joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464a57
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x4fa0c6
call fcn.004e3337
mov ebx, ecx
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
test eax, eax
jle 0x464b2d
mov esi, dword [0x542750]
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
lea edi, [eax - 1]
test edi, edi
js 0x464ad5
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov eax, dword [ebx]
push dword [eax + edi*4]
lea eax, [ebp - 0x10]
push 0x525754
push eax
call fcn.0040301c
mov eax, dword [ebp - 0x10]
add esp, 0xc
cmp dword [eax - 8], 0
je 0x464abb
push eax
push dword [eax - 8]
lea ecx, [ebp - 0x14]
call fcn.00402988
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.00403030
dec edi
js 0x464ad2
mov esi, dword [0x542750]
jmp 0x464a89
mov esi, dword [ebp - 0x14]
mov edi, dword [esi - 8]
xor ecx, ecx
inc edi
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d5f08
lea ecx, [edi + edi]
mov ebx, eax
push ecx
push 0
push ebx
call fcn.004db6f0
mov ecx, ebx
add esp, 0x10
sub ecx, esi
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x464b04
xor eax, eax
push eax
push eax
push ebx
push 0x464b33
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x14]
call fcn.00403030
call fcn.004e3305
ret
Function at 0x466a1f
Capabilities:
Delete file
Read file on windows

Disassembly:
push 0x264
mov eax, 0x4ff656
call fcn.004e336a
mov ebx, ecx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004db6f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.004d73be
pop ecx
pop ecx
xor ecx, ecx
lea esi, [ebx + 0xc]
mov word [eax + 2], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
mov dword [ebp - 0x220], esi
call fcn.004028a2
push 0x514de0
mov ecx, esi
call fcn.00402a02
push 0x525bb4
push dword [esi]
lea eax, [ebp - 0x21c]
push eax
call fcn.004d8c6e
add esp, 0xc
lea ecx, [ebp - 0x240]
push 0
call fcn.004bc970
and dword [ebp - 4], 0
cmp dword [ebp - 0x21c], 0
je 0x466b44
push 2
push 0
push dword [ebp - 0x21c]
call fcn.004d99a0
add esp, 0xc
push dword [ebp - 0x21c]
call fcn.004d9db3
pop ecx
push 0
push 0
push dword [ebp - 0x21c]
mov esi, eax
call fcn.004d99a0
add esp, 0xc
lea eax, [esi + 1]
push eax
call fcn.004d5f08
mov edi, eax
pop ecx
mov byte [edi + esi], 0
push dword [ebp - 0x21c]
push 1
push esi
push edi
call fcn.004d9fe4
push dword [ebp - 0x21c]
call fcn.004d8de9
add esp, 0x14
lea edx, [ebp - 0x240]
mov ecx, edi
push str.data
call fcn.00411163
pop ecx
push edi
call fcn.004d5e39
pop ecx
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
jmp 0x466b55
mov ecx, esi
call fcn.00466c89
add esi, 0x2c
cmp esi, edi
jne 0x466b4b
mov eax, dword [ebx]
lea ecx, [ebp - 0x240]
mov dword [ebx + 4], eax
call fcn.004be060
test al, al
je 0x466c63
push str.record_list
lea ecx, [ebp - 0x240]
call fcn.004bcd40
push eax
lea ecx, [ebp - 0x230]
call fcn.004bc800
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.004bde50
test al, al
je 0x466c54
mov eax, dword [0x542750]
and dword [ebp - 0x264], 0
and dword [ebp - 0x268], 0
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x26c], 2
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
xor esi, esi
call fcn.004be3f0
test eax, eax
je 0x466c49
push esi
lea ecx, [ebp - 0x230]
call fcn.004bcc50
sub esp, 0x10
mov ecx, esp
push eax
call fcn.004bc800
inc esi
lea edx, [ebp - 0x26c]
mov ecx, esi
call fcn.00466cc5
add esp, 0x10
test eax, eax
je 0x466c49
lea eax, [ebp - 0x26c]
mov ecx, ebx
push eax
call fcn.00467130
lea ecx, [ebp - 0x230]
call fcn.004be3f0
cmp esi, eax
jb 0x466c00
lea ecx, [ebp - 0x26c]
call fcn.00466c89
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.004bcaa0
mov ecx, dword [ebp - 0x220]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.004bcaa0
xor eax, eax
inc eax
call fcn.004e3319
ret
Function at 0x467419
Capabilities:
Read .ini file

Disassembly:
push 0x228
mov eax, 0x4ff786
call fcn.004e336a
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
mov edi, 0xfffffff
lea eax, [ebp - 0x216]
push eax
call fcn.004db6f0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x104
push eax
push 0x50e6f0
push str.SLG_time
push 0x50f824
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
je 0x467505
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [0x542750]
mov dword [ebp - 0x22c], eax
and dword [ebp - 4], 0
movzx eax, word [ebp - 0x222]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push 0x525a70
push eax
call fcn.0040301c
add esp, 0x10
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x234], esp
push eax
call fcn.00404e83
push ecx
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 1
mov ecx, esp
push eax
call fcn.004028cd
mov byte [ebp - 4], 0
call fcn.00469a7f
pop ecx
pop ecx
lea ecx, [ebp - 0x22c]
mov edi, eax
call fcn.00403030
mov eax, edi
call fcn.004e3319
ret

Function at 0x46763d
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x467655
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 4], 0
mov ecx, esi
call fcn.004676c3
lea ecx, [esi + 0x4bc]
call fcn.00403030
lea ecx, [esi + 0x4b8]
call fcn.00403030
lea ecx, [esi + 0x4ac]
call fcn.00411042
lea ecx, [esi + 0x4a0]
call fcn.00411042
lea ecx, [esi + 0x494]
call fcn.0040cbb0
lea ecx, [esi + 0x488]
call fcn.00469431
lea ecx, [esi + 0x480]
call fcn.004231c9
lea ecx, [esi + 0x478]
call fcn.00469280
lea eax, [esi + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop esi
ret
Function at 0x467984
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4679ae
xor eax, eax
jmp 0x467a6c
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4679c7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x467a24
lea ebx, [edi + 1]
push ebx
call fcn.004d5f08
push ebx
push 0
push eax
mov dword [ebp - 8], eax
call fcn.004db6f0
and dword [ebp - 0xc], 0
add esp, 0x10
test edi, edi
je 0x467a10
mov ebx, dword [ebp - 0xc]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
mov eax, edi
sub eax, ebx
push eax
mov eax, dword [ebp - 8]
add eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
add ebx, dword [ebp - 4]
cmp edi, ebx
jne 0x4679ea
lea ebx, [edi + 1]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004d5f08
mov esi, eax
pop ecx
test esi, esi
jne 0x467a28
xor eax, eax
jmp 0x467a6b
push ebx
push 0
push esi
call fcn.004db6f0
mov ebx, dword [ebp - 8]
add esp, 0xc
mov edx, esi
push 0x100
push ecx
push edi
mov ecx, ebx
call fcn.004137eb
push esi
call fcn.004066fa
mov ecx, dword [ebp + 8]
add esp, 0x10
push eax
push esi
call fcn.00406809
push ebx
call fcn.004d5e39
push esi
call fcn.004d5e39
pop ecx
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468fd6
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x4f901b
call fcn.004e3337
push dword [ebp + 8]
call fcn.004b33a3
test eax, eax
jne 0x468ff5
xor ebx, ebx
inc ebx
mov esi, ebx
jmp 0x469017
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004ae024
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
xor ebx, ebx
xor esi, esi
inc ebx
cmp dword [eax - 8], esi
cmove esi, ebx
call fcn.00403030
mov eax, dword [0x542750]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], bl
push 0x51e100
push eax
call fcn.0040301c
add esp, 0xc
push dword [0x543e38]
push 0
push dword [ebp - 0x10]
push str.SLGAddGameID
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
lea ecx, [ebp - 0x14]
call fcn.00403030
lea ecx, [ebp - 0x10]
call fcn.00403030
mov eax, esi
call fcn.004e3305
ret 4
Function at 0x4698e0
Capabilities:
Get file size
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5415b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], edx
xor eax, eax
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
mov dword [ebp - 0x30], 0x10
stosd dword es:[edi], eax
mov esi, ecx
push 0xf0000000
push 1
push ebx
stosd dword es:[edi], eax
push ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push ebx
test eax, eax
jne 0x469951
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x469a6e
push 0x80
push 3
push ebx
push ebx
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x28], edi
cmp edi, 0xffffffff
jne 0x46997c
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
jmp 0x469941
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x400
push 1
call fcn.004da158
mov esi, eax
mov dword [ebp - 0x2c], esi
pop ecx
pop ecx
test esi, esi
jne 0x4699c3
jmp 0x469970
cmp dword [ebp - 0x20], ebx
je 0x4699dc
push ebx
push dword [ebp - 0x20]
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4699dc
push 0x400
push ebx
push esi
call fcn.004db6f0
add esp, 0xc
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ebx
push eax
push 0x400
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46999d
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x14]
push eax
push 2
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x469a1e
mov edi, dword [ebp - 0x24]
mov esi, ebx
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02x
push 3
push edi
call fcn.004d7117
add esp, 0x10
add edi, 2
inc esi
cmp esi, 0x10
jl 0x4699f9
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004d6e42
mov edi, dword [ebp - 0x24]
mov esi, edi
pop ecx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x469a47
sub esi, ecx
test esi, esi
jle 0x469a6b
movsx ax, byte [edi + ebx]
movzx eax, ax
push eax
call fcn.004da147
mov byte [edi + ebx], al
inc ebx
pop ecx
cmp ebx, esi
jl 0x469a54
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret
Function at 0x46b6a0
Capabilities:
Read .ini file

Disassembly:
push 0x19c
mov eax, 0x4fff8a
call fcn.004e336a
mov edi, ecx
push dword [0x543e38]
mov esi, str.favorite
push 1
push str.AutoAddIEFav
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ebx, ebx
test eax, eax
je 0x46b6e1
call fcn.0046a809
push ebx
push str.AutoAddIEFav
push esi
call fcn.004309c7
mov eax, dword [0x542750]
mov esi, ebx
mov dword [ebp - 0x190], eax
push str.SimpleBrowser.xml
push 0x547b18
lea eax, [ebp - 0x190]
mov dword [ebp - 4], ebx
push 0x50de04
push eax
call fcn.0040301c
add esp, 0x10
lea ecx, [ebp - 0x18c]
call fcn.004ad305
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18c]
push dword [ebp - 0x190]
call fcn.004ad334
test eax, eax
je 0x46b802
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x198], ebx
lea eax, [ebp - 0x198]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x18c]
call fcn.004ad4d1
mov dword [ebp - 0x1a4], ebx
mov dword [ebp - 0x1a8], ebx
lea eax, [ebp - 0x1a8]
mov byte [ebp - 4], 3
push eax
push str.favorite
lea ecx, [ebp - 0x198]
call fcn.004acc87
test eax, eax
je 0x46b795
push edi
xor edx, edx
lea ecx, [ebp - 0x1a8]
call fcn.0046b185
pop ecx
mov esi, eax
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x1a0], ebx
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 4
push eax
push str.favoritefloder
lea ecx, [ebp - 0x198]
call fcn.004acc87
test eax, eax
je 0x46b7d5
xor edx, edx
lea ecx, [ebp - 0x1a0]
push edi
inc edx
call fcn.0046b185
test eax, eax
pop ecx
cmovne esi, eax
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 3
call fcn.004acc5c
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 2
call fcn.004acc5c
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 1
call fcn.004acc5c
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call dword [sym.imp.tinyxml.dll_public_virtual:_void___thiscall_TiXmlDocument::destructor_void_]
lea ecx, [ebp - 0x190]
call fcn.00403030
mov eax, esi
call fcn.004e3319
ret
Function at 0x46b873
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fffea
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.004e7570
mov eax, dword [0x5415b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and dword [ebp - 0x101c], 0
mov eax, dword [0x542750]
mov dword [ebp - 0x1020], esi
mov dword [esi], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1014]
xor ebx, ebx
inc ebx
push edi
mov dword [ebp - 0x101c], ebx
call fcn.00404e83
push 4
lea eax, [ebp - 0x1018]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x1014]
call fcn.0040fb27
push eax
lea ecx, [ebp - 0x1014]
mov byte [ebp - 4], 2
call fcn.00402a9f
lea ecx, [ebp - 0x1018]
mov byte [ebp - 4], bl
call fcn.00403030
lea ecx, [ebp - 0x1014]
call fcn.00402c72
push dword [ebp - 0x1014]
call dword [sym.imp.USER32.dll_CharLowerW]
push str..url
lea ecx, [ebp - 0x1014]
call fcn.0040e07c
test eax, eax
jne 0x46b982
push 0xffe
push eax
mov word [ebp - 0x1010], ax
lea eax, [ebp - 0x100e]
push eax
call fcn.004db6f0
add esp, 0xc
lea eax, [ebp - 0x1010]
push edi
push 0x800
push eax
push 0x50e6f0
push 0x50f2c0
push 0x50f29c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x1010]
mov ecx, esi
push eax
call fcn.004028a2
lea ecx, [ebp - 0x1014]
call fcn.00403030
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret
Function at 0x46c3b9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x46c44f
push esi
mov esi, edi
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x46c3d2
sub esi, ecx
sar esi, 1
cmp esi, 0x104
ja 0x46c44e
push 0x20
call fcn.004d6a5a
mov esi, eax
pop ecx
test esi, esi
je 0x46c423
mov ecx, dword [0x542750]
mov dword [esi + 0x10], ecx
mov ecx, dword [0x542750]
mov dword [esi + 0x14], ecx
mov ecx, dword [0x542750]
mov dword [esi + 0x18], ecx
mov eax, dword [0x542750]
mov dword [esi + 0x1c], eax
and dword [esi], 0
and dword [esi + 4], 0
jmp 0x46c425
xor esi, esi
push edi
lea ecx, [esi + 0x10]
call fcn.004028a2
push ebx
lea ecx, [esi + 0x14]
call fcn.004028a2
mov eax, dword [ebp + 8]
mov dword [esi], eax
xor eax, eax
push eax
push eax
push esi
push 0x46c2b3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46d634
Capabilities:
Check if file exists
Create process on windows
Terminate process

Disassembly:
push 0x86c
mov eax, 0x5002ee
call fcn.004e336a
mov dword [ebp - 0x814], edx
mov dword [ebp - 0x81c], ecx
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
push 0x44
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x878]
push esi
push eax
call fcn.004db6f0
xor eax, eax
mov dword [ebp - 0x878], 0x44
lea edi, [ebp - 0x830]
mov dword [ebp - 0x84c], 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x848], ax
mov eax, dword [0x542750]
mov dword [ebp - 0x818], eax
mov edi, str.6wanWebGame.exe
mov dword [ebp - 4], esi
push edi
push 0x547f70
lea eax, [ebp - 0x818]
push 0x50de04
push eax
call fcn.0040301c
add esp, 0x1c
push dword [ebp - 0x818]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46d7cc
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push esi
push eax
call fcn.004db6f0
push dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push dword [ebp - 0x81c]
push edi
push str._s__d_s
push eax
call fcn.00413df2
add esp, 0x20
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x878]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x46d7c3
mov ecx, dword [ebp - 0x820]
mov eax, dword [ebp - 0x830]
push 0xffffffffffffffff
push eax
mov dword [ecx], eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov dword [ebp - 0x814], esi
mov edi, esi
jmp 0x46d78d
lea eax, [ebp - 0x814]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x814]
cmp eax, dword [ebp - 0x828]
je 0x46d7a6
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0xa
cmp edi, 0xbb8
jg 0x46d7a6
push esi
push str.6wanWebGame
push esi
push dword [ebp - 0x81c]
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebx], eax
test eax, eax
jne 0x46d75d
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx], esi
jne 0x46d7c3
push esi
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
cmp dword [ebx], esi
setne al
mov esi, eax
lea ecx, [ebp - 0x818]
call fcn.00403030
mov eax, esi
call fcn.004e3319
ret
Function at 0x46ff50
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x50092c
call fcn.004e3337
xor edi, edi
push 0x24
mov dword [ebp - 4], edi
call fcn.004d6a5a
pop ecx
test eax, eax
je 0x46ff78
mov ecx, eax
call fcn.004420f8
mov esi, eax
jmp 0x46ff7a
mov esi, edi
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.0044438e
push edi
push edi
push esi
push 0x47017b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp + 8]
call fcn.00445a0c
call fcn.004e3305
ret

Function at 0x47535d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x5415b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5482e0]
push ebx
mov ebx, edx
push esi
push edi
test eax, eax
je 0x47539a
push eax
push 0x527230
lea eax, [ebp - 0x110]
push eax
push 0xe6
call fcn.00473537
add esp, 0x10
jmp 0x475412
call fcn.00474b85
mov esi, 0xe6
test eax, eax
je 0x4753db
lea eax, [ebp - 0x318]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x318]
call fcn.00474c39
mov edi, eax
test edi, edi
jne 0x4753f6
push 7
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x218]
call fcn.00474cf2
jmp 0x4753c1
push edi
push 0x527230
lea eax, [ebp - 0x110]
push eax
push esi
call fcn.00473537
push edi
call fcn.004d6e42
add esp, 0x14
lea ecx, [ebp - 0x110]
call fcn.00473cc8
test eax, eax
je 0x47542b
cmp byte [ecx + eax - 1], 0x5c
jne 0x47542b
dec eax
jne 0x475421
cmp eax, 0x105
jae 0x47548d
mov byte [ebp + eax - 0x110], 0
lea eax, [ebp - 0x110]
push eax
push str._setilqs_
push ebx
push 0xe7
call fcn.00473537
mov ecx, ebx
call fcn.00473cc8
mov esi, eax
lea ecx, [ebx + esi]
push ecx
push 0x14
pop edi
push edi
call fcn.004736aa
add esp, 0x18
movzx eax, byte [ebx + esi]
xor edx, edx
push 0x3e
pop ecx
div ecx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ebx + esi], al
inc esi
dec edi
jne 0x47546a
mov byte [ebx + esi], 0
xor eax, eax
jmp 0x4753ca
call fcn.004d8504
int3
Function at 0x4758b9
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5415b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x110]
mov edi, 0x200
push eax
push 0x104
push edx
push ecx
mov dword [ebp - 0x118], edi
call fcn.004757ec
add esp, 0x10
test eax, eax
jne 0x475992
lea ecx, [ebp - 0x110]
call fcn.00475321
mov esi, eax
test esi, esi
je 0x475998
call fcn.00474b85
test eax, eax
mov eax, esi
je 0x475953
xor ecx, ecx
cmp word [esi], cx
je 0x475934
cmp word [eax], 0x5c
je 0x47592f
add eax, 2
cmp word [eax], cx
jne 0x47591f
jmp 0x475934
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x475985
cmp byte [esi], 0
je 0x475968
cmp byte [eax], 0x5c
je 0x475965
inc eax
cmp byte [eax], 0
jne 0x475958
jmp 0x475968
mov byte [eax], 0
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov ebx, eax
call fcn.004d6e42
pop ecx
test ebx, ebx
je 0x475998
mov edi, dword [ebp - 0x118]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret
Function at 0x48c50b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, edx
mov eax, ecx
mov dword [esp + 4], eax
push esi
push edi
test ebx, ebx
jne 0x48c528
xor eax, eax
jmp 0x48c60a
push 0x44
pop edx
call fcn.004724bd
mov edi, eax
test edi, edi
je 0x48c521
mov esi, dword [ebp + 8]
mov edx, dword [ebx]
mov ecx, dword [esp + 0xc]
push esi
call fcn.0048c23e
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi], eax
mov edx, dword [ebx + 8]
push esi
call fcn.0048c33f
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi + 8], eax
mov edx, dword [ebx + 0xc]
push 0
push esi
call fcn.0048c01c
mov ecx, dword [esp + 0x14]
mov dword [edi + 0xc], eax
mov edx, dword [ebx + 0x10]
push esi
call fcn.0048c23e
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x10], eax
mov edx, dword [ebx + 0x14]
push 0
push esi
call fcn.0048c01c
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x14], eax
mov edx, dword [ebx + 0x18]
push esi
call fcn.0048c23e
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [edi + 0x18], eax
mov al, byte [ebx + 4]
mov byte [edi + 4], al
mov edx, dword [ebx + 0x1c]
push esi
call fcn.0048c50b
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x1c], eax
mov edx, dword [ebx + 0x28]
push 0
push esi
call fcn.0048c01c
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x28], eax
mov edx, dword [ebx + 0x2c]
push 0
push esi
call fcn.0048c01c
mov dword [edi + 0x2c], eax
xor edx, edx
mov dword [edi + 0x30], edx
mov ecx, 0xfff7
mov dword [edi + 0x34], edx
add esp, 0x10
mov ax, word [ebx + 6]
and ax, cx
mov dword [edi + 0x24], edx
mov word [edi + 6], ax
mov eax, edi
or dword [edi + 0x38], 0xffffffff
or dword [edi + 0x3c], 0xffffffff
or dword [edi + 0x40], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret