joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d236d
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x5d239b
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x5d2392
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x5d238a
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5d23bc
mov esp, ebp
pop ebp
ret

Function at 0x5d23c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x5d242c
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x5d2459
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x5d2448
xor ecx, eax
xor edx, ebx
dec edi
jne 0x5d2439
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x5d247f
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x5d2420
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x5d24ab
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5d2aa1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x5d2ab1
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jle 0x5d2b06
push dword [ebp + 8]
call fcn.005d2cb2
mov dword [ebp - 0x24], eax
cmp word [ebp - 0x24], 0x5a4d
jne 0x5d2b06
xor eax, eax
jmp 0x5d2b0b
mov eax, 1
test eax, eax
je 0x5d2b1d
mov eax, 0
jmp 0x5d2cac
push 0x3c
push dword [ebp + 8]
call fcn.005d2cf4
push eax
call fcn.005d2cce
push eax
push dword [ebp + 8]
call fcn.005d2cf4
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.005d2cce
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4550
jne 0x5d2b78
push 0x7c
push dword [ebp - 4]
call fcn.005d2cf4
push eax
call fcn.005d2cce
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x5d2b78
xor eax, eax
jmp 0x5d2b7d
mov eax, 1
test eax, eax
je 0x5d2b8f
mov eax, 0
jmp 0x5d2cac
push 0x78
push dword [ebp - 4]
call fcn.005d2cf4
push eax
call fcn.005d2cce
push eax
push dword [ebp + 8]
call fcn.005d2cf4
mov dword [ebp - 8], eax
push 0x20
push dword [ebp - 8]
call fcn.005d2cf4
push eax
call fcn.005d2cce
push eax
push dword [ebp + 8]
call fcn.005d2cf4
push eax
call fcn.005d2cce
push eax
push dword [ebp + 8]
call fcn.005d2cf4
mov dword [ebp - 0xc], eax
push 0x18
push dword [ebp - 8]
call fcn.005d2cf4
push eax
call fcn.005d2cce
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0x10]
call fcn.005d2d1b
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x5d2c9f
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.005d2cf4
mov dword [ebp - 0x14], eax
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call fcn.005d2d42
test eax, eax
je 0x5d2c82
push 0x1c
push dword [ebp - 8]
call fcn.005d2cf4
push eax
call fcn.005d2cce
push eax
push dword [ebp + 8]
call fcn.005d2cf4
mov dword [ebp - 0x24], eax
push 4
push dword [ebp - 0x10]
call fcn.005d2d76
push eax
push dword [ebp - 0x24]
call fcn.005d2cf4
push eax
call fcn.005d2cce
push eax
push dword [ebp + 8]
call fcn.005d2cf4
jmp 0x5d2cac
push dword [ebp - 0x14]
call fcn.005d2d9e
push eax
push dword [ebp - 0x18]
call fcn.005d2cf4
mov dword [ebp - 0x18], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x5d2c0b
add esp, 0xc
mov eax, 0
jmp 0x5d2cac
mov esp, ebp
pop ebp
ret 8
Function at 0x403110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403127
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40313b
pop esi
pop edi
xor eax, eax
pop ebp
ret
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x40315e
lea ebx, [ebx]
cmp esi, eax
jae 0x403135
dec edi
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x403150
cmp esi, eax
jae 0x403135
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x403230
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
push edi
lea ebp, [esi + 0x30]
push ebp
mov dword [esp + 0xc], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [esi + 0x2c]
test al, al
je 0x403266
test ebx, ebx
jbe 0x40329b
mov edi, dword [esp + 0x14]
mov eax, 1
mov ecx, ebx
push ebp
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
pop ecx
ret 8
xor eax, eax
test ebx, ebx
jbe 0x40329b
mov ecx, dword [esp + 0x10]
shl ecx, 2
mov edx, dword [esp + 0x10]
mov edi, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
add edx, eax
shr edx, 3
mov edx, dword [edi + edx*4]
xor edx, dword [ecx + ebp]
mov edi, dword [esp + 0x14]
mov dword [edi + eax*4], edx
inc eax
add ecx, 4
cmp eax, ebx
jb 0x403273
mov ebp, dword [esp + 8]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
pop ecx
ret 8
Function at 0x40a240
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x2dc
push ebx
push ebp
push esi
xor esi, esi
xor ebp, ebp
test eax, eax
mov ebx, 1
je 0x40a261
mov byte [esp + 0xf], 0
jmp 0x40a28c
lea eax, [esp + 0x2f8]
push eax
push 0x20019
push 0
push str.Enum
push reloc.WS2_32.dll_bind
mov byte [esp + 0x23], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a430
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x300]
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.class
push ecx
mov dword [esp + 0x2c], 0x40
call edi
test eax, eax
jne 0x40a35a
cmp dword [esp + 0x18], ebx
jne 0x40a35a
mov eax, dword [esp + 0x2f0]
lea edx, [esp + 0x2c]
push edx
push eax
call fcn.005654a6
add esp, 8
test eax, eax
jne 0x40a35a
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x300]
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push str.driver
push ecx
mov dword [esp + 0x2c], 0x80
call edi
test eax, eax
jne 0x40a35a
cmp dword [esp + 0x18], ebx
jne 0x40a35a
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0x1f0]
push str.SystemCurrentControlSetServicesClass_s
push eax
call fcn.0055e68c
mov ecx, dword [esp + 0x300]
add esp, 0xc
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x1f8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a35a
mov esi, ebx
mov edi, dword [esp + 0x2f8]
cmp edi, esi
jle 0x40a42f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x300]
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x100]
push edx
push 0
push eax
mov dword [esp + 0x3c], 0x100
call ebx
test eax, eax
jne 0x40a42f
mov eax, dword [esp + 0x2fc]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push 0
lea edx, [esp + 0xf8]
push edx
push eax
inc ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a3fc
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2f4]
push ecx
mov edx, edi
sub edx, esi
push edx
mov edx, dword [esp + 0x2f8]
lea ecx, [eax + esi*4]
push ecx
push edx
call fcn.0040a240
add esi, eax
mov eax, dword [esp + 0x30]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x300]
push 0
push 0
push 0
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x100]
push eax
push ebp
push ecx
mov dword [esp + 0x3c], 0x100
call ebx
test eax, eax
je 0x40a3a3
pop edi
mov eax, dword [esp + 0x2f8]
test eax, eax
je 0x40a44a
mov cl, byte [esp + 0xf]
test cl, cl
je 0x40a44a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret
Function at 0x40adb0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push edi
lea ebx, [esi + 0x30]
push ebx
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
xor edx, edx
test eax, eax
jbe 0x40ae3d
mov ecx, dword [esi + 0x20]
push ebp
mov ebp, dword [esi + 0x28]
mov eax, edi
shr eax, 3
shl eax, 2
mov ebx, dword [ecx + eax]
sub ebp, ebx
mov ebx, dword [esi + 0x24]
mov dword [esi + 0x28], ebp
mov ebx, dword [ebx + eax]
mov ebp, dword [esi + 0x1c]
xor ebx, dword [ebp + edi*4]
mov ebp, dword [ecx + eax]
sub ebp, ebx
mov ebx, dword [esp + 0x18]
mov dword [ecx + eax], ebp
mov ebp, dword [ebx + edx*4]
mov ecx, dword [esi + 0x24]
mov ecx, dword [ecx + eax]
xor ecx, ebp
mov ebp, dword [esi + 0x1c]
mov dword [ebp + edi*4], ecx
mov ecx, dword [esi + 0x20]
mov ebx, dword [ebx + edx*4]
mov ebp, dword [ecx + eax]
add ecx, eax
add ebp, ebx
mov dword [ecx], ebp
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx + eax]
mov ebx, dword [esi + 0x28]
add ebx, eax
mov eax, dword [esp + 0x1c]
inc edx
inc edi
cmp edx, eax
mov dword [esi + 0x28], ebx
jb 0x40add3
mov ebx, dword [esp + 0xc]
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
pop ecx
ret 0xc
Function at 0x40c2f0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x5711ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x124], 2
mov ebp, dword [esp + 0x134]
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov eax, dword [0x921460]
mov edi, dword [esp + 0x130]
push eax
push 0x100
lea ecx, [esp + 0x24]
push ecx
push 0
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
mov ebx, dword [esp + 0x138]
jne 0x40c3da
push ecx
lea eax, [ebx - 0x10]
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.00418740
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x12c], 3
lea eax, [ebp - 0x10]
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00418740
add eax, 0x10
mov dword [esi], eax
lea eax, [edi - 0x10]
mov dword [esp + 0x24], esp
mov esi, esp
push eax
mov byte [esp + 0x134], 4
call fcn.00418740
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [esp + 0x130], 2
call fcn.0040c470
add esp, 0xc
test eax, eax
je 0x40c3da
lea edx, [esp + 0x1c]
mov eax, ebx
sub edx, ebx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c3d0
mov esi, dword [esp + 0x12c]
push esi
lea ecx, [esp + 0x20]
call fcn.00407c70
add edi, 0xfffffff0
mov byte [esp + 0x124], 1
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40c40d
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
add ebp, 0xfffffff0
mov byte [esp + 0x124], 0
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c430
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
add ebx, 0xfffffff0
mov dword [esp + 0x124], 0xffffffff
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c455
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
mov ecx, dword [esp + 0x11c]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x118
ret
Function at 0x413450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x572672
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov ebp, vtable.Xenesis2::Foundation::Memory::xEncryptData_int_.0
push 1
mov dword [edi + 8], ebp
call fcn.004cee70
mov ecx, eax
call fcn.0040ae50
push 1
lea ecx, [esp + 0x18]
push ecx
xor ebx, ebx
push eax
mov dword [edi + 0xc], eax
mov dword [esp + 0x20], ebx
call fcn.004cee70
mov esi, eax
call fcn.0040adb0
mov dword [esp + 0x20], ebx
push 1
mov dword [edi + 0x10], ebp
call fcn.004cee70
mov ecx, eax
call fcn.0040ae50
push 1
lea edx, [esp + 0x18]
push edx
push eax
mov dword [edi + 0x14], eax
mov dword [esp + 0x20], ebx
call fcn.004cee70
mov esi, eax
call fcn.0040adb0
mov byte [esp + 0x20], 1
push 1
mov dword [edi + 0x18], vtable.Xenesis2::Foundation::Memory::xEncryptData_bool_.0
call fcn.004cee70
mov ecx, eax
call fcn.0040ae50
push 1
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [edi + 0x1c], eax
mov byte [esp + 0x1c], bl
call fcn.004cee70
mov esi, eax
call fcn.0040adb0
mov byte [esp + 0x20], 2
push 1
mov dword [edi + 0x20], ebp
call fcn.004cee70
mov ecx, eax
call fcn.0040ae50
push 1
lea edx, [esp + 0x18]
push edx
push eax
mov dword [edi + 0x24], eax
mov dword [esp + 0x20], ebx
call fcn.004cee70
mov esi, eax
call fcn.0040adb0
mov byte [esp + 0x20], 3
push 1
mov dword [edi + 0x28], vtable.Xenesis2::Foundation::Memory::xEncryptData_bool_.0
call fcn.004cee70
mov ecx, eax
call fcn.0040ae50
push 1
lea ecx, [esp + 0x14]
mov dword [edi + 0x2c], eax
mov byte [esp + 0x14], bl
push ecx
push eax
call fcn.004cee70
mov esi, eax
call fcn.0040adb0
mov byte [esp + 0x20], 4
push 1
mov dword [edi + 0x30], vtable.Xenesis2::Foundation::Memory::xEncryptData_bool_.0
call fcn.004cee70
mov ecx, eax
call fcn.0040ae50
push 1
lea edx, [esp + 0x14]
push edx
push eax
mov dword [edi + 0x34], eax
mov byte [esp + 0x1c], bl
call fcn.004cee70
mov esi, eax
call fcn.0040adb0
mov byte [esp + 0x20], 5
push 1
mov dword [edi + 0x38], ebp
call fcn.004cee70
mov ecx, eax
call fcn.0040ae50
push 1
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [edi + 0x3c], eax
mov dword [esp + 0x20], ebx
call fcn.004cee70
mov esi, eax
call fcn.0040adb0
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x4135f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x572672
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov dword [esp + 0x14], 5
mov eax, dword [esi + 0x3c]
push 1
mov ebx, vtable.Xenesis2::Foundation::Memory::xEncryptData_int_.0
push eax
mov dword [esi + 0x38], ebx
call fcn.004cee70
mov edi, eax
call fcn.0040aeb0
mov byte [esp + 0x14], 4
mov ecx, dword [esi + 0x34]
push 1
push ecx
mov dword [esi + 0x30], vtable.Xenesis2::Foundation::Memory::xEncryptData_bool_.0
call fcn.004cee70
mov edi, eax
call fcn.0040aeb0
mov byte [esp + 0x14], 3
mov edx, dword [esi + 0x2c]
push 1
push edx
mov dword [esi + 0x28], vtable.Xenesis2::Foundation::Memory::xEncryptData_bool_.0
call fcn.004cee70
mov edi, eax
call fcn.0040aeb0
mov byte [esp + 0x14], 2
mov eax, dword [esi + 0x24]
push 1
push eax
mov dword [esi + 0x20], ebx
call fcn.004cee70
mov edi, eax
call fcn.0040aeb0
mov byte [esp + 0x14], 1
mov ecx, dword [esi + 0x1c]
push 1
push ecx
mov dword [esi + 0x18], vtable.Xenesis2::Foundation::Memory::xEncryptData_bool_.0
call fcn.004cee70
mov edi, eax
call fcn.0040aeb0
mov byte [esp + 0x14], 0
mov edx, dword [esi + 0x14]
push 1
push edx
mov dword [esi + 0x10], ebx
call fcn.004cee70
mov edi, eax
call fcn.0040aeb0
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esi + 0xc]
push 1
push eax
mov dword [esi + 8], ebx
call fcn.004cee70
mov edi, eax
call fcn.0040aeb0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x413f10
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, eax
cmp esi, dword [0x892d1c]
je 0x414139
mov ecx, dword [0x892d5c]
xor eax, eax
cmp ecx, eax
jne 0x414139
push ebx
push edi
push eax
push 0x5f0c20
push 0x5ef1b8
push eax
mov byte [0x89ff61], al
mov byte [0x89ff7d], al
call fcn.004cf280
mov ebx, 0x5ef146b
mov edi, eax
call fcn.004032b0
push eax
call fcn.0055ffd5
xor edi, edi
add esp, 0x14
cmp eax, edi
je 0x413f6c
call fcn.005237d0
mov eax, dword [0x892d1c]
mov ecx, dword [eax*4 + 0x892698]
cmp ecx, edi
je 0x413f81
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, 0x921468
call fcn.0053bd10
mov ecx, 0x89872c
mov dword [0x921470], edi
mov dword [0x921474], edi
mov dword [0x898734], edi
call fcn.0053bd10
push 0x2710
mov eax, 0x89873c
call fcn.004c7780
cmp esi, 0xf
jne 0x413fee
push str.SoftnyxGunBound.gme
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x413fe3
cmp esi, edi
je 0x413fe3
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop ebx
pop esi
ret
mov ecx, dword [0x8927a4]
add ecx, 0x57f48
mov eax, str.b_gamelist_buddyup
call fcn.00402fc0
mov ecx, dword [0x8927a4]
add ecx, 0x57f48
mov eax, str.b_gamelist_buddydown
call fcn.00402fc0
mov ecx, dword [0x8927a4]
add ecx, 0x57f48
mov eax, str.b_gamelist_channelup
call fcn.00402fc0
mov ecx, dword [0x8927a4]
add ecx, 0x57f48
mov eax, str.b_gamelist_channeldown
call fcn.00402fc0
mov ecx, dword [0x8927a4]
add ecx, 0x57f48
mov eax, str.b_buddy_up
call fcn.00402fc0
mov ecx, dword [0x8927a4]
add ecx, 0x57f48
mov eax, str.b_buddy_down
call fcn.00402fc0
mov ecx, dword [0x8927a4]
add ecx, 0x57f48
mov eax, str.b_buddy_exit
call fcn.00402fc0
mov ecx, dword [0x8927a4]
add ecx, 0x57f48
mov eax, str.b_error_confirm
call fcn.00402fc0
mov ecx, dword [0x8927a4]
add ecx, 0x57f48
mov eax, str.cursor
call fcn.00402fc0
mov ebx, dword [0x8927a4]
push str.cursor
add ebx, 0x57f48
call fcn.00403040
push str.normal
mov ecx, 0x8976d0
mov dword [0x8976ec], eax
call fcn.00474810
mov eax, 0x89873c
call fcn.004c7840
mov eax, dword [esi*4 + 0x892698]
test eax, eax
je 0x4140fa
mov ecx, eax
mov edx, dword [ecx]
call dword [edx + 0x20]
mov eax, dword [0x892d1c]
mov dword [0x892d20], eax
mov dword [0x892d1c], esi
call fcn.0053b370
mov al, byte [0x892d24]
test al, al
je 0x414123
pop edi
pop ebx
mov byte [0x892d24], 0
pop esi
ret
pop edi
mov dword [0x5ef2a4], 0xa
mov dword [0x892d28], 0xffffffff
pop ebx
pop esi
ret
Function at 0x419740
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x572672
push eax
mov dword fs:[0], esp
mov al, byte [ebx]
push esi
mov esi, dword [esp + 0x14]
mov byte [esi], al
mov ecx, dword [ebx + 4]
push edi
mov dword [esi + 4], ecx
lea ecx, [ebx + 8]
lea edi, [esi + 8]
call fcn.00417a70
lea ecx, [ebx + 0x10]
lea edi, [esi + 0x10]
mov dword [esp + 0x10], 0
call fcn.00417a70
lea ecx, [ebx + 0x18]
lea edi, [esi + 0x18]
mov byte [esp + 0x10], 1
call fcn.004198f0
lea ecx, [ebx + 0x20]
lea edi, [esi + 0x20]
mov byte [esp + 0x10], 2
call fcn.00417a70
lea ecx, [ebx + 0x28]
lea edi, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.004198f0
lea ecx, [ebx + 0x30]
lea edi, [esi + 0x30]
mov byte [esp + 0x10], 4
call fcn.004198f0
lea ecx, [ebx + 0x38]
lea edi, [esi + 0x38]
mov byte [esp + 0x10], 5
call fcn.00417a70
mov dl, byte [ebx + 0x40]
mov ecx, dword [esp + 8]
mov byte [esi + 0x40], dl
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4

Function at 0x4197f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x57180b
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ecx, ebx
mov edi, esi
call fcn.004198f0
mov dword [esp + 0x10], 0
mov eax, dword [ebx + 8]
lea ecx, [ebx + 0xc]
lea edi, [esi + 0xc]
mov dword [esi + 8], eax
call fcn.00417a70
lea ecx, [ebx + 0x14]
lea edi, [esi + 0x14]
mov byte [esp + 0x10], 1
call fcn.00417a70
mov byte [esp + 0x10], 2
mov cl, byte [ebx + 0x1c]
mov byte [esi + 0x1c], cl
lea ecx, [ebx + 0x20]
lea edi, [esi + 0x20]
call fcn.004198f0
lea ecx, [ebx + 0x28]
lea edi, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.004198f0
mov byte [esp + 0x10], 4
mov dl, byte [ebx + 0x30]
lea ecx, [ebx + 0x34]
lea edi, [esi + 0x34]
mov byte [esi + 0x30], dl
call fcn.00417a70
lea ecx, [ebx + 0x3c]
lea edi, [esi + 0x3c]
mov byte [esp + 0x10], 5
call fcn.004198f0
lea ecx, [ebx + 0x44]
lea edi, [esi + 0x44]
mov byte [esp + 0x10], 6
call fcn.00417a70
lea ecx, [ebx + 0x4c]
lea edi, [esi + 0x4c]
mov byte [esp + 0x10], 7
call fcn.004198f0
lea ecx, [ebx + 0x54]
lea edi, [esi + 0x54]
mov byte [esp + 0x10], 8
call fcn.004198f0
lea ecx, [ebx + 0x5c]
lea edi, [esi + 0x5c]
mov byte [esp + 0x10], 9
call fcn.00417a70
mov al, byte [ebx + 0x64]
mov ecx, dword [esp + 8]
mov byte [esi + 0x64], al
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x443c00
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x104
push ebx
push ebp
mov ebp, dword [esp + 0x114]
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.004cee70
mov ebx, 1
mov esi, eax
call fcn.00403230
mov al, byte [esp + 0x10]
test al, al
jne case.default.0x443c6c
call fcn.0044c620
mov esi, dword [esp + 0x120]
push esi
lea edx, [esp + 0x18]
push str.joker_wall___d_n
push edx
call fcn.0055e68c
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 4
ja case.default.0x443c6c
jmp dword [esi*4 + 0x443d20]
mov ecx, dword [esp + 0x118]
push 1
push 0x2710
push ebp
push ecx
push edi
call fcn.00443210
mov eax, 0x1f5
jmp 0x443d02
mov edx, dword [esp + 0x118]
push 1
push 0x2710
push ebp
push edx
push edi
call fcn.00442f10
mov eax, 0x1f4
jmp 0x443d02
mov eax, dword [esp + 0x118]
push 1
push 0x2710
push ebp
push eax
push edi
call fcn.00443d40
mov eax, 0x1f6
jmp 0x443d02
mov ecx, dword [esp + 0x118]
push 1
push 0x2710
push ebp
push ecx
push edi
call fcn.004435a0
mov eax, 0x1f8
jmp 0x443d02
mov edx, dword [esp + 0x118]
push 1
push 0x2710
push ebp
push edx
push edi
call fcn.004438d0
mov eax, 0x1f9
mov edi, dword [0x8927a4]
add edi, 0x80ce8
call fcn.00417b40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 0xc