joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401490
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x6d617c]
movzx ecx, word [eax + 0x129]
push ecx
lea edx, [ebp - 0x44]
push 0x59566c
push edx
call fcn.0056ecd0
push 0x595684
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0056ec89
mov eax, dword [ebp - 4]
add esp, 0x18
test eax, eax
je 0x401509
push eax
push 1
push 0x1c64
add edi, 0xec
push edi
call fcn.0056eb3c
mov edx, dword [ebp - 4]
push edx
call fcn.0056e971
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404160
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
lea ecx, [esi + 0xec]
mov byte [ebp - 4], 2
call fcn.00401000
push 0x64
lea ecx, [esi + 0x1c]
mov dword [esi + 0x1d7c], edi
mov dword [esi], edi
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
call fcn.00562410
push 0xc8
lea ecx, [esi + 0x40]
call fcn.00562410
push 0x1f4
lea ecx, [esi + 0x64]
call fcn.00562410
mov ecx, esi
call fcn.00403d20
mov ecx, esi
call fcn.00403e80
mov ecx, esi
call fcn.00403ff0
mov ecx, esi
call fcn.00401550
mov eax, dword [0x6d70a4]
push edi
mov dword [esi + 0x1d50], eax
mov dword [esi + 4], edi
mov dword [esi + 0x9c], 0xffffffff
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0x1d80], edi
mov dword [esi + 0x1d84], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd4], edi
call fcn.0056e83a
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword [esi + 0xd8], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x404eb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6d617c]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [ebp - 0x48]
push str.._data_aiconfig__d.dat
push edx
call fcn.0056ecd0
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.0056e7c0
push 0x5956a0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0056ec89
mov eax, dword [ebp - 4]
add esp, 0x24
test eax, eax
je 0x404f6c
push eax
push 1
push 0x1c64
push edi
call fcn.0056f629
mov edx, dword [ebp - 4]
push edx
call fcn.0056e971
add esp, 0x14
call fcn.00404290
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [ebp - 8], eax
fild dword [ebp - 8]
test eax, eax
jns 0x404f3c
fadd dword [0x595710]
fstp dword [esi + 0xe0]
call fcn.00404290
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
test ecx, ecx
jns 0x404f60
fadd dword [0x595710]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.004046b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a980
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0x40a900
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6c7cf4], eax
pop ebp
ret 4
Function at 0x40ad40
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
push ebx
push edi
push 0x104
lea eax, [ebp - 0x35c]
push eax
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x35c]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40ad70
mov ecx, dword [str.mfl.dat]
mov edx, dword [0x595ca0]
mov dword [eax], ecx
mov cl, byte [0x595ca4]
mov dword [eax + 4], edx
lea edx, [ebp - 0x35c]
push 0x595ca8
push edx
mov byte [eax + 8], cl
call fcn.0056ec72
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40adbd
push eax
call fcn.0056e971
add esp, 4
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x258]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x258]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40add6
mov ecx, dword [str.Resource.bin]
mov edx, dword [0x595cb0]
mov dword [eax], ecx
mov ecx, dword [0x595cb4]
mov dword [eax + 4], edx
mov edx, dword [0x595cb8]
mov dword [eax + 8], ecx
push esi
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
jmp 0x40ae20
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [ebp - 0x128]
push ecx
push edi
push 0x595cbc
push ebx
call fcn.0056fbf1
movzx edx, word [ebp - 6]
movzx eax, word [ebp - 8]
movzx ecx, word [ebp - 0xa]
push edx
movzx edx, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push ecx
push edx
push eax
push 0x595cc4
push ebx
call fcn.0056fbf1
add esp, 0x2c
lea ecx, [ebp - 0x154]
push ecx
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ae20
lea edx, [ebp - 0x258]
push edx
push 0x104
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [ebp - 0x258]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40aea0
mov ecx, 6
mov esi, str.ResourceSkillArea.bsad
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x258]
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea ecx, [ecx]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov edi, dword [ebp - 0x14]
lea ecx, [ebp - 0x128]
push ecx
push edi
push str._d__s_t
push ebx
call fcn.0056fbf1
movzx edx, word [ebp - 6]
movzx eax, word [ebp - 8]
movzx ecx, word [ebp - 0xa]
push edx
movzx edx, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.0056fbf1
add esp, 0x2c
lea ecx, [ebp - 0x154]
push ecx
inc edi
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40aed0
push ebx
call fcn.0056e971
add esp, 4
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40af50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov ecx, 0x6c9aa0
call fcn.00423a40
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6c77d4], esi
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x700dd4]
xor edx, edx
mov eax, esi
div dword [0x700360]
mov eax, dword [0x700364]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40afae
cmp dword [edx], esi
je 0x40aff5
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x40afa3
mov edx, dword [ebp + 8]
push 0
push edx
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6c77d8
push 0x6c79f0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6c77c0], esi
test esi, esi
jne 0x40b014
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40afae
mov eax, dword [ebp + 8]
push 0
push eax
mov eax, dword [edx + 8]
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x40afc6
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6c7d20
call fcn.0040c6b0
cmp dword [0x6d80a8], 0
push 0
mov ecx, 0x6c7d20
push 0
jne 0x40b064
push 1
call fcn.0040c510
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push 2
call fcn.0040c510
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x40b830
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040a980
mov eax, dword [ebp + 0x10]
mov dword [0x6c77b8], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b872
test dl, dl
je 0x40b86e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b872
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b852
xor eax, eax
jmp 0x40b877
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40b898
push 0
push 0x595a74
push 0x595a7c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.0040abf0
test eax, eax
je 0x40b88f
push esi
call fcn.0040a980
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x595ac4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x595ac8
push 0x6e5810
call fcn.00515940
push str._____________________Client_Start______________________
push 0x6e5810
call fcn.00515940
push str._______________________________________________________
push 0x6e5810
call fcn.00515940
add esp, 0x18
call fcn.0040ab40
mov ecx, 0x6e6de8
call fcn.00520bf0
push 0x700232
push 0x6c77d8
call fcn.0056ecd0
push 0x700232
push 0x6c79f0
call fcn.0056ecd0
push esi
call fcn.0040b7d0
add esp, 0x14
mov ecx, 0x6e6de8
call fcn.005225d0
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6e3a68
call fcn.004e80e0
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6e3a68
call fcn.004e8cc0
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6e3a68
call fcn.004e6dc0
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6e3a68
call fcn.004e82a0
mov ecx, 0x6d5700
call fcn.00432340
mov eax, dword [ebp + 0x14]
push eax
push esi
call fcn.0040af50
add esp, 8
test eax, eax
jne 0x40b994
call fcn.0040ac00
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call esi
test eax, eax
je 0x40b9c8
lea edx, [ebp - 0x1c]
push edx
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
jmp 0x40b9a8
mov ecx, 0x6c7d20
call fcn.0040ca90
cmp eax, 0xffffffff
jne 0x40b9a8
call fcn.0040ac00
mov eax, dword [ebp - 0x14]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41e4a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x128
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x41e629
cmp byte [eax], bl
je 0x41e629
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e629
mov edx, dword [ebp - 8]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x41e50a
mov dword [ebp - 0xc], 0x64
push edi
xor edi, edi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0xc], ebx
jbe 0x41e614
push esi
lea ebx, [ebx]
xor eax, eax
push edi
push str._04u
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x18]
push 5
push eax
call fcn.0041e940
mov eax, dword [ebp - 8]
add esp, 0x10
lea ecx, [ebp - 4]
push ecx
push 0x20019
push ebx
lea edx, [ebp - 0x18]
push edx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e5ed
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x1c]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], 0x104
call esi
test eax, eax
je 0x41e59a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41e5ed
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41e5bb
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41e5ed
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
push ebx
push str.Characteristics
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 4
call esi
mov ecx, dword [ebp - 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41e60d
inc edi
cmp edi, dword [ebp - 0xc]
jb 0x41e520
mov eax, dword [ebp - 8]
pop esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x24]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
pop esi
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x24]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41e640
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x41e681
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push 0x597a94
push 0x12
push ecx
call fcn.0041e940
add esp, 0x10
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 4]
push esi
push edx
call fcn.00570d77
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
cmp esi, edi
jne 0x41e6b0
mov eax, dword [ebp + 8]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 4]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x41e6e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.0041e940
push esi
call fcn.00570d3d
add esp, 0x14
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x41e727
cmp eax, 8
ja 0x41e727
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.00570700
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.0041e4a0
test al, 4
jne 0x41e72d
mov esi, dword [esi]
test esi, esi
jne 0x41e6f0
mov edx, dword [ebp - 0xc]
push edx
call fcn.00570d3d
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x422275
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x6c7d28]
push esi
mov esi, ecx
mov ecx, dword [eax + 8]
mov dword [ecx + 0xc], 1
cmp dword [esi + 0x10], 0
push 0
mov ecx, 0x6c7d20
push 0
je 0x4222ab
push 3
mov dword [0x6c7f50], 1
call fcn.0040c510
mov dword [esi + 0x10], 0
jmp 0x4222b2
push 2
call fcn.0040c510
cmp dword [0x6d80a8], 0
pop esi
jne 0x4222d0
mov dword [0x6d80a8], 1
mov ecx, 0x6d8010
jmp fcn.004c8b30
ret
Function at 0x43e060
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c153
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00431020
xor edi, edi
lea ecx, [esi + 0x50]
mov dword [ebp - 4], edi
mov dword [esi], vtable.cWindow.0
call fcn.00430400
mov ebx, 1
lea ecx, [esi + 0x194]
mov byte [ebp - 4], bl
call fcn.0042cd10
fldz
fst dword [esi + 0x1e4]
xor eax, eax
fstp dword [esi + 0x1e8]
mov dword [esi + 8], edi
fld1
mov ecx, ebx
mov dword [esi + 0x14], edi
fst dword [esi + 0x1f0]
mov dword [esi + 0x24], edi
fstp dword [esi + 0x1f4]
mov dword [esi + 0x1b4], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 4], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov word [esi + 0x1c], ax
mov word [esi + 0xc], cx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x20], ebx
xor edx, edx
mov dword [esi + 0x34], ebx
pop edi
mov dword [esi + 0x1ec], edx
mov dword [esi + 0x1b8], 0xffffff
mov dword [esi + 0x1bc], 0xff
mov dword [esi + 0x1c0], 0x64
mov dword [esi + 0x18], 0x43e050
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x43f650
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0xc]
pop ebp
jmp fcn.004383b0

Function at 0x43fba0
Capabilities:
Delete file

Disassembly:
push esi
push edi
push 0x59bf0c
push str.._image_InterfaceScript_AdvancedSetDlg.bin
mov edi, ecx
call fcn.0043f650
mov ecx, dword [edi + 0x18]
mov esi, eax
push esi
call fcn.005696a0
mov ecx, esi
call fcn.00504f40
pop edi
mov dword [0x6c8594], esi
mov ecx, esi
pop esi
jmp fcn.005056f0

Function at 0x4576b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c8d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esi], vtable.CReinforceManager.0
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
push 0x14
mov byte [ebp - 4], 1
call fcn.00562410
push 0x14
lea ecx, [esi + 0x28]
call fcn.00562410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x50], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x460da0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cdc6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
xor eax, eax
push edi
mov edi, ecx
lea ecx, [edi + 4]
mov dword [edi], vtable.CMunpaMarkManager.0
mov dword [ebp - 0x10], edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
push 0x40
mov byte [ebp - 4], 1
mov dword [edi + 0x4c], eax
call fcn.00562410
push 0x40
lea ecx, [edi + 0x28]
call fcn.00562410
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x46fa90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
push edi
mov edi, ecx
test eax, eax
jne 0x46fab3
push str.Item_DB_idx__0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop ebx
pop ebp
ret 4
push esi
push eax
mov ecx, 0x6d6d88
call fcn.004a20a0
mov esi, eax
test esi, esi
je 0x46fad2
mov ax, word [ebx + 6]
mov word [esi + 0x28e], ax
jmp 0x46fb01
push str.CItemShopGridDialog::AddItem
push ebx
mov ecx, 0x6d6d88
call fcn.004a54a0
mov esi, eax
test esi, esi
jne 0x46faef
pop esi
pop edi
pop ebx
pop ebp
ret 4
push esi
mov ecx, 0x6d6d88
mov dword [esi + 0x24], 1
call fcn.004ae930
mov edx, dword [esi]
mov eax, dword [edx + 0x7c]
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.0046f9b0
movzx eax, ax
push esi
push eax
mov ecx, edi
call fcn.0042c970
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4865d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x284]
cmp ebx, 1
jne 0x48661a
mov eax, dword [0x6d70a4]
add eax, 0x1d4c0
push edi
mov dword [esi + 0x238], eax
call fcn.00446510
push 0x5a10f0
lea ecx, [esi + 0x284]
call fcn.00446540
pop edi
push ebx
mov ecx, esi
call fcn.00427d30
pop esi
pop ebx
pop ebp
ret 4
call fcn.00446510
push 0x5a1100
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.00427d30
pop esi
pop ebx
pop ebp
ret 4

Function at 0x486640
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x284]
cmp ebx, 1
jne 0x48668f
mov eax, dword [ebp + 0xc]
imul eax, eax, 0x3e8
add eax, dword [0x6d70a4]
push edi
mov dword [esi + 0x238], eax
call fcn.00446510
push 0x5a1110
lea ecx, [esi + 0x284]
call fcn.00446540
pop edi
push ebx
mov ecx, esi
call fcn.00427d30
pop esi
pop ebx
pop ebp
ret 8
call fcn.00446510
push 0x5a1120
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.00427d30
pop esi
pop ebx
pop ebp
ret 8
Function at 0x488340
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58deac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0xa
mov dword [ebp - 0x10], esi
call fcn.005692c0
xor eax, eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
push 0xa
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 2
call fcn.005692c0
push 0xa
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 3
call fcn.005692c0
push 0xa
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 4
call fcn.005692c0
push 0xa
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 5
call fcn.005692c0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret