joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ac0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x409335
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
lea ecx, [esp]
mov dword [esp + 8], 0
call sub.MFC42u.DLL_CString::CString_2
lea eax, [esp + 0x14]
push 0x104
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x230]
push 0x104
push ecx
push 0x40e634
mov dword [esp + 0x44c], 1
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x406b43
mov edx, dword [esp + 4]
lea eax, [esp]
push edx
push 0x40e62c
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
push esi
mov esi, dword [esp + 0x438]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 0xc], 1
lea ecx, [esp + 4]
mov byte [esp + 0x430], 0
call fcn.004082ee
mov ecx, dword [esp + 0x428]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x430
ret
Function at 0x406b90
Capabilities:
Get hostname

Disassembly:
push 0xffffffffffffffff
push 0x409398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
mov al, byte [0x40ea80]
push ebx
xor ebx, ebx
push esi
test al, 1
mov dword [esp + 0x14], ebx
jne 0x406bde
mov dl, al
mov ecx, 0x40ea7c
or dl, 1
mov byte [0x40ea80], dl
call sub.MFC42u.DLL_CString::CString_2
push 0x406e00
call fcn.0040872b
add esp, 4
mov eax, dword [0x40ea7c]
cmp dword [eax - 8], ebx
jne 0x406dcc
push edi
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x250], ebx
push ecx
push ebx
call fcn.00406810
add esp, 8
lea ecx, [esp + 0xc]
push 0x20
call sub.MFC42u.DLL_CString::Remove
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::TrimLeft
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::TrimRight
lea edx, [esp + 0x24]
push edx
call fcn.00406ac0
mov esi, eax
lea eax, [esp + 0x20]
mov byte [esp + 0x254], 1
push eax
call fcn.004069f0
add esp, 8
push esi
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x25c], 2
call sub.MFC42u.DLL_operator
lea edx, [esp + 0xc]
mov byte [esp + 0x250], 3
push edx
push eax
lea eax, [esp + 0x1c]
push eax
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x20]
mov byte [esp + 0x250], 7
call fcn.004082ee
lea ecx, [esp + 0x1c]
mov byte [esp + 0x250], 6
call fcn.004082ee
lea ecx, [esp + 0x24]
mov byte [esp + 0x250], 5
call fcn.004082ee
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x40ea7c
call fcn.0040834e
push 0x20
mov ecx, 0x40ea7c
call sub.MFC42u.DLL_CString::Remove
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x4a]
mov word [esp + 0x48], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x28]
lea eax, [esp + 0x48]
push edx
push eax
mov dword [esp + 0x30], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [esp + 0x2c]
call fcn.00401000
lea ecx, [esp + 0x48]
mov byte [esp + 0x250], 8
push ecx
call fcn.00401e90
add esp, 4
mov esi, eax
lea ecx, [esp + 0x2c]
push esi
call fcn.004012c0
push esi
call fcn.00401f00
add esp, 4
lea ecx, [esp + 0x2c]
call fcn.00401080
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00401da0
add esp, 8
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0x40ea7c
push ecx
mov byte [esp + 0x25c], 9
call sub.MFC42u.DLL_operator
push eax
mov ecx, 0x40ea7c
mov byte [esp + 0x254], 0xa
call fcn.0040834e
lea ecx, [esp + 0x18]
mov byte [esp + 0x250], 9
call fcn.004082ee
push 0x3d
mov ecx, 0x40ea7c
call sub.MFC42u.DLL_CString::Remove
lea ecx, [esp + 0x10]
mov byte [esp + 0x250], 8
call fcn.004082ee
lea ecx, [esp + 0x2c]
mov byte [esp + 0x250], 5
call fcn.00401040
lea ecx, [esp + 0x14]
mov byte [esp + 0x250], bl
call fcn.004082ee
lea ecx, [esp + 0xc]
mov dword [esp + 0x250], 0xffffffff
call fcn.004082ee
pop edi
mov esi, dword [esp + 0x254]
push 0x40ea7c
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov ecx, dword [esp + 0x244]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x248
ret
Function at 0x406fc0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x420
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22]
mov word [esp + 0x20], bx
rep stosd dword es:[edi], eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.IMONITOR_ID_30035
stosw word es:[edi], ax
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
push 0x40ea68
push eax
call fcn.00401c90
mov ecx, dword [eax]
mov esi, dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [esp + 0x2c]
push ecx
push edx
call esi
add esp, 0x14
lea ecx, [esp + 0x1c]
call fcn.004082ee
push str._C:Windows_system_sys_sysconmssys.exe____UPLOAD__1_
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::CString
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x22a]
mov word [esp + 0x228], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x228]
push eax
push ecx
call esi
add esp, 8
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str._shellimonitor
push 0x80000000
call esi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
lea ecx, [esp + 0x20]
push ecx
call edi
add esp, 4
lea edx, [esp + 0x20]
shl eax, 1
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call ebx
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str._shellimonitorcommand
push 0x80000000
call esi
lea ecx, [esp + 0x228]
push ecx
call edi
add esp, 4
lea edx, [esp + 0x228]
shl eax, 1
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push 0
push 0
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea ecx, [esp + 0x14]
call fcn.004082ee
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x420
ret

Function at 0x407120
Capabilities:
Delete registry key

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 8]
push edi
push eax
push 0x20019
push 0
push str._shellimonitor
push 0x80000000
call esi
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.command
push ecx
call edi
mov edx, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str._shell
push 0x80000000
call esi
mov ecx, dword [esp + 0xc]
push str.imonitor
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call ebx
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4063d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x406410
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x406415
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0x134
mov eax, dword [0x439360]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
mov esi, str.Game.exe
lea edi, [ebp + 0xa4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, str.Game_08d.exe
lea edi, [ebp + 0x94]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 2
movsb byte es:[edi], byte [esi]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, 0x128
push esi
mov dword [ebp - 0x78], eax
call fcn.0040b4b5
pop ecx
mov edi, eax
push edi
push dword [ebp - 0x78]
mov dword [edi], esi
call sub.KERNEL32.dll_Process32First
mov al, byte [ebp + 0xbc]
push edi
push dword [ebp - 0x78]
mov byte [ebp - 0x71], al
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x406561
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, 0x43abe0
lea eax, [edi + 0x24]
push eax
lea eax, [ebp + 0xa4]
push eax
call fcn.0040b350
pop ecx
pop ecx
test eax, eax
je 0x4064ca
lea eax, [edi + 0x24]
push eax
lea eax, [ebp + 0x94]
push eax
call fcn.0040b350
pop ecx
pop ecx
test eax, eax
jne 0x406550
push dword [edi + 8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x104
lea ecx, [ebp - 0x70]
push ecx
push 0
push eax
mov dword [ebp - 0x80], eax
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [ebp - 0x70]
push eax
call fcn.0041f083
push esi
call fcn.0041f083
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.0040b220
add esp, 0x10
test eax, eax
je 0x406550
cmp byte [ebp - 0x71], 0
je 0x40651d
push 0
push dword [ebp - 0x80]
call ebx
jmp 0x406550
push 6
push 0x43039c
push 0x430340
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xb
jne 0x406544
push 0
push dword [ebp - 0x80]
mov byte [ebp - 0x71], 1
call ebx
cmp dword [ebp - 0x7c], 4
je 0x406566
cmp dword [ebp - 0x7c], 2
je 0x40658b
push edi
push dword [ebp - 0x78]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40649a
xor esi, esi
inc esi
jmp 0x406568
xor esi, esi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xb0]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b3d8
add ebp, 0xb4
leave
ret
or esi, 0xffffffff
jmp 0x406568
Function at 0x407352
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x4084a6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x439360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov esi, 0x400
jmp 0x4084d7
push eax
lea eax, [ebp - 0x404]
push eax
mov ecx, ebx
call fcn.004083e4
push edi
push esi
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.0040c962
add esp, 0x10
test eax, eax
jne 0x4084c8
push edi
call fcn.0040c646
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b3d8
leave
ret 4

Function at 0x408655
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x439360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, str.TPK_DT_UPDATE
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
movsd dword es:[edi], dword [esi]
push 0
push 0
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x4086a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4086a1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x4086a3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040b3d8
leave
ret
Function at 0x4086b1
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x439360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 7
mov dword [ebp - 0x4c], ecx
pop ecx
mov eax, str.SOFTWAREHuaYoudamingSetup
mov esi, eax
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 7
pop ecx
mov esi, eax
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x104
xor edi, edi
push esi
push edi
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], edi
call fcn.0040c050
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
mov ebx, 0x20019
push ebx
push edi
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x54], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 0x80000002
push edi
call esi
test eax, eax
je 0x40872f
lea eax, [ebp - 0x48]
push eax
push ebx
push 0
lea eax, [ebp - 0x24]
push eax
push edi
call esi
test eax, eax
jne 0x40876b
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x4c]
lea eax, [ebp - 0x58]
push eax
push 0
push str.InstallPath
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408762
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x50], ecx
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x50]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b3d8
leave
ret

Function at 0x40881d
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
push esi
push edi
push 0
push 0
mov edi, 0x43ae40
push edi
mov esi, 0x43ad38
push esi
push dword [esp + 0x20]
call fcn.0040e3ba
push edi
push esi
call fcn.0040e0e0
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x1c
push dword [esp + 0x10]
call ebp
cmp eax, 0xffffffff
jne 0x40889d
push esi
xor edi, edi
call fcn.0040b750
pop ecx
test eax, eax
jbe 0x40889d
push ebx
mov bl, byte [edi + 0x43ad38]
cmp bl, 0x5c
je 0x408872
cmp bl, 0x2f
jne 0x408890
push esi
mov byte [edi + 0x43ad38], 0
call ebp
cmp eax, 0xffffffff
jne 0x40888a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [edi + 0x43ad38], bl
push esi
inc edi
call fcn.0040b750
pop ecx
cmp edi, eax
jb 0x408862
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x40894d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
mov esi, ecx
push 0x104
push esi
call fcn.00408919
test eax, eax
jl 0x408985
cmp byte [esi], 0
je 0x408985
cmp dword [ebp - 4], 3
jbe 0x408985
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x408987
xor eax, eax
pop esi
leave
ret
Function at 0x408d8d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x439360]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x10c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x2e
push esi
mov ebx, ecx
call fcn.0040ca20
mov edi, eax
mov eax, dword [0x43ad2c]
pop ecx
pop ecx
test eax, eax
je 0x408dd7
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x3ec
push dword [0x43ad30]
call eax
test edi, edi
je 0x408dfd
push str..tpk
push edi
call fcn.0040edb3
pop ecx
pop ecx
test eax, eax
jne 0x408dfd
push ebx
push esi
mov ecx, ebx
call fcn.00408b3d
mov dword [ebp - 0x10c], eax
jmp 0x408e3d
push esi
call fcn.0040881d
push 0x5c
push esi
call fcn.0040ca20
add esp, 0xc
test eax, eax
jne 0x408e16
mov eax, esi
jmp 0x408e17
inc eax
push eax
push ebx
lea eax, [ebp - 0x108]
push str._s_s
push eax
call fcn.0040c97f
add esp, 0x10
push 0
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [ebp - 0x10c], 0
pop edi
pop esi
pop ebx
jne 0x408e65
mov eax, dword [0x43ad2c]
test eax, eax
je 0x408e65
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x3ed
push dword [0x43ad30]
call eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
xor ecx, ebp
call fcn.0040b3d8
leave
ret 0x10
Function at 0x408e79
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
sub esp, 0x1a8
lea ebp, [esp - 4]
mov eax, dword [0x439360]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
push 0x3c
mov eax, 0x42f883
call fcn.0040bbc1
mov dword [ebp - 0x10], ecx
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00401540
and dword [ebp - 4], 0
push str._Config_Client.ini
push eax
lea eax, [ebp + 0x88]
push eax
call fcn.00408af6
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00402360
mov eax, dword [ebp + 0x8c]
push 0x10
pop ebx
cmp dword [ebp + 0xa0], ebx
jae 0x408ee9
lea eax, [ebp + 0x8c]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test al, 1
je 0x408f17
mov ecx, dword [ebp + 0x8c]
and eax, 0xfffffffe
cmp dword [ebp + 0xa0], ebx
jae 0x408f13
lea ecx, [ebp + 0x8c]
push eax
push ecx
call edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x48]
call fcn.00401540
push str._Config_config.ini
push eax
lea eax, [ebp + 0x6c]
push eax
mov byte [ebp - 4], 3
call fcn.00408af6
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.00402360
mov eax, dword [ebp + 0x70]
cmp dword [ebp + 0x84], ebx
jae 0x408f56
lea eax, [ebp + 0x70]
push eax
call esi
test al, 1
je 0x408f72
mov ecx, dword [ebp + 0x70]
and eax, 0xfffffffe
cmp dword [ebp + 0x84], ebx
jae 0x408f6e
lea ecx, [ebp + 0x70]
push eax
push ecx
call edi
mov ecx, dword [ebp + 0x8c]
cmp dword [ebp + 0xa0], ebx
jae 0x408f86
lea ecx, [ebp + 0x8c]
mov eax, dword [ebp - 0x10]
add eax, 0x120
cmp dword [eax + 0x18], ebx
jb 0x408f98
mov eax, dword [eax + 4]
jmp 0x408f9b
add eax, 4
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ecx
push eax
push str.GameVersion
mov edi, str.Version
push edi
call esi
push 0x104
lea eax, [ebp + 0xa4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0xa4]
push 0x4306f0
push eax
call fcn.0040e73a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x409014
push ebx
lea ecx, [ebp]
call fcn.0040859c
lea ecx, [ebp]
call fcn.004085ba
cmp dword [ebp + 0xa0], 0x10
mov ecx, dword [ebp + 0x8c]
jae 0x409003
lea ecx, [ebp + 0x8c]
push ecx
push eax
push 0x4306ec
push edi
call esi
push ebx
call fcn.0040c646
pop ecx
push 0
push 1
lea ecx, [ebp + 0x6c]
call fcn.00402360
push 0
push 1
lea ecx, [ebp + 0x88]
call fcn.00402360
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1a8]
xor ecx, ebp
call fcn.0040b3d8
add ebp, 0x1ac
leave
ret
Function at 0x40b3d8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x439360]
jne 0x40b3e2
repz ret
jmp fcn.00412eae

Function at 0x41c415
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413740
and dword [ebp - 4], 0
cmp dword [0x43bb2c], 0
mov ebx, eax
jne 0x41c4c6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41c577
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x432a60
push edi
call esi
test eax, eax
je 0x41c577
push eax
call fcn.004136ce
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43bb2c], eax
call esi
push eax
call fcn.004136ce
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43bb30], eax
call esi
push eax
call fcn.004136ce
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43bb34], eax
call esi
push eax
call fcn.004136ce
pop ecx
mov dword [0x43bb3c], eax
test eax, eax
je 0x41c4c6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004136ce
pop ecx
mov dword [0x43bb38], eax
mov eax, dword [0x43bb38]
cmp eax, ebx
je 0x41c51e
cmp dword [0x43bb3c], ebx
je 0x41c51e
push eax
call fcn.00413749
push dword [0x43bb3c]
mov esi, eax
call fcn.00413749
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41c51e
test edi, edi
je 0x41c51e
call esi
test eax, eax
je 0x41c515
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41c515
test byte [ebp - 0xc], 1
jne 0x41c51e
or dword [ebp + 0x10], 0x200000
jmp 0x41c557
mov eax, dword [0x43bb30]
cmp eax, ebx
je 0x41c557
push eax
call fcn.00413749
pop ecx
test eax, eax
je 0x41c557
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41c557
mov eax, dword [0x43bb34]
cmp eax, ebx
je 0x41c557
push eax
call fcn.00413749
pop ecx
test eax, eax
je 0x41c557
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43bb2c]
call fcn.00413749
pop ecx
test eax, eax
je 0x41c577
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41c579
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42aad0
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x439360]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42aaf8
jmp 0x42ab4c
mov ecx, dword [ebp - 4]
and ecx, 0xfffffffd
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0xfffffffe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
and eax, 0xfffffffb
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x42ab4c
mov eax, dword [ebp + 8]
push eax
push str.cmd_C_D_attrib__r__s__h__s
lea ecx, [ebp - 0x408]
push ecx
call fcn.0040c97f
add esp, 0xc
push 0
lea edx, [ebp - 0x408]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040b3d8
mov esp, ebp
pop ebp
ret

Function at 0x42ab60
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
push 0x43c118
push 0x43c010
mov eax, dword [ebp + 8]
push eax
call fcn.0040e3ba
add esp, 0x14
push 0x43c118
push 0x43c010
call fcn.0040e0e0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42aba6
jmp 0x42ac29
mov dword [ebp - 4], 0
jmp 0x42abb8
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0x43c010
call fcn.0040b750
add esp, 4
cmp dword [ebp - 4], eax
jae 0x42ac29
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 0x43c010]
cmp ecx, 0x5c
je 0x42abe8
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x43c010]
cmp eax, 0x2f
jne 0x42ac27
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + 0x43c010]
mov byte [ebp - 5], dl
mov eax, dword [ebp - 4]
mov byte [eax + 0x43c010], 0
push 0x43c010
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42ac1b
push 0
push 0x43c010
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
mov dl, byte [ebp - 5]
mov byte [ecx + 0x43c010], dl
jmp 0x42abaf
mov esp, ebp
pop ebp
ret
Function at 0x42ae20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xeeeeeeee
mov eax, dword [ebp + 0xc]
shr eax, 2
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
test ecx, ecx
jbe 0x42aea8
mov eax, dword [ebp + 0x10]
and eax, 0xff
mov ecx, dword [ebp - 8]
add ecx, dword [eax*4 + 0x43d220]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor edx, dword [eax]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x10]
not ecx
shl ecx, 0x15
add ecx, 0x11111111
mov edx, dword [ebp + 0x10]
shr edx, 0xb
or ecx, edx
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
shl ecx, 5
lea edx, [eax + ecx + 3]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp + 8], edx
jmp 0x42ae36
mov esp, ebp
pop ebp
ret