joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419180
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418e22

Function at 0x41918b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418fb1

Function at 0x419585
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00409270
mov eax, dword [0x42f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004164e5
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4195c7
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x419723
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004235a0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x489950]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.0041a755
mov ecx, dword [esi*4 + 0x489950]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x41971c
cmp eax, dword [edi + ecx + 0x24]
jne 0x41971c
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41971c
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041a755
add esp, 0x14
test edx, edx
jl 0x41971c
jg 0x419692
test eax, eax
jb 0x41971c
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x41971c
jl 0x4196ac
cmp dword [ebp - 0x1008], eax
ja 0x41971c
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4196ca
test ebx, ebx
je 0x419703
cmp ecx, edi
jae 0x419703
mov al, byte [ecx]
cmp al, 0xd
jne 0x4196e4
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4196f0
cmp byte [ecx + 1], 0xa
jne 0x4196f0
inc ecx
jmp 0x4196f0
movzx eax, al
movsx eax, byte [eax + 0x42f300]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4196ca
cmp edx, ebx
jne 0x4196ca
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x419721
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040833e
leave
ret
Function at 0x419bf3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x489950]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419c33
cmp byte [ebx], 0xa
jne 0x419c33
or byte [eax + edi + 0x28], 4
jmp 0x419c38
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x419d36
mov al, byte [edx]
cmp al, 0x1a
je 0x419d18
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x419c67
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x419c8c
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x419c96
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x419c49
jmp 0x419d36
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419d13
cmp dword [ebp - 0xc], 0
je 0x419d13
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x489950]
test byte [eax + edi + 0x28], 0x48
je 0x419ced
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x419cd8
mov byte [esi], dl
jmp 0x419ce9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x489950]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x419d36
cmp byte [ebp - 1], 0xa
jne 0x419cfc
cmp esi, ebx
jne 0x419cfc
mov byte [esi], 0xa
jmp 0x419d35
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041a773
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x419d36
mov byte [esi], 0xd
jmp 0x419d35
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x489950]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419d32
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419d36
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419d3f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x489950]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x419d82
cmp word [esi], dx
jne 0x419d82
or byte [edi + eax + 0x28], 4
jmp 0x419d87
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x419eda
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x419eba
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x419dc9
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x419dff
cmp eax, edx
jae 0x419e0b
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x419da1
jmp 0x419eda
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x419eb6
cmp dword [ebp - 0x14], 0
je 0x419eb6
mov eax, dword [ebx*4 + 0x489950]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x419e8e
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x419e57
mov word [esi], cx
jmp 0x419e8a
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x489950]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x489950]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x489950]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x419eda
pop ebx
cmp word [ebp - 4], bx
jne 0x419e9f
cmp esi, dword [ebp + 0xc]
jne 0x419e9f
mov word [esi], bx
jmp 0x419ed7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041a773
add esp, 0x10
cmp word [ebp - 4], bx
je 0x419eda
push 0xd
jmp 0x419ed3
mov ecx, dword [ebx*4 + 0x489950]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x419ed1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x419eda
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4039d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push str.__CConfig::Save___n
mov ecx, dword [esi + 4]
add ecx, 0x18fb50
call fcn.00445d20
mov ecx, dword [esi + 4]
add ecx, 0x18fb50
call fcn.00445cf0
lea ecx, [esp + 0x10]
call fcn.00445c60
mov eax, dword [esi + 8]
mov dword [esp + 4], 0
test eax, eax
jne 0x403a23
lea eax, [esp + 4]
push str.BaseTgameconf.ini
push eax
call fcn.00439930
add esp, 8
jmp 0x403a40
lea ecx, [esp + 4]
push eax
push ecx
call fcn.00439930
lea edx, [esp + 0xc]
push str.gameconf.ini
push edx
call fcn.00439b10
add esp, 0x10
mov eax, dword [esp + 4]
lea ecx, [esp + 0x10]
push eax
call fcn.00445c70
lea ecx, [esp + 4]
push ecx
call fcn.00439990
add esp, 4
lea ecx, [esp + 0x10]
push str.Resolution_____1024x768_n
call fcn.00445d20
push str.Depth__________32bit_n
lea ecx, [esp + 0x14]
call fcn.00445d20
push str.Quality________0_n
lea ecx, [esp + 0x14]
call fcn.00445d20
xor edx, edx
lea ecx, [esp + 0x10]
mov dx, word [esi + 0x52]
push edx
push str.MusicVol
call fcn.00445f00
xor eax, eax
lea ecx, [esp + 0x10]
mov ax, word [esi + 0x54]
push eax
push str.SoundVol
call fcn.00445f00
push str.CameraMode_____0_n
lea ecx, [esp + 0x14]
call fcn.00445d20
xor ecx, ecx
mov cl, byte [esi + 0x67]
push ecx
push str.FullScreen
lea ecx, [esp + 0x18]
call fcn.00445f00
xor edx, edx
lea ecx, [esp + 0x10]
mov dx, word [esi + 0x58]
push edx
push str.Lang
call fcn.00445f00
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
push str.SoftwareEnkordArmada_Tank
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x403b58
push 2
call fcn.004799d9
mov cl, byte [esi + 0x58]
mov dword [esp + 0xc], eax
add cl, 0x30
add esp, 4
mov byte [eax], cl
mov edx, dword [esp + 8]
push 2
mov byte [edx + 1], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push eax
push 1
push 0
push str.Installer_Language
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [esp + 8]
push eax
call fcn.00439990
add esp, 4
mov ecx, dword [esi + 4]
add ecx, 0x18fb50
call fcn.00445d00
mov ecx, dword [esi + 4]
push str.____n
add ecx, 0x18fb50
call fcn.00445d20
pop esi
add esp, 0x1c
ret
Function at 0x403d50
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push esi
mov esi, ecx
push edi
push str.__CConfig::CreateListLang___n
mov ecx, dword [esi + 4]
add ecx, 0x18fb50
call fcn.00445d20
mov ecx, dword [esi + 4]
add ecx, 0x18fb50
call fcn.00445cf0
lea eax, [esp + 8]
push eax
push str.BaseTMessage.txt
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403dd4
mov ecx, dword [esi + 4]
push str.BaseTMessage.txt
push str.___ERROR_FindFirstFile
add ecx, 0x18fb50
call fcn.00445df0
mov ecx, dword [esi + 4]
add ecx, 0x18fb50
call fcn.00445d00
mov ecx, dword [esi + 4]
push str.____return_on_ERROR_n
add ecx, 0x18fb50
call fcn.00445d20
pop edi
pop esi
add esp, 0x140
ret
xor ecx, ecx
push ebx
mov cx, word [esi]
push str.BaseTMessage_
lea edx, [esi + ecx*4 + 0xc]
push edx
call fcn.00439930
xor ecx, ecx
lea eax, [esp + 0x40]
mov cx, word [esi]
push eax
lea edx, [esi + ecx*4 + 0xc]
push edx
call fcn.00439b10
xor eax, eax
add esp, 0x10
mov ax, word [esi]
mov ecx, dword [esi + eax*4 + 0xc]
push ecx
mov ecx, dword [esi + 4]
push str.___Lang
add ecx, 0x18fb50
call fcn.00445df0
mov ebx, dword [sym.imp.kernel32.dll_FindNextFileA]
lea edx, [esp + 0xc]
push edx
push edi
mov word [esi], 1
call ebx
test eax, eax
je 0x403e9d
xor eax, eax
push str.BaseTMessage_
mov ax, word [esi]
lea ecx, [esi + eax*4 + 0xc]
push ecx
call fcn.00439930
xor eax, eax
lea edx, [esp + 0x40]
mov ax, word [esi]
push edx
lea ecx, [esi + eax*4 + 0xc]
push ecx
call fcn.00439b10
mov ecx, dword [esi + 4]
xor edx, edx
mov dx, word [esi]
add esp, 0x10
add ecx, 0x18fb50
mov eax, dword [esi + edx*4 + 0xc]
push eax
push str.___Lang
call fcn.00445df0
mov ax, word [esi]
mov ecx, eax
and ecx, 0xffff
inc ecx
cmp ecx, 0x10
jge 0x403e91
inc eax
mov word [esi], ax
lea edx, [esp + 0xc]
push edx
push edi
call ebx
test eax, eax
jne 0x403e34
push edi
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [esi + 4]
add ecx, 0x18fb50
call fcn.00445d00
mov ecx, dword [esi + 4]
push str.____n
add ecx, 0x18fb50
call fcn.00445d20
pop ebx
pop edi
pop esi
add esp, 0x140
ret
Function at 0x40f920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
lea eax, [esp + 0xc]
push esi
push eax
xor ebx, ebx
push str.SoftwareEnkordArmada_Tank
push 0x80000001
mov esi, ecx
mov dword [esp + 0x18], 0x2000
mov dword [esp + 0x14], ebx
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
je 0x40f968
mov ecx, dword [esi]
push str.___ERROR:_RegOpenKey_ERROR_SUCCESS__n
add ecx, 0x18fb50
call fcn.00445d20
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004799d9
add esp, 4
lea edx, [esp + 0xc]
mov dword [esp + 8], eax
push edx
push eax
mov eax, dword [esp + 0x18]
push ebx
push ebx
push str.AffiliateBuild
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x40f9a9
mov ecx, dword [esi]
push str.___ERROR:_RegQueryValue_ERROR_SUCCESS_AffiliateBuild
add ecx, 0x18fb50
call fcn.00445d20
jmp 0x40f9d8
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [esi]
push str.___RegQueryValueEx_AffiliateBuild
add ecx, 0x18fb50
call fcn.00445df0
mov edx, dword [esp + 8]
push 0x48cb14
push edx
call fcn.004398a0
add esp, 8
test al, al
je 0x40f9d8
mov bl, 1
lea eax, [esp + 8]
push eax
call fcn.00439990
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x40fa00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push esi
push eax
push str.SoftwareEnkordArmada_Tank
push 0x80000001
mov esi, ecx
mov dword [esp + 0x14], 0x2000
mov dword [esp + 0x10], 0
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
je 0x40fa43
mov ecx, dword [esi]
push str.___ERROR:_RegOpenKey_ERROR_SUCCESS__n
add ecx, 0x18fb50
call fcn.00445d20
jmp 0x40faa2
mov ecx, dword [esp + 8]
push ecx
call fcn.004799d9
add esp, 4
lea edx, [esp + 8]
mov dword [esp + 4], eax
push edx
push eax
mov eax, dword [esp + 0x14]
push 0
push 0
push str.OrderURL
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov ecx, dword [esi]
add ecx, 0x18fb50
test eax, eax
je 0x40fa93
push str.___ERROR:_RegQueryValue_ERROR_SUCCESS_OrderURL
call fcn.00445d20
lea ecx, [esp + 4]
push ecx
call fcn.00439990
add esp, 4
jmp 0x40faa2
mov edx, dword [esp + 4]
push edx
push str.___RegQueryValueEx_OrderURL
call fcn.00445df0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp + 4]
test eax, eax
jne 0x40facf
mov ecx, dword [esi]
lea eax, [esp + 4]
mov edx, dword [ecx + 0x74fd64]
push edx
push eax
call fcn.00439930
mov eax, dword [esp + 0xc]
add esp, 8
pop esi
add esp, 0xc
ret
Function at 0x413c00
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push esi
mov esi, ecx
push edi
push str.__CMapList::ReadListPackMap___n
mov ecx, dword [esi]
add ecx, 0x18fb50
call fcn.00445d20
mov ecx, dword [esi]
add ecx, 0x18fb50
call fcn.00445cf0
lea eax, [esp + 8]
push eax
push str.BaseTMap.mpl
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x413c7f
mov ecx, dword [esi]
push str.BaseTMap.mpl
push str.___ERROR_FindFirstFile
add ecx, 0x18fb50
call fcn.00445df0
mov ecx, dword [esi]
add ecx, 0x18fb50
call fcn.00445d00
mov ecx, dword [esi]
push str.____return_on_ERROR_n
add ecx, 0x18fb50
call fcn.00445d20
pop edi
pop esi
add esp, 0x140
ret
lea ecx, [esp + 0x34]
push ebx
push ecx
mov ecx, esi
call fcn.00413cf0
mov ebx, dword [sym.imp.kernel32.dll_FindNextFileA]
lea edx, [esp + 0xc]
push edx
push edi
call ebx
test eax, eax
je 0x413cbd
cmp word [esi + 4], 0x20
jae 0x413cbd
lea eax, [esp + 0x38]
mov ecx, esi
push eax
call fcn.00413cf0
lea ecx, [esp + 0xc]
push ecx
push edi
call ebx
test eax, eax
jne 0x413c9e
push edi
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [esi]
add ecx, 0x18fb50
call fcn.00445d00
mov ecx, dword [esi]
push str.____n
add ecx, 0x18fb50
call fcn.00445d20
pop ebx
pop edi
pop esi
add esp, 0x140
ret
Function at 0x41f9e0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov ax, word [ecx + 6]
test edx, edx
lea eax, [eax + eax*8]
lea eax, [ecx + eax*4 + 0x74]
jge 0x41fa1f
push esi
mov esi, dword [eax]
add edx, esi
pop esi
test edx, edx
jge 0x41fa1a
mov dword [eax], 0
mov ecx, dword [ecx]
mov dword [esp + 4], str.___WARNING_m_Player.Money___sub_Money__n
add ecx, 0x18fb50
jmp fcn.00445d20
mov dword [eax], edx
ret 4
add dword [eax], edx
ret 4

Function at 0x41fb20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ax, word [esi + 8]
cmp ax, 1
jbe 0x41fba4
push ebx
mov bx, word [esi + 6]
dec eax
cmp bx, ax
mov word [esi + 8], ax
jae 0x41fb95
push edi
mov eax, ebx
and eax, 0xffff
lea ecx, [eax + eax*8]
mov dx, word [esi + ecx*4 + 0x8c]
lea edi, [esi + ecx*4]
lea ecx, [eax + eax*8 + 0x24]
mov word [edi + 0x68], dx
mov ecx, dword [esi + ecx*4]
test ecx, ecx
je 0x41fb74
lea edx, [eax + eax*8 + 0x1b]
push ecx
lea eax, [esi + edx*4]
push eax
call fcn.00439930
add esp, 8
jmp 0x41fb84
lea ecx, [eax + eax*8 + 0x1b]
lea edx, [esi + ecx*4]
push edx
call fcn.00439990
add esp, 4
mov eax, dword [edi + 0x94]
inc ebx
mov dword [edi + 0x70], eax
cmp bx, word [esi + 8]
jb 0x41fb3d
pop edi
mov word [esi + 6], 0
mov ecx, esi
pop ebx
pop esi
jmp fcn.0041fbb0
pop esi
ret

Function at 0x41fed0
Capabilities:
Write file on windows

Disassembly:
mov ax, word [esp + 4]
cmp ax, word [ecx + 8]
jae 0x41fee2
mov word [ecx + 6], ax
ret 4
mov ecx, dword [ecx]
mov dword [esp + 4], str.___WARNING_SetActivePlayer___m_NumPlayer__n
add ecx, 0x18fb50
jmp fcn.00445d20
Function at 0x427430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
mov ax, word [esi + 0x52]
mov bl, byte [esi + 0x4e]
cmp ax, 8
mov byte [esp + 0xc], bl
jae 0x427451
add eax, edi
mov word [esi + 0x52], ax
cmp word [esi + 0x18], 0
jne 0x42746e
mov ecx, dword [esi]
xor eax, eax
mov ax, word [esi + 0x52]
add ecx, 0x37cfc4
push eax
push 3
call fcn.00410f20
cmp word [esi + 0x18], 1
jne 0x42748b
xor ecx, ecx
mov cx, word [esi + 0x52]
push ecx
mov ecx, dword [esi]
push 5
add ecx, 0x37cfc4
call fcn.00410f20
test di, di
jbe 0x4274d6
and edi, 0xffff
mov eax, 0xfffa
mov ecx, 0xfffd
test bl, 0x40
je 0x4274b3
test bl, 0x20
jne 0x4274cf
or bl, 0x20
dec word [esi + 0x7e]
jmp 0x4274cf
dec word [esi + 0x7e]
test bl, 0x20
je 0x4274c8
add word [esi + 0x1c], ax
or bl, 0x40
xor bl, 0x20
jmp 0x4274cf
add word [esi + 0x1c], cx
or bl, 0x20
dec edi
jne 0x4274a0
mov byte [esp + 0xc], bl
mov ecx, esi
call fcn.004272a0
mov edx, dword [esi]
mov word [esi + 0x1c], ax
mov ecx, esi
mov ax, word [edx + 0x74fb6e]
push eax
call fcn.00427020
mov edi, dword [esp + 0xc]
xor cx, cx
cmp word [esi + 0x18], 0
mov cl, bl
mov word [esi + 0x4e], cx
jne 0x42751e
mov ecx, dword [esi]
mov edx, edi
and edx, 0xff
add ecx, 0x37cfc4
push edx
push 6
call fcn.00410f20
cmp word [esi + 0x18], 1
jne 0x42753b
mov ecx, dword [esi]
and edi, 0xff
push edi
push 7
add ecx, 0x37cfc4
call fcn.00410f20
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x42a1c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
mov ecx, eax
and ecx, 4
or ecx, edx
jne 0x42a3ea
mov ecx, eax
and ecx, 8
or ecx, edx
je 0x42a1e4
mov eax, 1
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x10
or ecx, edx
je 0x42a1f7
mov eax, 2
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x20
or ecx, edx
je 0x42a20a
mov eax, 3
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x40
or ecx, edx
je 0x42a21d
mov eax, 4
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x80
or ecx, edx
je 0x42a233
mov eax, 5
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x100
or ecx, edx
je 0x42a249
mov eax, 6
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x200
or ecx, edx
je 0x42a25f
mov eax, 7
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x4000
or ecx, edx
je 0x42a275
mov eax, 8
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x8000
or ecx, edx
je 0x42a28b
mov eax, 9
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x10000
or ecx, edx
je 0x42a2a1
mov eax, 0xa
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x20000
or ecx, edx
je 0x42a2b7
mov eax, 0xb
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x40000
or ecx, edx
je 0x42a2cd
mov eax, 0xc
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x80000
or ecx, edx
je 0x42a2e3
mov eax, 0xd
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x100000
or ecx, edx
je 0x42a2f9
mov eax, 0xe
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x200000
or ecx, edx
je 0x42a30f
mov eax, 0xf
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x400000
or ecx, edx
je 0x42a325
mov eax, 0x10
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x800000
or ecx, edx
je 0x42a33b
mov eax, 0x11
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x1000000
or ecx, edx
je 0x42a351
mov eax, 0x12
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x2000000
or ecx, edx
je 0x42a367
mov eax, 0x13
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x4000000
or ecx, edx
je 0x42a37d
mov eax, 0x14
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x8000000
or ecx, edx
je 0x42a393
mov eax, 0x15
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x10000000
or ecx, edx
je 0x42a3a9
mov eax, 0x16
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x20000000
or ecx, edx
je 0x42a3bf
mov eax, 0x17
ret 8
mov ecx, eax
xor edx, edx
and ecx, 0x40000000
or ecx, edx
je 0x42a3d5
mov eax, 0x18
ret 8
mov ecx, dword [esp + 8]
and eax, 0x80000000
or eax, ecx
je 0x42a3ea
mov eax, 0x19
ret 8
xor eax, eax
ret 8
Function at 0x43a210
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov dl, byte [0x498e60]
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], dl
mov byte [esp + 0x1c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov cl, byte [eax + 0x498e60]
mov byte [eax + 0xbea9b8], cl
inc eax
test cl, cl
jne 0x43a24e
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x11c]
push 0xff
push eax
push str.USERNAME
call esi
test eax, eax
je 0x43a3be
lea ecx, [esp + 0x1c]
push 0xff
push ecx
push str.USERKEY
call esi
test eax, eax
jne 0x43a2a5
mov cl, byte [eax + 0x498e60]
mov byte [esp + eax + 0x1c], cl
inc eax
test cl, cl
jne 0x43a296
lea edx, [esp + 0x11c]
push str.DEFAULT
push edx
call fcn.00483790
add esp, 8
test eax, eax
je 0x43a2df
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x43a2df
mov cl, byte [eax + str.registered]
mov byte [eax + 0xbea9b8], cl
inc eax
test cl, cl
jne 0x43a2ce
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREEnkordClayside
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43a3be
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
mov esi, 0x400
push ecx
push 0xbeadc0
push eax
push eax
push str.OrderURL
push edx
mov dword [esp + 0x20], esi
call edi
test eax, eax
jne 0x43a331
cmp dword [esp + 8], esi
jbe 0x43a344
xor eax, eax
mov cl, byte [eax + 0x498e60]
mov byte [eax + 0xbeadc0], cl
inc eax
test cl, cl
jne 0x43a333
mov edx, dword [esp + 0xc]
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0
mov esi, 0xa
push str.AffiliateBuild
push edx
mov dword [esp + 0x20], esi
call edi
test eax, eax
jne 0x43a3a2
cmp dword [esp + 8], esi
ja 0x43a3a2
lea eax, [esp + 0x10]
push 0x48cb14
push eax
call fcn.00483790
mov edx, dword [esp + 0x14]
add esp, 8
test eax, eax
sete cl
push edx
mov byte [0xbeadb8], cl
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x214
ret
xor eax, eax
mov cl, byte [eax + 0x490088]
mov byte [esp + eax + 0x10], cl
inc eax
test cl, cl
jne 0x43a3a4
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0x214
ret