joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f89a
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x4b1810]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x324], esi
mov dword [ebp - 0x314], esi
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x47f8e3
cmp edi, 0xffffffff
jne 0x47f8e3
push ebx
call fcn.0047fae0
pop ecx
jmp 0x47facf
test ebx, ebx
jle 0x47f901
mov dword [ebp - 0x314], ebx
call fcn.0047855d
mov dword [ebp - 0x320], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x324], edx
mov ecx, esi
mov dword [ebp - 0x310], esi
or edx, 0xffffffff
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x31c], 1
cmp eax, 0xffffffff
je 0x47f941
mov ecx, dword [ebp - 0x31c]
mov edx, eax
mov dword [ebp - 0x30c], eax
mov dword [ebp - 0x310], ecx
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x20c], esi
cmp edi, 0xffffffff
je 0x47f98b
mov dword [ebp - 0x208], edi
mov eax, esi
mov dword [ebp - 0x20c], 1
test ecx, ecx
je 0x47f970
cmp dword [ebp + eax*4 - 0x104], edi
je 0x47f970
inc eax
cmp eax, ecx
jb 0x47f962
cmp eax, ecx
jne 0x47f986
cmp ecx, 0x40
jae 0x47f986
mov dword [ebp + eax*4 - 0x104], edi
inc dword [ebp - 0x108]
cmp edi, edx
cmova edx, edi
xor ecx, ecx
lea eax, [ebp - 0x32c]
test ebx, ebx
cmovs eax, ecx
lea ecx, [edx + 1]
mov dword [ebp - 0x330], ecx
mov ecx, dword [ebp - 0x314]
mov dword [ebp - 0x318], eax
test ebx, ebx
jle 0x47f9d5
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x32c], eax
imul eax, edx, 0x3e8
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x318]
jmp 0x47f9e3
jne 0x47f9e3
mov dword [ebp - 0x32c], esi
mov dword [ebp - 0x328], esi
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x330]
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x47fa5f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x47fa1b
cmp eax, 0x2714
jne 0x47fa63
mov ecx, dword [ebp - 0x314]
mov eax, dword [ebp - 0x318]
test ebx, ebx
jle 0x47f9d5
push dword [ebp - 0x324]
push dword [ebp - 0x320]
call fcn.0047855d
push edx
push eax
call fcn.00478507
mov ecx, ebx
add esp, 0x10
sub ecx, eax
mov dword [ebp - 0x314], ecx
test ecx, ecx
jle 0x47fa63
mov eax, dword [ebp - 0x318]
jmp 0x47f9ad
test eax, eax
jns 0x47fa68
or eax, 0xffffffff
jmp 0x47facf
jne 0x47fa6e
xor eax, eax
jmp 0x47facf
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x47faa0
lea eax, [ebp - 0x310]
push eax
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
lea eax, [ebp - 0x108]
push eax
cmovne esi, dword [ebp - 0x31c]
push ebx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x47faa0
or esi, 4
cmp edi, 0xffffffff
je 0x47facd
lea eax, [ebp - 0x20c]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x47fab9
or esi, 2
lea eax, [ebp - 0x108]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x47facd
or esi, 4
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004918a1
mov esp, ebp
pop ebp
ret
Function at 0x480d0a
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4b1810]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov dword [ebp - 0x1c], 0x10
mov eax, dword [ebx + 0x134]
mov esi, dword [ebx]
mov dword [ebp - 0x18], eax
jmp 0x480d5c
mov eax, 0x3e8
cmp ecx, eax
cmovl eax, ecx
push eax
push 0xffffffffffffffff
push dword [ebp - 0x18]
call fcn.0047f89a
add esp, 0xc
cmp eax, 0xffffffff
je 0x480e03
test eax, eax
jne 0x480d90
push 1
push 0
push esi
call fcn.00477072
mov ecx, eax
add esp, 0xc
test ecx, ecx
jns 0x480d37
push 0x409094
push esi
call fcn.004768f6
pop ecx
pop ecx
push 0x1c
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004918a1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x480dbf
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push dword [ebp - 0x18]
push ebx
call fcn.00476e15
pop ecx
pop ecx
cmp edi, 0xffffffff
jne 0x480de0
push 0x4090e8
push esi
call fcn.004768f6
pop ecx
pop ecx
push 0x1e
jmp 0x480d7e
push 0x40910c
push esi
call fcn.0047698c
push 1
push edi
mov dword [ebx + 0x134], edi
call fcn.00489f0e
add esp, 0x10
xor eax, eax
jmp 0x480d7f
push 0x4090c0
jmp 0x480dd4

Function at 0x482bba
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x64
cdq
xor esi, esi
pop ebx
idiv ebx
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
cmp eax, 2
je 0x482be7
push 0x40960c
push ecx
call fcn.004768f6
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x482c3e
cmp dword [ebp + 0xc], 0xc8
je 0x482c01
push dword [ebp + 0xc]
push 0x409628
push ecx
call fcn.0047698c
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x482c12
push edi
call fcn.004827d9
pop ecx
jmp 0x482c3a
cmp eax, 0x14
jne 0x482c1f
push edi
call fcn.00482399
jmp 0x482c0f
cmp eax, 0x15
jne 0x482c28
push 0xd
jmp 0x482c2f
cmp eax, 0x16
jne 0x482c3c
push 0xe
push 1
push edi
call fcn.00482853
add esp, 0xc
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x487307
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
push ebx
push esi
mov ebx, dword [eax]
mov eax, dword [eax + 0x3d0]
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], eax
call fcn.0047855d
mov ecx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x54], edi
mov dword [ebx + 0x58], esi
mov dword [ebx + 0x5c], edi
cmp dword [ecx], 3
je 0x48758a
invalid
mov eax, dword [ebp - 8]

Function at 0x487846
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4b1810]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x3d0]
mov edi, dword [eax]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [esi + 0x15c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x4878d7
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.0048e2f0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], eax
mov ebx, dword [esi + 0x14c]
cmp ebx, 4
jge 0x487909
push 0x40ad88
push edi
call fcn.004768f6
pop ecx
pop ecx
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004918a1
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x15c]
movzx eax, byte [ecx]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 1]
or edx, eax
mov dword [esi + 0xc], edx
sub edx, 3
je 0x48798b
dec edx
je 0x4879fd
dec edx
je 0x487964
dec edx
je 0x487949
push 0x40ada4
push 0x413c94
push edi
call fcn.004768f6
jmp 0x4879fa
lea eax, [ebx - 2]
push eax
lea eax, [ecx + 2]
push eax
push esi
call fcn.004875f9
add esp, 0xc
test eax, eax
je 0x4879fd
jmp 0x4878f8
mov edx, ecx
movzx eax, byte [edx + 2]
shl ax, 8
movzx ecx, ax
movzx eax, byte [edx + 3]
or ecx, eax
lea eax, [edx + 4]
push eax
push 0x40699c
push edi
mov dword [esi + 8], ecx
call fcn.0047698c
jmp 0x4879fa
cmp ebx, 4
jle 0x4879fd
movzx eax, byte [ecx + 2]
shl ax, 8
movzx edx, ax
movzx eax, byte [ecx + 3]
or edx, eax
movzx eax, word [esi + 0x40]
inc eax
and eax, 0xffff
cmp eax, edx
jne 0x4879fd
lea eax, [ebx - 4]
push eax
lea eax, [ecx + 4]
push eax
push 1
push dword [ebp - 0x8c]
call fcn.004766f9
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x4879de
push 5
push esi
call fcn.00488083
pop ecx
pop ecx
mov eax, ebx
jmp 0x4878f8
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x38], eax
adc dword [edi + 0x3c], edx
push dword [edi + 0x3c]
push dword [edi + 0x38]
push edi
call fcn.0047e9c3
add esp, 0xc
push dword [ebp - 0x8c]
call fcn.0047ebad
pop ecx
test eax, eax
je 0x4878f6
push 5
push esi
call fcn.00488083
pop ecx
pop ecx
push 0x2a
pop eax
jmp 0x4878f8
Function at 0x414b2e
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x214], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov esi, 0x40e330
call fcn.00427b40
add esp, 0xc
push 9
pop ebx
mov edi, 0x105
push dword [ebp - 0x214]
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.0042250d
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call fcn.00413535
push 0x5c
push esi
call fcn.0042380e
pop ecx
pop ecx
test eax, eax
jne 0x414bae
mov eax, esi
jmp 0x414bb1
add eax, 2
push eax
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.00422675
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea esi, [esi + ebx*2 + 2]
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x414be9
sub eax, ecx
sar eax, 1
mov ebx, eax
jne 0x414b7a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004224f9
leave
ret 4
Function at 0x41c75a
Capabilities:
Check os version
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x928
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
test ebx, ebx
je 0x41c934
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ebx
stosd dword es:[edi], eax
push ebx
lea eax, [esi - 1]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor edi, edi
cmp eax, edi
je 0x41c930
cmp eax, esi
ja 0x41c930
mov esi, 0x114
push esi
lea eax, [ebp - 0x918]
push edi
push eax
call fcn.00427b40
add esp, 0xc
lea eax, [ebp - 0x918]
push eax
mov dword [ebp - 0x918], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41c7d8
cmp dword [ebp - 0x914], 5
ja 0x41c7fc
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x41c7fc
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41c7ec
jmp 0x41c92a
lea eax, [ebp - 0x91c]
push eax
push 0x20019
push edi
push 0x40eed8
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c8ed
lea eax, [ebp - 0x924]
push eax
lea eax, [ebp - 0x920]
push eax
push edi
push edi
push 0x40ef3c
push dword [ebp - 0x91c]
mov dword [ebp - 0x920], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x924], 4
call edi
test eax, eax
jne 0x41c869
cmp dword [ebp - 0x920], eax
sete al
mov esi, eax
test esi, esi
jne 0x41c8c9
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call fcn.00427b40
add esp, 0xc
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push 0x40ef60
push dword [ebp - 0x91c]
mov dword [ebp - 0x928], 0x400
call edi
test eax, eax
jne 0x41c8c9
lea eax, [ebp - 0x804]
push eax
call fcn.00422e89
mov esi, eax
neg esi
sbb esi, esi
pop ecx
neg esi
push dword [ebp - 0x91c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41c8eb
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c8de
jmp 0x41c92a
xor edi, edi
push 0x5c
push ebx
call fcn.0042380e
pop ecx
pop ecx
cmp eax, edi
je 0x41c906
cmp word [eax + 2], di
jne 0x41c906
xor ecx, ecx
mov word [eax], cx
push 0x5c
push ebx
call fcn.0042380e
pop ecx
pop ecx
cmp eax, edi
je 0x41c91a
xor ecx, ecx
mov word [eax + 2], cx
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41c91f
sub eax, edx
sar eax, 1
jmp 0x41c932
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004224f9
leave
ret 8
Function at 0x41c948
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp edi, ebx
jne 0x41c95f
push 0x80004005
call fcn.0041331b
push edi
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, ebx
je 0x41c9ce
mov ecx, dword [edi]
cmp ecx, ebx
jbe 0x41c9c9
cmp dword [ebp - 4], ebx
jbe 0x41c9bf
cmp dword [ebp - 4], 2
jbe 0x41c9b1
cmp dword [ebp - 4], 7
jne 0x41c9bf
test cl, 1
jne 0x41c9bf
shr ecx, 1
cmp ecx, 1
jb 0x41c9bf
cmp word [esi + ecx*2 - 2], bx
jne 0x41c9bf
cmp ecx, 1
jbe 0x41c9ce
cmp word [esi + ecx*2 - 4], bx
jmp 0x41c9bd
test cl, 1
jne 0x41c9bf
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
je 0x41c9ce
xor eax, eax
push 0xd
mov word [esi], ax
pop eax
jmp 0x41c9ce
xor ecx, ecx
mov word [esi], cx
pop ebx
leave
ret 8
Function at 0x41dcc8
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4566cc
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x461070]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x20]
call fcn.0042e933
and dword [esp + 0x38], 0
push 0
lea ecx, [esp + 0x10]
call fcn.0042e933
mov byte [esp + 0x38], 1
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push 1
push dword [0x466004]
mov dword [0x467238], eax
call dword [0x465124]
push eax
push 1
push 0x80
push dword [esi + 4]
call dword [0x465138]
push 0x4644c0
lea eax, [esp + 0x10]
push 0x1003
push eax
call fcn.0042e9a1
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
jne 0x41dd62
mov eax, 0x40df5c
push eax
push dword [esi + 4]
call dword [0x465144]
lea eax, [esp + 0x1c]
push 0x1057
push eax
call fcn.0042e9a1
mov eax, dword [esp + 0x28]
pop ecx
pop ecx
test eax, eax
jne 0x41dd8a
mov eax, 0x40df5c
push eax
push 0xde
push dword [esi + 4]
call dword [0x46513c]
xor edx, edx
lea ecx, [esi + 4]
call fcn.0041c9d8
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov byte [esp + 0x38], 0
lea ecx, [esp + 0xc]
call fcn.0042e991
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.0042e991
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x41e251
Capabilities:
Log keystrokes

Disassembly:
push 0x14
mov eax, 0x45669c
call fcn.00447299
xor esi, esi
push esi
lea ecx, [ebp - 0x20]
call fcn.0042e933
mov dword [ebp - 4], esi
push 0x4644c0
lea eax, [ebp - 0x20]
push 0x1003
push eax
call fcn.0042e9a1
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, esi
jne 0x41e28d
mov eax, 0x40df5c
push eax
push esi
call dword [0x465100]
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0042e991
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.00447385
ret

Function at 0x41ecd2
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00427b40
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, str.Unknown
mov ecx, esi
lea eax, [ebp - 0x210]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ed4b
test dx, dx
je 0x41ed47
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ed4b
add eax, 4
add ecx, 4
test dx, dx
jne 0x41ed25
xor eax, eax
jmp 0x41ed50
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41ed5b
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004224f9
leave
ret
Function at 0x41f113
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0041c75a
cmp dword [ebp + 0xc], eax
jbe 0x41f18c
push esi
call fcn.0041f0d8
mov esi, eax
test esi, esi
je 0x41f18b
push ebx
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push esi
mov esi, dword [0x4650e0]
mov edi, eax
push edi
call esi
movzx ecx, word [eax]
cmp ecx, 0x22
jne 0x41f155
or ebx, 0xffffffff
cmp ecx, 0x5c
je 0x41f16f
cmp eax, edi
je 0x41f169
push eax
push edi
call esi
inc ebx
cmp word [eax], 0x5c
jne 0x41f15a
cmp word [eax], 0x5c
jne 0x41f178
push eax
call dword [0x4650dc]
jmp 0x41f179
inc ebx
push ebx
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00422d2a
add esp, 0x10
pop edi
pop ebx
pop esi
pop ebp
ret 8

Function at 0x41f195
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x461070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x41c], ax
xor edi, edi
lea eax, [ebp - 0x41a]
push edi
push eax
call fcn.00427b40
xor eax, eax
push esi
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push edi
push eax
call fcn.00427b40
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.00427b40
add esp, 0x24
mov esi, 0x105
push esi
lea eax, [ebp - 0x628]
push eax
call fcn.0041f113
push esi
lea eax, [ebp - 0x41c]
push eax
push dword [0x466004]
call fcn.0042ee15
call fcn.0041f0d8
cmp word [eax], di
je 0x41f25b
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00423bd1
add esp, 0x10
cmp eax, 0x50
je 0x41f2cc
push 0x40e944
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00422675
add esp, 0xc
push 0x40f6dc
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00422675
push 0x40f700
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00422675
push str._OrigPath
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00422675
push 0x40f718
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00422675
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00422675
push 0x40f720
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00422675
add esp, 0x48
mov ecx, dword [0x46747c]
call fcn.0041ccaa
push 1
push edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
push 0x40ec04
push edi
call dword [0x4650d4]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004224f9
leave
ret
Function at 0x41f519
Capabilities:
Shutdown system

Disassembly:
push 0x144
mov eax, 0x456368
call fcn.0044730c
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x13c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ebx, ebx
push 2
pop esi
test eax, eax
je 0x41f5ad
cmp dword [ebp - 0x12c], esi
jne 0x41f5ad
lea eax, [ebp - 0x140]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41f5ad
lea eax, [ebp - 0x148]
push eax
push 0x40f738
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x148]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x144]
push ebx
push ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x140]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esi, eax
cmp esi, ebx
jne 0x41f637
push ebx
lea ecx, [ebp - 0x24]
call fcn.0042e933
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x150]
call fcn.0042e933
mov byte [ebp - 4], 1
lea eax, [ebp - 0x24]
push 0x1073
push eax
call fcn.0042e9a1
lea eax, [ebp - 0x150]
push 0x1074
push eax
call fcn.0042e9a1
mov ecx, dword [ebp - 0x14c]
add esp, 0x10
mov eax, 0x40df5c
cmp ecx, ebx
jne 0x41f60a
mov ecx, eax
cmp dword [ebp - 0x20], ebx
je 0x41f612
mov eax, dword [ebp - 0x20]
push 0x30
push ecx
push eax
push ebx
call dword [0x465128]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x150]
call fcn.0042e991
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0042e991
mov eax, esi
call fcn.0044739e
ret
Function at 0x41f644
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x458590
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x461070]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push ebx
push 0x25a
push 0x259
push ebx
call fcn.00430c06
test al, al
je 0x41f812
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, 0x467484
push esi
mov dword [ebp + 0x10], eax
call fcn.0041f9e5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
push ebx
mov dword [0x4674b4], eax
call fcn.0042fc7f
call fcn.0041ed6d
mov edi, str.LauncherSingleInstance
push edi
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x467230], eax
cmp eax, ebx
jne 0x41f791
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x467230], eax
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x40f928
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x467480], eax
cmp eax, ebx
jne 0x41f7af
push ebx
lea ecx, [esp + 0x18]
call fcn.0042e933
mov dword [esp + 0x40], ebx
push 0x4644c0
lea eax, [esp + 0x18]
push 0x1003
push eax
call fcn.0042e9a1
add esp, 0xc
push 0x106a
lea ecx, [esp + 0x28]
call fcn.0042e933
mov byte [esp + 0x40], 1
mov edx, dword [esp + 0x18]
mov ecx, 0x40df5c
cmp edx, ebx
jne 0x41f75b
mov edx, ecx
mov eax, dword [eax + 4]
cmp eax, ebx
jne 0x41f764
mov eax, ecx
push ebx
push edx
push eax
push ebx
call dword [0x465128]
mov byte [esp + 0x40], bl
lea ecx, [esp + 0x24]
call fcn.0042e991
or dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0042e991
or eax, 0xffffffff
jmp 0x41f814
push 0x40f760
push dword [ebp + 0x10]
call fcn.004235e0
pop ecx
pop ecx
test eax, eax
jne 0x41f6f1
call fcn.0041e251
jmp 0x41f7e4
call fcn.0041e452
test eax, eax
je 0x41f7e4
call fcn.0041e849
test eax, eax
jne 0x41f7e4
call fcn.0041e775
test eax, eax
jne 0x41f7e4
call fcn.0041f47a
test eax, eax
je 0x41f7e4
push dword [ebp + 0x10]
call fcn.0041f3a7
test eax, eax
jne 0x41f7e4
call fcn.0041f307
push dword [0x467230]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
mov dword [0x467230], ebx
call fcn.0041f983
mov ebx, esi
call fcn.0041f92e
cmp dword [0x46723c], 0
je 0x41f812
call fcn.0041f519
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10