joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d117d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x64dff0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0x10
call fcn.0045dbeb
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x438976
push ecx
mov esi, esp
xorps xmm0, xmm0
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x14]
movups xmmword [edi], xmm0
mov eax, dword [eax + 0x14]
sub eax, 0x10
push eax
call fcn.00403f00
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov ecx, edi
mov esi, dword [ebp - 0x14]
push esi
call fcn.00438cc0
jmp 0x438978
xor eax, eax
lea edi, [esi + 0x38]
mov dword [ebp - 0x14], eax
lea eax, [edi + 8]
mov dword [ebp - 0x20], vtable.CAutoCriticalSection.0
push eax
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
mov eax, dword [esi + 4]
push ecx
mov dword [ebp - 0x18], eax
push dword [eax + 4]
push eax
call fcn.00438b70
mov ecx, 0x15555554
mov edx, eax
sub ecx, dword [esi + 8]
cmp ecx, 1
jae 0x4389c5
push str.list_T__too_long
call fcn.005a480c
inc dword [esi + 8]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push esi
push 0
push esi
mov dword [eax + 4], edx
mov eax, dword [edx + 4]
push 0x438f50
push 0
push 0
mov dword [eax], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 4], eax
setne byte [ebp - 0xd]
mov dword [ebp - 4], 2
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 0x14]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x438d70
Capabilities:
Connect pipe
Create pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1211
mov eax, dword fs:[0]
push eax
sub esp, 0xa60
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xa60], ebx
push 1
lea eax, [ebp - 0xa50]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0xa50]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0xa50]
mov dword [ebp - 0xa5c], 0xc
mov dword [ebp - 0xa58], eax
lea eax, [ebp - 0xa5c]
push eax
push 0x64
push 0
push 0
push 0xff
push 0
push 1
push dword [ebx + 8]
mov dword [ebp - 0xa54], 1
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
push 0
push esi
mov dword [ebp - 0xa64], esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x438e24
or eax, 0xffffffff
jmp 0x438f20
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x438e30
call fcn.00438900
push 0xa28
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa3c], 0
push 0
push eax
call fcn.005a7a20
add esp, 0xc
lea eax, [ebp - 0xa3c]
push 0
push eax
push 0xa27
lea eax, [ebp - 0xa38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438f1e
mov esi, dword [ebp - 0xa3c]
cmp esi, 0xa28
jae 0x438f3c
mov edi, dword [ebx + 0xc]
mov byte [ebp + esi - 0xa38], 0
test edi, edi
je 0x438ef5
lea ebx, [edi + 0x18]
mov dword [ebp - method.CAutoCriticalSection.virtual_0], vtable.CAutoCriticalSection.0
lea eax, [ebx + 8]
mov dword [ebp - 0xa68], ebx
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x438ed0
push esi
lea ecx, [ebp - 0xa38]
push ecx
push dword [edi + 0x10]
call eax
add esp, 0xc
mov dword [ebp - 4], 1
mov ecx, ebx
mov eax, dword [ebx]
mov dword [ebp - method.CAutoCriticalSection.virtual_0], vtable.CAutoCriticalSection.0
call dword [eax + 0x14]
mov ebx, dword [ebp - 0xa60]
mov dword [ebp - 4], 0xffffffff
push 0
lea eax, [ebp - 0xa3c]
push eax
push 0xa27
lea eax, [ebp - 0xa38]
push eax
push dword [ebp - 0xa64]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x438e74
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
call fcn.005a3b43
int3
Function at 0x438ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0xffffffff
jne 0x43901e
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push esi
push 0xa28
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.005a7a20
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0xa2c]
push 0xa28
push 0xa28
push eax
call fcn.00402790
push dword [eax + 4]
push dword [eax]
call fcn.005ad0a1
mov esi, eax
add esp, 0x20
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
test esi, esi
jne 0x439081
pop esi
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0xa30]
mov dword [ebp - 0xa30], 0
push eax
push esi
lea eax, [ebp - 0xa2c]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4390c6
cmp dword [ebp - 0xa30], esi
jne 0x4390c6
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop edi
call fcn.005a3521
mov esp, ebp
pop ebp
ret
Function at 0x43a7e0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1368
mov eax, dword fs:[0]
push eax
sub esp, 0x66c
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, cl
mov byte [ebp - 0x672], bl
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43a9a6
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.005a7a20
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x420]
push 0x620de0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43a88e
test bl, bl
jmp 0x43a98a
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005a7a20
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005a7a20
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp - 0x644]
push ecx
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x218]
push 0x620df0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 0x670]
add esp, 0x1c
test al, 1
je 0x43a90d
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp - 0x670]
test al, 0x10
je 0x43a95d
push 0x61c768
lea eax, [ebp - 0x644]
push eax
call esi
test eax, eax
je 0x43a966
push 0x620dfc
lea eax, [ebp - 0x644]
push eax
call esi
test eax, eax
je 0x43a966
sub esp, 0x18
mov byte [ebp - 0x671], 1
lea eax, [ebp - 0x218]
mov ecx, esp
push eax
call fcn.00402300
mov cl, byte [ebp - 0x671]
call fcn.0043a7e0
add esp, 0x18
jmp 0x43a966
lea eax, [ebp - 0x218]
push eax
call ebx
lea eax, [ebp - 0x670]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43a8b0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp - 0x672], 0
je 0x43a9a6
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x43a9a6
xor bl, bl
jmp 0x43a9a8
mov bl, 1
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x43a9bd
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00402e30
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
Function at 0x43ad70
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x64dff0]
xor eax, esp
mov dword [esp + 0x44], eax
lea eax, [esp]
mov dword [esp], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 8]
xor ecx, esp
mov edx, dword [esp + 0xc]
call fcn.005a3521
mov esp, ebp
pop ebp
ret
Function at 0x43c880
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d17a3
mov eax, dword fs:[0]
push eax
mov eax, 0x42254
call fcn.005a3e00
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x42040
lea eax, [ebp - 0x42258]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x42260], 0
call fcn.005a7a20
add esp, 0xc
lea eax, [ebp - 0x42260]
push eax
push 0x42040
lea eax, [ebp - 0x42258]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
or esi, 0xffffffff
test eax, eax
je 0x43c98d
cmp dword [ebp - 0x42260], 0
je 0x43c98d
lea ecx, [ebp + 8]
call fcn.0040d1f0
mov eax, dword [ebp - 0x42260]
xor edi, edi
shr eax, 2
mov dword [ebp - 0x42260], eax
test eax, eax
je 0x43c98d
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax]
mov eax, dword [ebp + edi*4 - 0x42258]
test eax, eax
je 0x43c984
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x43c981
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005a7a20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x43c9ca
push esi
call ebx
or esi, 0xffffffff
inc edi
cmp edi, dword [ebp - 0x42260]
jb 0x43c930
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x43c9ac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x4225c], 0
push eax
lea ecx, [ebp - 0x4225c]
call fcn.00406cf0
lea ecx, [ebp - 0x4225c]
mov byte [ebp - 4], 1
call fcn.0040d1f0
push eax
lea ecx, [ebp - 0x4225c]
call fcn.00403f70
lea eax, [ebp - 0x4225c]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0041ed90
add esp, 8
test al, al
je 0x43ca21
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x4225c]
push dword [eax - 8]
push eax
call fcn.005ae443
mov edx, eax
add esp, 8
test edx, edx
js 0x43ca83
mov ecx, dword [ebp - 0x4225c]
cmp edx, dword [ecx - 8]
jg 0x43ca83
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x4225c]
push esi
mov word [eax + edx*2], cx
call ebx
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x4225c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43c984
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x43c984
push 0x80070057
call fcn.00402d80
int3
Function at 0x43ca90
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d17d8
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
push str.CPlayerManager::_downloadImage
push str.__s__:_url__s_
call fcn.00404190
push eax
call fcn.00425940
add esp, 0x10
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005a7a20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0
push 0x104
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToCacheFileW]
mov ecx, esi
test eax, eax
jne 0x43cb5c
lea eax, [ebp - 0x218]
push eax
call fcn.00406cf0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edi, dword [ebp + 0xc]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x43cb88
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x43cb88
push 0x61b534
call fcn.00406cf0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43cb88
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 8
Function at 0x43fa20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1db8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x61b534
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.00406cf0
push dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push 0x621314
push dword [esi + 0x2c]
push str._sclone__s_d_conf.ini.lock
push eax
call fcn.004057a0
add esp, 0x14
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43faad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 4
Function at 0x4403d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ecx + 0x30]
push eax
lea eax, [ecx + 0x2c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041ad30
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 4]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x44040e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
pop esi
setne al
mov esp, ebp
pop ebp
ret
Function at 0x440dc0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x42048
call fcn.005a3e00
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x42040
lea eax, [ebp - 0x42044]
mov dword [ebp - 0x42048], 0
push 0
push eax
call fcn.005a7a20
add esp, 0xc
lea eax, [ebp - 0x42048]
push eax
push 0x42040
lea eax, [ebp - 0x42044]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x440e6a
mov edx, dword [ebp - 0x42048]
test edx, edx
je 0x440e6a
shr edx, 2
xor eax, eax
push esi
test edx, edx
je 0x440e44
mov esi, dword [ebp + 8]
nop dword [eax + eax]
mov ecx, dword [ebp + eax*4 - 0x42044]
test ecx, ecx
je 0x440e3f
cmp esi, ecx
je 0x440e57
inc eax
cmp eax, edx
jb 0x440e30
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 4
Function at 0x441100
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1ffd
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x42c], 0
call fcn.005a7a20
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x208
push 0
push eax
call fcn.005a7a20
add esp, 0xc
call fcn.0045fe71
mov ecx, eax
test ecx, ecx
jne 0x441184
push 0x80004005
call fcn.00402d80
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
push dword [ebp + 8]
lea eax, [ebp - 0x424]
mov dword [ebp - 4], 0
push 0x621888
push eax
call fcn.004057a0
add esp, 0xc
lea eax, [ebp - 0x434]
add edi, 0x2c
push str..position
push edi
push eax
call fcn.0040d830
add esp, 0xc
mov byte [ebp - 4], 1
mov ebx, 1
push dword [eax]
mov esi, dword [ebp - 0x424]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x61b534
push 0x6218a4
push esi
mov dword [ebp - 0x42c], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x441244
push str..position
lea eax, [ebp - 0x430]
push edi
push eax
call fcn.0040d830
add esp, 0xc
mov ebx, 3
push dword [eax]
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0x61b534
push 0x6218a8
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov byte [ebp - 0x425], 0
test eax, eax
jne 0x44124b
mov byte [ebp - 0x425], 1
or edi, 0xffffffff
test bl, 2
je 0x441279
mov edx, dword [ebp - 0x430]
and ebx, 0xfffffffd
mov dword [ebp - 0x42c], ebx
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x441279
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x434]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44129d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x425], 0
je 0x4412aa
xor bl, bl
jmp 0x4412d5
lea eax, [ebp - 0x218]
push eax
call fcn.005ae2c8
mov ebx, dword [ebp - 0x438]
add esp, 4
mov dword [ebx], eax
lea eax, [ebp - 0x420]
push eax
call fcn.005ae2c8
mov dword [ebx + 4], eax
add esp, 4
mov bl, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x4412f1
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 8
Function at 0x441320
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd3f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
push dword [ebp + 8]
push str.CPlayerManager::GetPlayerHWND
push str.__s__:_name__s_
call fcn.00404190
push eax
call fcn.00425940
add esp, 0xc
mov esi, esp
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00403f00
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.0043d140
mov ecx, dword [edi + 0x54]
mov edx, eax
test ecx, ecx
je 0x4413ad
mov eax, ecx
test ecx, ecx
je 0x441433
mov eax, dword [eax + 8]
mov ecx, dword [ecx]
cmp dword [eax + 0x1c], edx
je 0x4413f0
test ecx, ecx
jne 0x441395
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4413d1
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 4
mov eax, dword [eax + 0x14]
cmp eax, 0xffffff9c
je 0x4413ad
push eax
mov ecx, edi
call fcn.0043d250
test eax, eax
je 0x4413ad
mov eax, dword [eax + 4]
test eax, eax
je 0x4413ad
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], 0
push 0x43adb0
mov dword [ebp - 0x14], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x14]
jmp 0x4413af
call fcn.0045e5d5
int3
Function at 0x445280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2688
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x64dff0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
call fcn.00404190
mov bl, byte [ebp + 0xc]
movzx ecx, bl
push ecx
push dword [ebp + 8]
push str.CPlayerManager::ReceiveRunPlayer
push str.__s__:_name__s___bool__d_
push eax
call fcn.00425940
mov eax, dword [ebp + 8]
add esp, 0x14
add eax, 0xfffffff0
push ecx
mov esi, esp
push eax
mov dword [ebp - 0x14], esi
call fcn.00403f00
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.0043d140
mov ecx, dword [edi + 0x54]
mov edx, eax
nop
test ecx, ecx
je 0x445368
mov esi, dword [ecx + 8]
mov ecx, dword [ecx]
cmp dword [esi + 0x1c], edx
jne 0x445300
lea eax, [esi + 0x78]
mov dword [esi + 8], 0
test eax, eax
je 0x44531f
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test bl, bl
je 0x44540c
lea ebx, [esi + 0xc]
lea eax, [edi + 0xc]
push ebx
push eax
call fcn.0041acd0
add esp, 8
test al, al
je 0x4453b5
call fcn.00404190
push dword [ebx]
push dword [edi + 0xc]
push dword [ebp + 8]
push str.CPlayerManager::ReceiveRunPlayer
push str.__s__:_user_not_matching___name__s___user__s___playeruser__s_
push eax
call fcn.00425940
add esp, 0x18
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x14], esi
call fcn.00403f00
add esp, 4
lea ecx, [edi + 0x14]
add eax, 0x10
mov dword [esi], eax
call fcn.00434a10
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44548c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x44548c
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x4453c1
call fcn.0044eb40
push esi
mov ecx, edi
mov dword [esi + 0x18], 2
call fcn.0043e1c0
push esi
mov ecx, edi
call fcn.0043e740
push esi
mov ecx, edi
call fcn.0043eaf0
lea eax, [ebp + 8]
lea ecx, [edi + 0x9c]
push eax
call fcn.00403f70
push 0
push 0
push edi
push 0x43b240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44541a
mov ecx, esi
mov dword [esi + 0x18], 0
call fcn.00439920
push 0
push 0
push dword [edi + 0x48]
push dword [edi + 0x44]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44544c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8