joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4885fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b779d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x20], 0xeae
mov dword [ebp - 0x24], str.tynfykrxo_arywhouf_wznwdu_ywedtlchw_frmisys_cqvu_gtbuqgdli_vqqxbkebu_pkgznskt
cmp dword [ebp - 0x20], 0xecd
jle 0x4886a1
and dword [ebp - 0x18], 0
jmp 0x488648
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1c40
jge 0x4886a1
and dword [ebp - 0x1c], 0
jmp 0x48865e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x469a
jge 0x48869f
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.0040195e
pop ecx
pop ecx
mov ecx, eax
call fcn.004200e8
push eax
call fcn.004a11e7
pop ecx
lea ecx, [ebp - 0x44]
call fcn.004200de
jmp 0x488657
jmp 0x488641
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x4886b1
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xb1a
jge 0x4886c7
push dword [ebp - 0x24]
call fcn.004a11e7
pop ecx
jmp 0x4886e3
or dword [ebp - 4], 0xffffffff
jmp 0x4886ed
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b270c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b87c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004a50bb
mov dword [ebp - 0x14], eax
cmp dword [0xac793c], esi
jne 0x4b27ff
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4b278c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4b28df
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4b28df
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4b28df
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xac793c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xac7940], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xac7944], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xac794c], eax
test eax, eax
je 0x4b27fc
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xac7948], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4b2824
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4b2817
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4b2839
push 4
pop eax
jmp 0x4b28e1
cmp dword [ebp - 0x14], esi
je 0x4b2839
push dword [0xac793c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4b281e
mov eax, dword [0xac7948]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4b2897
cmp dword [0xac794c], edi
je 0x4b2897
push eax
call ebx
push dword [0xac794c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4b2897
test eax, eax
je 0x4b2897
call ecx
test eax, eax
je 0x4b288c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4b288c
test byte [ebp - 8], 1
jne 0x4b2897
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4b28c7
mov eax, dword [0xac7940]
cmp eax, edi
je 0x4b28c4
push eax
call ebx
test eax, eax
je 0x4b28c4
call eax
mov esi, eax
test esi, esi
je 0x4b28c4
mov eax, dword [0xac7944]
cmp eax, edi
je 0x4b28c4
push eax
call ebx
test eax, eax
je 0x4b28c4
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xac793c]
call ebx
test eax, eax
je 0x4b28df
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4b28e1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a251b
mov esp, ebp
pop ebp
ret
Function at 0x401cb0
Capabilities:
Get common file path

Disassembly:
push ebp
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x401d2b
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push edi
call ebp
push ebx
mov esi, eax
call fcn.00405450
add eax, esi
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x401ce7
pop edi
pop esi
pop ebp
ret
push esi
push edi
call ebp
mov ebp, eax
cmp word [edi + ebp*2 - 2], 0x5c
je 0x401cfe
mov word [edi + ebp*2], 0x5c
add ebp, 1
push ebx
xor esi, esi
call fcn.00405450
add esp, 4
test eax, eax
jbe 0x401d2b
lea ebp, [edi + ebp*2]
mov cx, word [ebx + esi*2]
mov word [ebp], cx
push ebx
add esi, 1
add ebp, 2
call fcn.00405450
add esp, 4
cmp esi, eax
jb 0x401d10
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x402e10
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
cmp dword [0x4086b0], esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x24
mov dword [esp + 0x14], 0x26
mov dword [esp + 0x18], 0x2a
jne 0x402ea6
push 3
push 0x20
push 3
push 1
push 3
push 2
push esi
push esi
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
call sub.KERNEL32.dll_VerSetConditionMask
push edx
push eax
push 0x23
push 0x4086b0
mov dword [0x4086b0], 0x11c
mov dword [0x4086b4], 6
mov dword [0x4086b8], 1
mov word [0x4087c4], si
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
neg eax
sbb eax, eax
add eax, 1
mov dword [section..data], eax
jmp 0x402eab
mov eax, dword [section..data]
cmp eax, esi
je 0x402eba
pop esi
mov eax, 1
pop ebp
add esp, 0x14
ret
cmp ebp, esi
je 0x402fda
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push edi
push esi
push esi
push esi
push ebp
call ebx
mov edi, eax
test edi, edi
je 0x402fd8
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x402fd8
push 0
mov ecx, eax
push ecx
push edi
push ebp
call ebx
cmp edi, eax
jbe 0x402fd8
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ebx, ebx
jmp 0x402f10
mov eax, dword [esp + ebx*4 + 0x18]
cmp eax, 0x26
jne 0x402f8f
push 0
push 0
push str._ProgramW6432_
call ebp
mov edi, eax
test edi, edi
je 0x402fd8
lea edx, [edi + edi + 2]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x402fd8
push edi
push esi
push str._ProgramW6432_
call ebp
cmp edi, eax
jne 0x402fd8
push esi
push str._ProgramW6432_
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x402f76
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x4069cc
push 0x26
jmp 0x402f95
cmp word [esi + edi*2 - 4], 0x5c
je 0x402fa3
push 0x4064c0
add edi, 1
push edi
push esi
call fcn.00402c60
jmp 0x402fa3
push 0x4069cc
push eax
call fcn.00402d00
mov esi, eax
add esp, 8
test esi, esi
je 0x402fd8
push esi
call fcn.00405450
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.00405462
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
jne 0x402fd8
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, 1
xor esi, esi
cmp ebx, 3
jl 0x402f10
pop edi
pop ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x403380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
call fcn.00403210
mov esi, eax
add esp, 4
test esi, esi
je 0x4033c2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4033a4
test al, 0x50
je 0x4033c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4033b7
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x405462
Capabilities:
Terminate process

Disassembly:
inc eax
add byte [eax], al
jne 0x405420
push eax
call dword [sym.imp.MSVCR120.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.MSVCR120.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x4087dc], 0
jne 0x405434
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x4087e0]
mov dword [ebp - 4], 0xfffffffe
call fcn.00405615
ret
je 0x4053e5
std
xchg byte [ebx + 0x3720000], bl
add byte [edx + 3], dh
Function at 0x401740
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x40175b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x401766
bts eax, 6
shr ecx, 1
test cl, 1
je 0x401771
bts eax, 5
shr ecx, 1
test cl, 1
je 0x40177c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x401787
bts eax, 3
shr ecx, 1
test cl, 1
je 0x401792
bts eax, 2
shr ecx, 1
test cl, 1
je 0x40179d
bts eax, 1
test cl, 2
je 0x4017a6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x401842
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x401833
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x401750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401870
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x4497a0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.0041c956
add esp, 0xc
test eax, eax
je 0x4018a9
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.0041c99d
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x4018d5
call fcn.0041ca1f
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.0041cc81
add esp, 0x10
test eax, eax
je 0x40192f
push esi
nop word [eax + eax]
mov esi, ebx
test eax, eax
je 0x401917
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x4018f6
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call fcn.0041cc81
add esp, 0x10
test eax, eax
jne 0x4018f0
pop esi
push ebx
call fcn.0041cdb2
push dword [ebp + 0xc]
call fcn.0041ca1f
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406800
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3af54
call fcn.00418e70
mov eax, dword [0x451068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x40682c
jmp 0x40683e
lea eax, [ebp - 0x3a398]
push 0x25b70
push 0
push eax
call fcn.004199c0
add esp, 0xc
lea eax, [ebp - 0x136f8]
push 0x1f40
push 0
push eax
call fcn.004199c0
add esp, 0xc
lea eax, [ebp - 0x11178]
push 0x101d0
push 0
push eax
call fcn.004199c0
add esp, 8
mov ecx, 0x478650
call fcn.00402e00
push ecx
mov ecx, 0x496eb0
call fcn.00403710
push ecx
mov ecx, 0x473648
call fcn.00402b80
push ecx
mov ecx, 0x4a1140
call fcn.00403b80
push ecx
mov ecx, 0x479210
call fcn.00403040
push ecx
mov ecx, 0x4a50d0
call fcn.004042b0
push ecx
mov ecx, 0x4a3f98
call fcn.00403fd0
push ecx
call fcn.00403580
push ecx
mov ecx, 0x4a0af8
call fcn.00403990
push ecx
mov ecx, 0x486cd8
call fcn.00403310
push ecx
call fcn.004028f0
push 0x9c40
lea eax, [ebp - 0x3a398]
mov ecx, 0x2ee
mov esi, 0x478654
lea edi, [ebp - 0x3af50]
push 0x496eb4
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00419440
add esp, 0xc
lea eax, [ebp - 0x30758]
push 0x5000
push 0x47364c
push eax
call fcn.00419440
add esp, 0xc
lea eax, [ebp - 0x2b758]
push 0x2710
push 0x4a1144
push eax
call fcn.00419440
add esp, 0xc
lea eax, [ebp - 0x29048]
push 0xdac0
push 0x479214
push eax
call fcn.00419440
add esp, 0xc
push 0x6d60
lea eax, [ebp - 0x1b588]
push 0x4a50d4
push eax
call fcn.00419440
add esp, 0xc
lea edi, [ebp - 0x14828]
mov ecx, 0x2bc
lea eax, [ebp - 0x136f8]
mov esi, 0x4a3f9c
rep movsd dword es:[edi], dword [esi]
push 0x1f40
mov ecx, 0x190
lea edi, [ebp - 0x13d38]
mov esi, 0x4a4a8c
push 0x51c7a0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00419440
add esp, 0xc
lea eax, [ebp - 0x11178]
mov ecx, 0x190
lea edi, [ebp - 0x117b8]
mov esi, 0x4a0afc
rep movsd dword es:[edi], dword [esi]
push 0x101d0
push 0x486cdc
push eax
call fcn.00419440
mov ecx, 0x3e8
lea edi, [ebp - 0xfa8]
mov esi, 0x51b800
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
xor eax, eax
nop dword [eax]
mov cl, byte [ebp + eax - 0x3af50]
mov edx, eax
xor cl, al
shr edx, 8
xor dl, 0x6e
xor cl, 0xe6
sub cl, dl
mov byte [ebp + eax - 0x3af50], cl
inc eax
cmp eax, 0x3af48
jb 0x406a00
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str.Client_EffectGame.info
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406a77
push 0
lea eax, [ebp - 0x3af54]
mov dword [ebp - 0x3af54], 0
push eax
push 0x3af48
lea eax, [ebp - 0x3af50]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x406a8a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417ffe
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406aa2
jmp 0x406ab9
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00417ffe
mov esp, ebp
pop ebp
ret
Function at 0x406ad0
Capabilities:
Create directory
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
push 0
push str.Client
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, 0x44b1c8
mov ecx, 0x51a7b8
call fcn.00408f90
mov edx, str._n_KG_Emulator_
mov ecx, 0x51a7b8
call fcn.00408f90
mov edx, str._n
mov ecx, 0x51a7b8
call fcn.00408f90
mov edx, str._n____0__to_exit._n____1__to_generate_ServerGame.info_n____2__to_generate_EffectGame.info_n____3__to_calculate_ItemIndex_n____4__Encrypt_LuaScript_n____5__Encrypt_Item_Files_n____6__Encrypt_Main_Files
mov ecx, 0x51a7b8
call fcn.00408f90
mov edx, str._n_n__
mov ecx, 0x51a7b8
call fcn.00408f90
mov eax, dword [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
call fcn.00409240
mov eax, dword [esp + 8]
cmp eax, 6
ja case.default.0x406b51
jmp dword [eax*4 + 0x406cf4]
call fcn.00404f00
mov edx, str._nClient_ServerGame.info__OK_.
jmp 0x406cc6
call fcn.00406800
mov edx, str._nClient_EffectGame.info__OK_.
jmp 0x406cc6
mov edx, str._nItemType___
mov ecx, 0x51a7b8
call fcn.00408f90
mov eax, dword [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
call fcn.00409240
mov edx, str._nItemID___
mov ecx, 0x51a7b8
call fcn.00408f90
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
call fcn.00409240
mov edx, str._nItemIndex:
mov ecx, 0x51a7b8
call fcn.00408f90
mov ecx, dword [esp + 8]
shl ecx, 9
add ecx, dword [esp + 0xc]
push ecx
mov ecx, eax
call fcn.004070b0
jmp case.default.0x406b51
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str..MainInfo.ini
push 0x11
push 0x519b6c
push 0x449845
push str.KG_MainInfo_IpAddress
push str.MainInfo
call esi
push str..MainInfo.ini
push 0x7d
push 0x519b7d
push 0x449845
push str.KG_MainInfo_PrivateCode
push str.MainInfo
call esi
push str.MainProtectLuaScriptsEncrypted_
push str.MainProtectLuaScriptsDecrypted_
mov ecx, 0x519a60
call fcn.004109c0
mov edx, str._nEncrypted_Lua__OK_.
jmp 0x406cc6
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str..MainInfo.ini
push 0x11
push 0x5199cc
push 0x449845
push str.KG_MainInfo_IpAddress
push str.MainInfo
call esi
push str..MainInfo.ini
push 0x7d
push 0x5199dd
push 0x449845
push str.KG_MainInfo_PrivateCode
push str.MainInfo
call esi
push str.MainProtectItemFilesEncrypted_
push str.MainProtectItemFilesDecrypted_
mov ecx, 0x5198c0
call fcn.00410620
mov edx, str._nEncrypted_Items__OK_.
jmp 0x406cc6
push str..MainInfo.ini
push 0x7d
push 0x519c04
push 0x449845
push str.KG_MainInfo_PrivateCode
push str.MainInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
sub esp, 8
call fcn.00412970
mov edx, str._nEncrypted_Files__OK_.
mov ecx, 0x51a7b8
call fcn.00408f90
mov edx, str._n_n
mov ecx, 0x51a7b8
call fcn.00408f90
push str.pause
call fcn.0042243f
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ff10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
push 0x100
lea ebx, [esi + 0xc]
push ebx
call fcn.0041ecb6
add esp, 0xc
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40ff68
push ebx
lea eax, [esi + 0x218]
push str.__s__Could_not_open_file_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x40ff8b
push eax
call fcn.004182ed
add esp, 4
mov dword [esi + 4], 0
push dword [esi + 8]
call fcn.004182f2
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x40ffc3
push ebx
push str.__s__Could_not_alloc_file_buffer_n
lea eax, [esi + 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
push 0
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push dword [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ffe7
push ebx
push str.__s__Could_not_read_file_n
jmp 0x40ffa3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [esi + 0x214], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x410460
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x410614
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4104b3
push eax
call fcn.004182ed
add esp, 4
mov dword [esi + 4], 0
push dword [esi + 8]
call fcn.004182f2
add esp, 4
mov dword [esi + 4], eax
test eax, eax
je 0x41060d
push 0
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push dword [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41060d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 8], 8
jb 0x410512
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
cmp eax, dword [0x44b7d4]
jne 0x410512
mov eax, dword [ecx + 4]
cmp eax, dword [0x44b7d8]
je 0x410614
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 0xc]
call ebx
mov ebx, eax
mov dword [ebp + 0xc], ebx
cmp ebx, 0xffffffff
je 0x410614
mov ecx, dword [esi + 8]
add ecx, 8
push ecx
call fcn.004182f2
mov ecx, dword [0x44b7d4]
mov dword [ebp - 8], eax
mov dword [eax], ecx
mov ecx, dword [0x44b7d8]
mov dword [eax + 4], ecx
lea ecx, [eax + 8]
push dword [esi + 8]
mov dword [ebp + 8], ecx
push dword [esi + 4]
push ecx
call fcn.00419440
mov eax, dword [esi + 8]
add esp, 0x10
xor edi, edi
test eax, eax
jle 0x4105ce
mov ebx, dword [ebp + 8]
lea ecx, [esi + 0x11d]
nop dword [eax + eax]
mov eax, edi
lea edx, [ecx + 1]
and eax, 0xf
mov al, byte [eax + 0x44b7c4]
xor al, byte [ebx + edi]
mov byte [ebp + 8], al
mov byte [ebx + edi], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410597
sub ecx, edx
mov eax, edi
xor edx, edx
div ecx
lea ecx, [esi + 0x11d]
movsx eax, byte [edx + esi + 0x11d]
and eax, 0xf
mov al, byte [eax + 0x44b7c4]
add al, byte [ebp + 8]
mov byte [ebx + edi], al
inc edi
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x410580
mov ebx, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
add eax, 8
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
jne 0x410600
call eax
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
call eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x410620
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x451068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x308]
push 0x44b794
push eax
mov dword [ebp - 0x450], ecx
call esi
add esp, 0xc
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4107bc
nop
test byte [ebp - 0x448], 0x10
lea eax, [ebp - 0x41c]
jne 0x4106ec
push eax
push edi
lea eax, [ebp - 0x208]
push str._s_s
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x44c]
lea eax, [ebp - 0x108]
push str._s_s
push eax
call esi
lea eax, [ebp - 0x108]
push eax
push str._s_encrypted__n
call fcn.00401c40
mov ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x108]
add esp, 0x28
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00410460
jmp 0x4107a6
mov ecx, 0x44b5d4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410711
test dl, dl
je 0x41070d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410711
add eax, 2
add ecx, 2
test dl, dl
jne 0x4106f1
xor eax, eax
jmp 0x410716
sbb eax, eax
or eax, 1
test eax, eax
je 0x4107a6
mov eax, 0x44b7b0
lea ecx, [ebp - 0x41c]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x410750
test dl, dl
je 0x41074c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x410750
add ecx, 2
add eax, 2
test dl, dl
jne 0x410730
xor eax, eax
jmp 0x410755
sbb eax, eax
or eax, 1
test eax, eax
je 0x4107a6
lea eax, [ebp - 0x41c]
push eax
push edi
lea eax, [ebp - 0x108]
push str._s_s_
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x44c]
lea eax, [ebp - 0x208]
push str._s_s_
push eax
call esi
mov ecx, dword [ebp - 0x450]
lea eax, [ebp - 0x208]
add esp, 0x20
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00410620
lea eax, [ebp - 0x448]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410680
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00417ffe
mov esp, ebp
pop ebp
ret 8