9220
mov ecx, dword [esi + 0x106]
cmp ecx, dword [esp + 8]
je 0x40949b
push 0
push 0x19b
push str..Updater.cpp
push str.fe__size__out_size
call fcn.005baf80
add esp, 0x10
lea ebx, [edi + 0x20dd4]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ebp
push 1
push edx
push eax
call fcn.005e23be
push ebp
call fcn.005e1210
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str.MiniA.exe
push esi
call fcn.005e46fd
add esp, 8
test eax, eax
jne 0x4094e8
mov byte [edi + 0x2162c], 1
call fcn.00409760
mov ecx, dword [esp + 0xc]
push ecx
call fcn.005bcc20
add esp, 4
mov ecx, dword [esp + 0x41c]
pop ebp
pop ebx
xor ecx, esp
call fcn.005e0d87
add esp, 0x41c
ret
Function at 0x4095e0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x630548
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x708dfc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
xor esi, esi
mov dword [esp + 0x18], ebx
call fcn.0040bd10
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], esi
call fcn.0040bda0
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
sar ecx, 2
test ecx, ecx
jbe 0x40968f
mov ebp, 0x100000
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
sar edx, 2
cmp esi, edx
jb 0x409658
call fcn.005e1f86
mov eax, dword [edi + 0x5f4]
mov eax, dword [eax + esi*4]
test dword [eax + 0x116], ebp
jne 0x409675
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040beb0
inc ebx
mov edx, dword [edi + 0x5f8]
sub edx, dword [edi + 0x5f4]
inc esi
sar edx, 2
cmp esi, edx
jb 0x409640
mov dword [esp + 0x14], ebx
xor esi, esi
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x409708
xor ebp, ebp
lea ebx, [edi + 0x5e4]
cmp esi, eax
jb 0x4096bd
call fcn.005e1f86
mov eax, dword [esp + 0x24]
lea edi, [eax + ebp]
push edi
mov ecx, ebx
call fcn.005cad30
test byte [edi + 0x116], 1
je 0x4096dc
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
add ebp, 0x128
cmp esi, eax
jb 0x4096bd
mov ebx, dword [esp + 0x14]
xor esi, esi
push ebx
push str.removed__d_files_n
call fcn.005bac70
mov eax, dword [esp + 0x2c]
add esp, 8
cmp eax, esi
je 0x409727
push eax
call fcn.005bcc20
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.005bcc20
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x409760
Capabilities:
Get common file path

Disassembly:
sub esp, 0x61c
mov eax, dword [0x708dfc]
xor eax, esp
mov dword [esp + 0x614], eax
lea eax, [esp + 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.MiniA.exe
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 8]
push 0x6db2d8
push edx
call fcn.00401aa0
push 0x70c670
lea eax, [esp + 0x224]
push str.Allow_network_traffic_for__s
push eax
call fcn.00401ac0
lea ecx, [esp + 0x22c]
add esp, 0x1c
push ecx
lea ecx, [esp + 4]
call fcn.00401710
mov ecx, dword [esp + 0x618]
add esp, 4
xor ecx, esp
call fcn.005e0d87
add esp, 0x61c
ret
Function at 0x409c20
Capabilities:
Delete file

Disassembly:
sub esp, 0x40c
mov eax, dword [0x708dfc]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
push ebp
push esi
push str.Making_sure_extracted_files_exists_n
call fcn.005bac70
add esp, 4
push 1
lea ebx, [edi + 0x4e0]
push 1
mov ecx, ebx
call fcn.005c8da0
mov eax, dword [edi + 0x5f8]
sub eax, dword [edi + 0x5f4]
xor ebp, ebp
sar eax, 2
test eax, eax
jbe 0x409d0e
mov edi, edi
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
sar ecx, 2
cmp ebp, ecx
jb 0x409c88
call fcn.005e1f86
mov edx, dword [edi + 0x5f4]
mov esi, dword [edx + ebp*4]
test byte [esi + 0x116], 1
je 0x409cf6
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.005bb9c0
add esp, 0xc
test al, al
je 0x409cc9
mov edx, dword [esp + 0x10]
cmp edx, dword [esi + 0x10e]
jne 0x409cc9
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 0x106]
je 0x409cf6
push esi
push str.restoring__s_n
call fcn.005bac70
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0x6db458
push esi
mov ecx, ebx
call fcn.005c9c70
test al, al
je 0x409d3a
mov ecx, dword [edi + 0x5f8]
sub ecx, dword [edi + 0x5f4]
inc ebp
sar ecx, 2
cmp ebp, ecx
jb 0x409c70
mov ecx, ebx
call fcn.005c8f00
push str.Making_sure_extracted_files_exists___finished_n
call fcn.005bac70
mov ecx, dword [esp + 0x418]
add esp, 4
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005e0d87
add esp, 0x40c
ret
push esi
lea edx, [esp + 0x18]
push str.Cant_extract_file__s_nPlease_delete_this_file_manually
push edx
call fcn.00401ac0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.00408890
int3
Function at 0x40a260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x630590
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x708dfc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [esi + 0x20dec], 0
je 0x40a2b7
push 0
push 0x34b
push str..Updater.cpp
push str.status___STATUS_Checking
call fcn.005baf80
add esp, 0x10
mov ecx, esi
call fcn.004088f0
call fcn.00408ae0
test al, al
je 0x40a2e2
mov ecx, esi
call fcn.00408b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, esi
mov byte [esi + 0x98], 1
call fcn.00408de0
mov dword [esi + 0x20dec], eax
lea eax, [esi + 0x20df5]
push 0x6da6ae
push eax
call fcn.00401ac0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov ebx, 5
jmp 0x40a320
cmp dword [esi + 0x20dec], ebx
jne 0x40a420
mov ecx, dword [esi + 0x2179c]
mov eax, dword [0x7b5c90]
or eax, dword [0x7b5c94]
mov dword [0x7b5c80], ecx
mov edx, dword [esi + 0x217a0]
mov dword [0x7b5c84], edx
je 0x40a379
call fcn.00402bd0
test al, al
je 0x40a379
push 0
push 0
push 0x7b5c80
push 0x402890
push 0
push 0
call fcn.005e16c7
add esp, 0x18
mov dword [0x7b5e48], eax
call fcn.00408e40
call fcn.00408f90
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x5e4]
push ecx
push eax
push str.current_build_version_d__updater_data_version_d_n
call fcn.005bac70
mov eax, dword [esi + 0x5e4]
add esp, 0xc
cmp eax, dword [esi + 0x1c]
jne 0x40a3ad
mov eax, esi
call fcn.0040a190
mov ebx, esi
call fcn.00409230
mov ecx, esi
call fcn.00409910
call fcn.0040a0f0
push str.Validating_game_data_n
call fcn.005bac70
add esp, 4
lea edx, [esi + 0x20df5]
push str.Validating_game_data
push edx
call fcn.00401ac0
add esp, 8
lea eax, [esi + 0x21600]
push eax
lea ecx, [esi + 0x215f8]
push ecx
push 0
lea ecx, [esi + 0x4e0]
call fcn.005cc880
test al, al
jne 0x40a40c
push str.Game_data_is_damaged__please_restart_launcher_to_repair_damaged_files
mov eax, esi
call fcn.00408890
push str.Validating_game_data___finished_n
call fcn.005bac70
add esp, 4
mov eax, esi
call fcn.0040a190
push 0x32
call edi
jmp 0x40a320

Function at 0x40b930
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x21618], 0
je 0x40b952
push 0
push 0x5cc
push str..Updater.cpp
push str.mainThread___NULL
call fcn.005baf80
add esp, 0x10
cmp dword [esi + 0x21630], 0
je 0x40b974
push 0
push 0x5cd
push str..Updater.cpp
push str.loginThread___NULL
call fcn.005baf80
add esp, 0x10
push 0
push 0
push esi
push 0x40a4f0
push 0
push 0
call fcn.005e16c7
push 0
push 0
push esi
push 0x40adc0
push 0
push 0
mov dword [esi + 0x21618], eax
call fcn.005e16c7
push 0
push 0
push esi
push 0x40add0
push 0
push 0
mov dword [esi + 0x21cc4], eax
call fcn.005e16c7
add esp, 0x48
mov dword [esi + 0x21628], eax
ret
Function at 0x40ba50
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push str.CUpdater::Stop___n
mov esi, eax
call fcn.005bac70
xor ebx, ebx
add esp, 4
cmp byte [esi + 0x20df4], bl
jne 0x40ba74
mov eax, dword [esi + 0x21620]
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x798a4c
call edi
lea eax, [esi + 0x20dd4]
push eax
mov dword [esp + 0x14], eax
call edi
mov eax, dword [esi + 0x21618]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x40bab7
push ebx
push eax
call edi
mov ecx, dword [esi + 0x21618]
push ecx
call ebp
mov dword [esi + 0x21618], ebx
mov eax, dword [esi + 0x21cc4]
cmp eax, ebx
je 0x40bad4
push ebx
push eax
call edi
mov edx, dword [esi + 0x21cc4]
push edx
call ebp
mov dword [esi + 0x21cc4], ebx
mov eax, dword [esi + 0x21630]
cmp eax, ebx
je 0x40baf1
push ebx
push eax
call edi
mov eax, dword [esi + 0x21630]
push eax
call ebp
mov dword [esi + 0x21630], ebx
mov eax, dword [esi + 0x21628]
cmp eax, ebx
je 0x40bb0e
push ebx
push eax
call edi
mov ecx, dword [esi + 0x21628]
push ecx
call ebp
mov dword [esi + 0x21628], ebx
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edx
call esi
push 0x798a4c
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40dbc0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
sub esp, 8
push esi
push edi
push 0x11
mov dword [esp + 0xc], 4
call fcn.005e26a7
mov edi, eax
push 0x288
mov dword [esp + 0x14], edi
call fcn.005e26a7
mov esi, eax
add esp, 8
test esi, esi
jne 0x40dbfa
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.005e2771
add esp, 4
lea eax, [esp + 8]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x40dc2a
mov ecx, dword [esp + 8]
push ecx
call fcn.005e26a7
mov esi, eax
add esp, 4
test esi, esi
jne 0x40dc2a
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.005e2771
add esp, 4
lea edx, [esp + 8]
push edx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x40dc95
movzx eax, byte [esi + 0x199]
movzx ecx, byte [esi + 0x198]
movzx edx, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push ecx
movzx ecx, byte [esi + 0x195]
push edx
movzx edx, byte [esi + 0x194]
push eax
push ecx
push edx
lea eax, [esp + 0x24]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call fcn.0040e340
push edi
add esi, 0x1b0
push esi
push str.Address:__s__mac:__s_n
call fcn.005e2771
add esp, 0x2c
mov eax, edi
pop edi
pop esi
add esp, 8
ret
push esi
call fcn.005e2836
add esp, 4
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x40df90
Capabilities:
Set registry value

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareSiam_ReturnWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40dfe9
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dfc0
mov ecx, dword [esp]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.username
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40e000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SoftwareSiam_ReturnWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e050
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.username
push eax
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret 4

Function at 0x40e060
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e0b6
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
add edx, 0x132
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.Identifier
push eax
mov dword [esp + 0x1c], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 8
ret 4

Function at 0x40e0c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SoftwareHouse_of_Warrior_InteractiveWarZ
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40e0f4
mov ecx, esi
call fcn.0040e130
mov al, 1
pop esi
add esp, 8
ret
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
add esi, 0x100
push esi
push 0
push 0
push str.hardwareid
push edx
mov dword [esp + 0x20], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
add esp, 8
ret
Function at 0x40e130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1d4
mov eax, dword [0x708dfc]
xor eax, esp
mov dword [esp + 0x1d0], eax
push esi
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareHouse_of_Warrior_InteractiveWarZ
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e1e0
push 0x1c8
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.005e4750
add esp, 0xc
lea eax, [esp + 8]
call fcn.004021c0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
add esi, 0x100
push str.0x_I64x
mov edx, esi
call fcn.0040e320
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e1b5
mov ecx, dword [esp + 4]
sub eax, edx
inc eax
push eax
push esi
push 1
push 0
push str.hardwareid
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1d4]
pop esi
xor ecx, esp
call fcn.005e0d87
mov esp, ebp
pop ebp
ret
Function at 0x40f6e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 4]
add edx, 0xc
mov dword [esp + 4], edx
jmp sym.WhiteZ_Launcher.exe_ZSTD_CCtxParams_getParameter
Function at 0x453230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7fc
mov eax, dword [0x708dfc]
xor eax, esp
mov dword [esp + 0x7f4], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x40
lea eax, [esp + 0x80]
push esi
push eax
mov edi, ecx
mov dword [esp + 0x84], esi
call fcn.005e4750
add esp, 0xc
push 0x44
lea ecx, [esp + 0x38]
push esi
push ecx
mov dword [esp + 0x3c], esi
call fcn.005e4750
mov ebx, dword [edi]
add edi, 4
add esp, 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
cmp ebx, 0x10
jbe 0x453296
mov eax, 0xffffffd4
jmp 0x45341e
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x81c]
lea ecx, [esp + 0x80]
push ecx
mov ecx, dword [esp + 0x81c]
lea edx, [esp + 0x50c]
push edx
call fcn.004527f0
add esp, 0x10
mov dword [esp + 0x2c], eax
cmp eax, 0xffffff88
ja 0x45341e
mov edi, dword [esp + 0x1c]
cmp edi, ebx
ja 0x45328c
mov dword [esp + 0x14], edi
cmp dword [esp + edi*4 + 0x78], esi
jne 0x4532f0
dec edi
cmp dword [esp + edi*4 + 0x78], esi
je 0x4532e5
mov dword [esp + 0x14], edi
xor ebp, ebp
lea eax, [ebp + 1]
lea ebx, [edi + 1]
mov dword [esp + 0x20], ebp
cmp ebx, eax
jbe 0x453313
mov ecx, ebp
add ebp, dword [esp + eax*4 + 0x78]
mov dword [esp + eax*4 + 0x34], ecx
inc eax
cmp eax, ebx
jb 0x453300
mov dword [esp + 0x20], ebp
mov esi, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x34], ebp
test esi, esi
jbe 0x45334b
movzx edx, byte [esp + eax + 0x500]
mov ecx, dword [esp + edx*4 + 0x34]
mov byte [esp + ecx*2 + 0x600], al
inc eax
lea edi, [ecx + 1]
mov dword [esp + edx*4 + 0x34], edi
mov byte [esp + ecx*2 + 0x601], dl
cmp eax, esi
jb 0x453321
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
sub edx, dword [esp + 0x1c]
xor esi, esi
lea eax, [esi + 1]
dec edx
mov dword [esp + 0x34], esi
cmp ebx, eax
jbe 0x453382
mov ebp, dword [esp + eax*4 + 0x78]
lea ecx, [eax + edx]
shl ebp, cl
mov edi, esi
mov dword [esp + eax*4 + 0xc0], edi
inc eax
add esi, ebp
cmp eax, ebx
jb 0x453361
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sub ecx, edi
mov edi, dword [esp + 0x24]
inc ecx
sub edi, ecx
inc edi
cmp ecx, edi
jae 0x4533e7
mov edx, ecx
neg edx
mov eax, ecx
shl eax, 4
shl edx, 4
add eax, ecx
sub edx, ecx
lea eax, [esp + eax*4 + 0xc4]
add edx, edx
mov dword [esp + 0x18], eax
add edx, edx
cmp ebx, 1
jbe 0x4533d4
lea esi, [ebx - 1]
jmp 0x4533c0
mov ebp, dword [edx + eax]
shr ebp, cl
add eax, 4
sub esi, 1
mov dword [eax - 4], ebp
jne 0x4533c0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
inc ecx
add eax, 0x44
sub edx, 0x44
mov dword [esp + 0x18], eax
cmp ecx, edi
jb 0x4533b3
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
inc ecx
push ecx
push edx
lea eax, [esp + 0xc8]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x38]
push ebp
lea edx, [esp + 0x614]
push edx
push eax
push ecx
call fcn.00453100
mov eax, dword [esp + 0x4c]
add esp, 0x20
mov ecx, dword [esp + 0x804]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005e0d87
add esp, 0x7fc
ret
Function at 0x45b1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x7c]
push esi
mov esi, ecx
lea ecx, [esi + eax]
mov dword [esp + 0x24], ecx
lea ecx, [edx + ebp]
xor edx, edx
push edi
mov edi, dword [esp + 0x80]
mov ebx, dword [edi + 0x6860]
mov dword [esp + 0x18], edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x14], edx
lea edx, [edi + 0x1004]
mov dword [esp + 0x1c], edx
mov edx, dword [edi + 0x6814]
mov dword [esp + 0x38], edx
mov edx, dword [edi + 0x6818]
mov dword [esp + 0x34], edx
mov edx, dword [edi + 0x681c]
mov dword [esp + 0x30], edx
mov edx, dword [edi + 0x6858]
push edx
push eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edi + 0x685c]
mov dword [esp + 0x28], ecx
add ebx, ecx
push esi
lea ecx, [edi + 0x1808]
push eax
push ecx
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x30]
lea edx, [esp + 0x98]
call fcn.0045aa10
add esp, 0x18
cmp eax, 0xffffff88
ja 0x45b3e5
cmp dword [esp + 0x80], 0
lea edx, [eax + esi]
je 0x45b3a5
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x74], eax
add eax, ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x28]
mov esi, 1
sub eax, edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x44], esi
mov dword [esp + 0x70], esi
call fcn.00458870
cmp eax, 0xffffff88
jbe 0x45b2c6
mov eax, 0xffffffec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
lea edx, [esp + 0x58]
push edx
mov eax, edi
lea edx, [esp + 0x4c]
call fcn.00458a20
lea eax, [esp + 0x64]
add esp, 4
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x4c]
call fcn.00458a20
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x6c]
add esp, 4
push ecx
lea edx, [esp + 0x4c]
call fcn.00458a20
add esp, 4
lea ecx, [esp + 0x48]
call fcn.00458970
cmp eax, 2
jg 0x45b397
jmp 0x45b325
mov esi, 1
cmp dword [esp + 0x80], 0
je 0x45b3a5
sub dword [esp + 0x80], esi
lea edx, [esp + 0x3c]
push edx
lea esi, [esp + 0x4c]
call fcn.0045adf0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esp, 4
push eax
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x4c]
push ebx
lea eax, [esp + 0x30]
push eax
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x64]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x44]
mov dword [eax + 8], ecx
push edx
mov eax, ebp
call fcn.0045b000
add esp, 0x24
cmp eax, 0xffffff88
ja 0x45b3e5
mov ecx, esi
add ebp, eax
call fcn.00458970
cmp eax, 2
jle 0x45b320
cmp dword [esp + 0x80], 0
jne 0x45b2b9
mov ecx, dword [esp + 0x20]
mov eax, ebx
sub eax, ecx
cmp ecx, ebx
ja 0x45b2b9
lea esi, [eax + ebp]
cmp esi, dword [esp + 0x24]
jbe 0x45b3cb
mov eax, 0xffffffba
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
test eax, eax
jbe 0x45b3dc
push eax
push ecx
push ebp
call fcn.005e47d0
add esp, 0xc
mov ebp, esi
mov eax, ebp
sub eax, dword [esp + 0x84]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret