joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eb370
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5abf
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x53fbb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x2c]
call fcn.00403bd0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4eb466
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x48]
call fcn.00404490
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x88], ecx
mov byte [ebp - 4], 1
push 0x514b3c
mov edx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.00403160
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x90]
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.00403160
add esp, 0xc
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x98], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x98]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004013e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
call fcn.00403c40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00403c40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00403c40
jmp 0x4eb472
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403b90
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403bb0
push eax
push 0x514b40
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403c40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049115e
mov esp, ebp
pop ebp
ret
Function at 0x4eb720
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5b1f
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x53fbb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.00491200
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4eb784
xor al, al
jmp 0x4eb81f
mov dword [ebp - 0x244], 0x22c
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4eb813
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x260]
push ecx
call fcn.004eb550
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.00403bb0
push eax
lea ecx, [ebp - 0x260]
call fcn.00403bb0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4eb7ed
lea edx, [ebp - 0x23c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.004019b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.00403c40
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4eb7a2
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049115e
mov esp, ebp
pop ebp
ret

Function at 0x4eb840
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x53fbb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.00491200
add esp, 0xc
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404490
mov ecx, dword [ebp - 0x114]
or ecx, 1
mov dword [ebp - 0x114], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049115e
mov esp, ebp
pop ebp
ret
Function at 0x4eb8c0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f5b57
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x53fbb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.00403bb0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4eb9a8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004eb6b0
add esp, 8
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 4], 0
push 0x514acc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.00403160
add esp, 0xc
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x74], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x74]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004031f0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.00403c40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00403c40
lea ecx, [ebp - 0x2c]
call fcn.00403bb0
push eax
mov ecx, dword [ebp + 8]
call fcn.00403bb0
push eax
call fcn.00499fdc
add esp, 8
push 5
push 0
lea ecx, [ebp - 0x2c]
call fcn.00403bb0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x2c]
call fcn.00403c40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049115e
mov esp, ebp
pop ebp
ret

Function at 0x4ebef0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x53fbb0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
call fcn.004ebcb0
add esp, 4
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x20]
call fcn.00401780
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ebf4c
push 3
push 0
mov ecx, dword [ebp + 8]
call fcn.00401780
push eax
lea ecx, [ebp - 0x20]
call fcn.00401780
push eax
push 0x514c74
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x20
jae 0x4ebf71
push 3
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00401780
push eax
push 0x514c80
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x20
jae 0x4ebf99
push 3
push 0
mov ecx, dword [ebp + 8]
call fcn.00401780
push eax
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x20
sbb ecx, ecx
add ecx, 1
mov byte [ebp - 0x25], cl
lea ecx, [ebp - 0x20]
call fcn.00401740
mov al, byte [ebp - 0x25]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049115e
mov esp, ebp
pop ebp
ret
Function at 0x4ebfd0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x4ec036
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
add eax, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
cmp ecx, 0x186a0
jl 0x4ec01d
push 0
mov ecx, dword [ebp - 4]
call fcn.004e62f0
mov ecx, dword [ebp - 4]
call fcn.004e6320
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp - 4]
mov dword [eax + 0x20], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00491170
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.004e6350
mov esp, ebp
pop ebp
ret 4

Function at 0x4ec8f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x53fbb0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.00410f60
jmp 0x4ec91f
push 0
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 8]
call fcn.00413010
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp + 8]
call fcn.00412b10
push eax
lea ecx, [ebp - 8]
call fcn.00411340
movzx eax, al
test eax, eax
je 0x4ec99f
lea ecx, [ebp - 8]
call fcn.00431280
mov ecx, eax
call fcn.00403bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
push eax
push ecx
call fcn.004ead50
add esp, 8
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x28]
push edx
call fcn.004144a0
add esp, 0x20
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x28]
call fcn.00401780
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ec992
mov byte [ebp - 0x3d], 0
lea ecx, [ebp - 0x28]
call fcn.00401740
mov al, byte [ebp - 0x3d]
jmp 0x4ec9a1
lea ecx, [ebp - 0x28]
call fcn.00401740
jmp 0x4ec911
mov al, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0049115e
mov esp, ebp
pop ebp
ret 4

Function at 0x4ec9c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x53fbb0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x44], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.00410f60
jmp 0x4ec9ef
push 0
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 8]
call fcn.00413010
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp + 8]
call fcn.00412b10
push eax
lea ecx, [ebp - 8]
call fcn.00411340
movzx eax, al
test eax, eax
je 0x4eca6f
lea ecx, [ebp - 8]
call fcn.00431280
mov ecx, eax
call fcn.00403bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
push eax
push ecx
call fcn.004ead50
add esp, 8
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x28]
push edx
call fcn.004144a0
add esp, 0x20
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x28]
call fcn.00401780
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4eca62
mov byte [ebp - 0x3d], 0
lea ecx, [ebp - 0x28]
call fcn.00401740
mov al, byte [ebp - 0x3d]
jmp 0x4eca71
lea ecx, [ebp - 0x28]
call fcn.00401740
jmp 0x4ec9e1
mov al, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0049115e
mov esp, ebp
pop ebp
ret 4
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x79867958
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..text
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x59ff5371
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4819473b
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2fc602be
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4014d0
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x6b117c]
movzx ecx, word [eax + 0x129]
push ecx
lea edx, [esp + 0x10]
push str.._data_aiconfig__d.dat
push edx
call fcn.00565980
push 0x583640
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00565939
mov eax, dword [esp + 0x20]
add esp, 0x18
test eax, eax
je 0x401556
push eax
push 1
push 0x1c64
add edi, 0xec
push edi
call fcn.005657ec
mov edx, dword [esp + 0x18]
push edx
call fcn.00565621
add esp, 0x14
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.00565a22
add esp, 0x48
ret
Function at 0x404e20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x6b117c]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00565980
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.00565470
push 0x583700
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00565939
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x404ef8
push eax
push 1
push 0x1c64
push edi
call fcn.00565f05
mov edx, dword [esp + 0x18]
push edx
call fcn.00565621
add esp, 0x14
call fcn.00404230
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x404ebb
fadd dword [0x583680]
fstp dword [esi + 0xe0]
call fcn.00404230
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x404ee1
fadd dword [0x583680]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00565a22
add esp, 0x4c
ret
mov ecx, esi
call fcn.00404640
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00565a22
add esp, 0x4c
ret

Function at 0x404e33
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x6b117c]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00565980
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.00565470
push 0x583700
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00565939
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x404ef8
push eax
push 1
push 0x1c64
push edi
call fcn.00565f05
mov edx, dword [esp + 0x18]
push edx
call fcn.00565621
add esp, 0x14
call fcn.00404230
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x404ebb
fadd dword [0x583680]
fstp dword [esi + 0xe0]
call fcn.00404230
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x404ee1
fadd dword [0x583680]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00565a22
add esp, 0x4c
ret
mov ecx, esi
call fcn.00404640
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00565a22
add esp, 0x4c
ret
Function at 0x40a3e0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push 0x40a360
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6a2cf4], eax
ret 4
Function at 0x40a7d0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x35c
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push ebp
push 0x104
lea eax, [esp + 0x260]
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x25c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40a806
mov ecx, dword [str.mfl.dat]
mov edx, dword [0x5839f4]
mov dword [eax], ecx
mov cl, byte [0x5839f8]
mov dword [eax + 4], edx
lea edx, [esp + 0x25c]
push 0x583998
push edx
mov byte [eax + 8], cl
call fcn.00565922
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40a865
push eax
call fcn.00565621
add esp, 4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.00565a22
add esp, 0x35c
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x160]
push eax
push 0x104
call edi
lea eax, [esp + 0x160]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40a884
mov ecx, dword [str.Resource.bin]
mov edx, dword [0x5839e4]
mov dword [eax], ecx
mov ecx, dword [0x5839e8]
mov dword [eax + 4], edx
mov edx, dword [0x5839ec]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.005668b1
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.005668b1
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a8c4
lea edx, [esp + 0x160]
push edx
push 0x104
call edi
lea edi, [esp + 0x160]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a940
mov ecx, 6
mov esi, str.ResourceSkillArea.bsad
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea esp, [esp]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.005668b1
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.005668b1
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a970
push ebx
call fcn.00565621
mov ecx, dword [esp + 0x36c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00565a22
add esp, 0x35c
ret
Function at 0x40aa00
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov ecx, 0x6a4aa0
call fcn.00423bd0
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6a27d4], ebp
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x6dbdd4]
xor edx, edx
mov eax, esi
div dword [0x6db360]
mov eax, dword [0x6db364]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40aa5d
cmp dword [edx], esi
je 0x40aaa1
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x40aa52
push 0
push ebp
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6a27d8
push 0x6a29f0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6a27c0], esi
test esi, esi
jne 0x40aabd
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40aa5d
mov eax, dword [edx + 8]
push 0
push ebp
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x40aa72
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6a2d20
call fcn.0040c0a0
cmp dword [0x6b30a8], 0
push 0
mov ecx, 0x6a2d20
push 0
jne 0x40ab0e
push 1
call fcn.0040bf10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push 2
call fcn.0040bf10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40b2b0
Capabilities:
Create directory
Delete file

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push esi
call fcn.0040a3e0
mov eax, dword [esp + 0x2c]
mov dword [0x6a27b8], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40b2f1
test dl, dl
je 0x40b2ed
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40b2f1
add eax, 2
add ecx, 2
test dl, dl
jne 0x40b2d1
xor eax, eax
jmp 0x40b2f6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40b317
push 0
push str.Error__
push 0x583b24
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
call fcn.0040a650
test eax, eax
je 0x40b30e
push esi
call fcn.0040a3e0
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x583b10
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x6c0810
call fcn.0050f2a0
push str._____________________Client_Start______________________
push 0x6c0810
call fcn.0050f2a0
push str._______________________________________________________
push 0x6c0810
call fcn.0050f2a0
add esp, 0x18
call fcn.0040a5c0
mov ecx, 0x6c1de8
call fcn.00519100
push 0x6db232
push 0x6a27d8
call fcn.00565980
push 0x6db232
push 0x6a29f0
call fcn.00565980
push esi
call fcn.0040b240
add esp, 0x14
mov ecx, 0x6c1de8
call fcn.0051b6f0
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6bea68
call fcn.004e3020
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6bea68
call fcn.004e3ba0
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6bea68
call fcn.004e1d00
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6bea68
call fcn.004e31c0
mov ecx, 0x6b0700
call fcn.00431ae0
mov eax, dword [esp + 0x30]
push eax
push esi
call fcn.0040aa00
add esp, 8
test eax, eax
jne 0x40b414
call fcn.0040a660
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x40b44b
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
jmp 0x40b428
mov ecx, 0x6a2d20
call fcn.0040c420
cmp eax, 0xffffffff
jne 0x40b428
call fcn.0040a660
mov eax, dword [esp + 0x14]
pop edi
pop ebx
pop esi
add esp, 0x1c
ret 0x10