joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58c3bb
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
mov esp, 0xf113c1da
jecxz 0x58c3ba
mov word [edx], ss
jge 0x58c3eb
cmp dword [edx], ebp
rol dword [ebx - 0x78], cl
outsd dx, dword [esi]
sbb eax, 0xa16af326
lahf
add bl, bh
push ds
adc bl, byte [edi - 0x6d774baf]
out 0x64, eax
invalid
mov dword [0x85e0f380], eax
rcl byte [edx - 0x72d24295], 0xce
sahf
push es
jo 0x58c44e
inc eax
mov cl, 0xad
jecxz 0x58c3ab
adc bh, 0xad
int3
pop ebp
ja 0x58c3a1
wait
mov edx, dword [ebx + ebx*4 + 0x5d326328]
jl 0x58c47e
out dx, al
mov byte [0x3353b048], al
jl fcn.0058c40b
adc esi, dword [edx - 0x67]
out 0x9c, al
std
add byte [edi], 0xb7
mov bl, 0x69
mov dword [0xf79cb256], eax
adc ecx, esp
insd dword es:[edi], dx
mov esp, 0x7452b823
push edx
and dl, byte [ebx]
mov bl, 0xb9
clc
int3
aad 0xdd
int1
jp 0x58c473
xor esp, dword [edx]
inc ecx
xchg ebp, eax
push es
div byte [edi]
popfd
xlatb
pop ebp
add eax, 0x3ed95354
mov al, byte [0x82f8f22c]
xchg edx, eax
stc
pop edi
jge 0x58c432
clc
adc byte [edx - 0x3982a007], 0xdb
inc edx
lodsb al, byte [esi]
fild dword [edx - 0x54]
and eax, dword [ecx + 0x73]
sub eax, 0xd4c31f45
aad 0x7f
add dh, bh
arpl word [ecx - 0x42d022ed], dx
test byte [ebx], 0x25
and esi, 0xbfcde5a7
out 0x12, eax
cmc
inc ebp
pop ds
ret
invalid
mov dword [0xb1296a8d], eax
fld qword [edi + 0x2c]
mov ebp, 0xd4712b40
lodsd eax, dword [esi]
pop ss
mov dl, 0x22
mov dword [ebx + 0x11c22bec], edx
fisttp word [edi - 0x4d12b05e]
sbb ecx, dword [esp + ecx - 0x3076c2a2]
jle 0x58c4bc
arpl word [eax + 0x72f80d77], sp
dec ebx
aas
les ecx, [ebp + 0x4dd1cde3]
jle 0x58c507
invalid
jae 0x58c532
fstp xword [ebp - 0x6d]
fld dword [ebx]
in eax, dx
inc esi
fadd qword [edi + 0x61ed6345]
and dword [eax], esi
jns 0x58c465
mov byte [ebp - 0x2c9ea87b], 0xb8
sbb eax, dword [eax + 0x234fbfbc]
cmp bl, ch
fcomp dword [ebp - 0x5ce31d3c]
pop esi
fisub dword [ebx - 0x31]
jecxz 0x58c4e1
imul ecx, dword [eax + 0x2f3c563f], 0xb229d5c
and al, 0xd3
pop ss
wait
jb 0x58c48d
movsd dword es:[edi], dword [esi]
out dx, al
invalid
pop ebx
retf
wait
popal
fstp qword [ebx - 0x24]
inc esi
sub ah, bl
dec ebx
Function at 0x658efc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x663480
cmp edx, dword [eax]
je 0x658f1e
add eax, 8
inc ecx
cmp eax, 0x663510
jl 0x658f0f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x663480]
jne 0x65904c
mov eax, dword [0xa66cf0]
cmp eax, 1
je 0x659026
test eax, eax
jne 0x658f4f
cmp dword [0x6612c4], 1
je 0x659026
cmp edx, 0xfc
je 0x65904c
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x658f86
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a060
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a150
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x658fc9
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a150
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65dc84
push edi
call fcn.0065ab10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a060
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a070
lea eax, [ebp - 0xa0]
push 0x65dc64
push eax
call fcn.0065a070
push dword [esi + 0x663484]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a070
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065aa82
add esp, 0x2c
pop edi
jmp 0x65904c
lea eax, [ebp + 8]
lea esi, [esi + 0x663484]
push 0
push eax
push dword [esi]
call fcn.0065a150
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x49271c
Capabilities:
Set socket configuration

Disassembly:
jmp 0x4d3919
jmp fcn.004d3930
sub ecx, dword [ecx - 4]
jmp 0x493c39

Function at 0x49287f
Capabilities:
Set socket configuration

Disassembly:
jmp 0x4d3ce9
jmp fcn.004d3d00
sub ecx, dword [ecx - 4]
jmp 0x495d81

Function at 0x492bef
Capabilities:
Set socket configuration

Disassembly:
jmp 0x4d3a49
jmp fcn.004d3a60
sub ecx, dword [ecx - 4]
jmp 0x49693e

Function at 0x492c53
Capabilities:
Set socket configuration

Disassembly:
jmp 0x4d3e19
jmp fcn.004d3e30
sub ecx, dword [ecx - 4]
jmp 0x495cd7

Function at 0x492c9e
Capabilities:
Set socket configuration

Disassembly:
jmp 0x4d37a9
jmp fcn.004d37c0
sub ecx, dword [ecx - 4]
jmp 0x49810d

Function at 0x494440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x59c930
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x611d7c], 1
jge 0x59c99f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x59c975
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x59c975
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x59c952
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x59c98b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x59c992
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x59ca9d
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movdqa xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movdqa xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movdqa xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x59ca6e
mov eax, dword [ebx + 8]
movdqu xmm0, xmmword [eax]
movdqa xmmword [ebp - 0x40], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movdqa xmmword [ebp - 0x20], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movdqa xmmword [ebp - 0x20], xmm0
movdqa xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movdqa xmmword [ebp - 0x40], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movdqa xmmword [ebp - 0x20], xmm0
movdqa xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x59ca63
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x59ca57
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x59ca5e
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x59ca9d
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x59ca98
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x59ca81
mov eax, dword [ebx + 8]
jmp 0x59ca9d
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x59ca8f
xor eax, eax
jmp 0x59ca9d
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x59c9c2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x496204
Capabilities:
Set socket configuration

Disassembly:
jmp fcn.004d3ba0
jmp 0x4d3b89
sub ecx, dword [ecx - 4]
jmp 0x49609c

Function at 0x49655b
Capabilities:
Print debug messages
Write file on windows

Disassembly:
jmp fcn.004bd4f0
jmp 0x4bd4e6
sub ecx, dword [ecx - 4]
jmp 0x493022

Function at 0x496c9f
Capabilities:
Print debug messages
Read file on windows

Disassembly:
jmp fcn.004bd000
jmp 0x4bcff4
sub ecx, dword [ecx - 4]
jmp 0x49580e

Function at 0x4ce840
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18fc
call fcn.00496a88
push ebx
push esi
push edi
lea edi, [ebp - 0x18fc]
mov ecx, 0x63f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x60ab20]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push 0x3f6
mov eax, dword [0x60e668]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp esi, esp
call fcn.0049561a
mov dword [ebp - 0xc], eax
xor eax, eax
mov word [ebp - 0x818], ax
push 0x800
push 0
lea eax, [ebp - 0x816]
push eax
call fcn.00493f9f
add esp, 0xc
mov esi, esp
push 0x400
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.0049561a
mov esi, esp
push 0
push 0
push 0x14b
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.0049561a
mov byte [ebp - 0x1820], 0
push 0xfff
push 0
lea eax, [ebp - 0x181f]
push eax
call fcn.00493f9f
add esp, 0xc
lea ecx, [ebp - 0x182c]
call fcn.0049325c
push 0
push 0x1000
lea eax, [ebp - 0x1820]
push eax
lea ecx, [ebp - 0x182c]
call fcn.004945c1
test eax, eax
je 0x4ce9a4
lea eax, [ebp - 0x1820]
mov dword [ebp - 0x1838], eax
mov eax, dword [ebp - 0x1838]
push eax
call fcn.004943d2
add esp, 4
test eax, eax
je 0x4ce9a4
mov esi, esp
mov eax, dword [ebp - 0x1838]
push eax
mov edi, esp
push 0
push 0
push 0x146
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp edi, esp
call fcn.0049561a
push eax
push 0x14a
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, esp
call fcn.0049561a
mov eax, dword [ebp - 0x1838]
push eax
call fcn.004943d2
add esp, 4
mov ecx, dword [ebp - 0x1838]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x1838], edx
jmp 0x4ce934
mov esi, esp
lea eax, [ebp - 0x818]
push eax
push 0
push 0x14d
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.0049561a
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp esi, esp
call fcn.0049561a
test eax, eax
jne 0x4cea18
mov esi, esp
push 0
push 0
push 0x146
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.0049561a
test eax, eax
jle 0x4cea18
mov esi, esp
push 0
push 0
push 0x14e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.0049561a
push edx
mov ecx, ebp
push eax
lea edx, [0x4cea48]
call fcn.00496c54
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497f46
add esp, 0x18fc
cmp ebp, esp
call fcn.0049561a
mov esp, ebp
pop ebp
ret
Function at 0x4cecb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18fc
call fcn.00496a88
push ebx
push esi
push edi
lea edi, [ebp - 0x18fc]
mov ecx, 0x63f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x60ab20]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push 0x3f5
mov eax, dword [0x60e668]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp esi, esp
call fcn.0049561a
mov dword [ebp - 0xc], eax
xor eax, eax
mov word [ebp - 0x818], ax
push 0x800
push 0
lea eax, [ebp - 0x816]
push eax
call fcn.00493f9f
add esp, 0xc
mov esi, esp
push 0x400
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.0049561a
mov esi, esp
push 0
push 0
push 0x14b
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.0049561a
mov byte [ebp - 0x1820], 0
push 0xfff
push 0
lea eax, [ebp - 0x181f]
push eax
call fcn.00493f9f
add esp, 0xc
lea ecx, [ebp - 0x182c]
call fcn.00497587
push 0
push 0x1000
lea eax, [ebp - 0x1820]
push eax
lea ecx, [ebp - 0x182c]
call fcn.00495c00
test eax, eax
je 0x4cee14
lea eax, [ebp - 0x1820]
mov dword [ebp - 0x1838], eax
mov eax, dword [ebp - 0x1838]
push eax
call fcn.004943d2
add esp, 4
test eax, eax
je 0x4cee14
mov esi, esp
mov eax, dword [ebp - 0x1838]
push eax
mov edi, esp
push 0
push 0
push 0x146
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp edi, esp
call fcn.0049561a
push eax
push 0x14a
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp esi, esp
call fcn.0049561a
mov eax, dword [ebp - 0x1838]
push eax
call fcn.004943d2
add esp, 4
mov ecx, dword [ebp - 0x1838]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x1838], edx
jmp 0x4ceda4
mov esi, esp
lea eax, [ebp - 0x818]
push eax
push 0
push 0x14d
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.0049561a
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp esi, esp
call fcn.0049561a
test eax, eax
jne 0x4cee88
mov esi, esp
push 0
push 0
push 0x146
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.0049561a
test eax, eax
jle 0x4cee88
mov esi, esp
push 0
push 0
push 0x14e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, esp
call fcn.0049561a
push edx
mov ecx, ebp
push eax
lea edx, [0x4ceeb8]
call fcn.00496c54
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497f46
add esp, 0x18fc
cmp ebp, esp
call fcn.0049561a
mov esp, ebp
pop ebp
ret
Function at 0x4d03b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push ebx
push esi
push edi
lea edi, [ebp - 0x4d0]
mov ecx, 0x134
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x60ab20]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x40c], 0
push 0x400
push 0
lea eax, [ebp - 0x40b]
push eax
call fcn.00493f9f
add esp, 0xc
mov esi, esp
push 0x400
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp esi, esp
call fcn.0049561a
lea eax, [ebp - 0x40c]
push eax
call fcn.00496281
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x4d0454]
call fcn.00496c54
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497f46
add esp, 0x4d0
cmp ebp, esp
call fcn.0049561a
mov esp, ebp
pop ebp
ret

Function at 0x4d04a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8dc
push ebx
push esi
push edi
lea edi, [ebp - 0x8dc]
mov ecx, 0x237
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x60ab20]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x8d8], 0
xor eax, eax
mov word [ebp - 0x80c], ax
push 0x800
push 0
lea eax, [ebp - 0x80a]
push eax
call fcn.00493f9f
add esp, 0xc
mov esi, esp
push 0x400
lea eax, [ebp - 0x80c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.0049561a
lea eax, [ebp - 0x80c]
push eax
mov ecx, dword [ebp + 8]
call fcn.0049818f
mov ecx, dword [ebp - 0x8d8]
or ecx, 1
mov dword [ebp - 0x8d8], ecx
mov eax, dword [ebp + 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x4d0560]
call fcn.00496c54
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497f46
add esp, 0x8dc
cmp ebp, esp
call fcn.0049561a
mov esp, ebp
pop ebp
ret
Function at 0x40c360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449eaf
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x158], ecx
mov ecx, dword [ebp - 0x158]
add ecx, 0x14
call fcn.00403dc0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x158]
add ecx, 0x3c
call fcn.00403dc0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x158]
add ecx, 0x58
call fcn.00403dc0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x158]
add ecx, 0x78
call fcn.0040e840
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x158]
add ecx, 0x114
call fcn.00401040
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x158]
add ecx, 0x160
call fcn.0040e960
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x158]
add ecx, 0x19c
call fcn.00403dc0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x158]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x158]
mov dword [ecx], 0
mov edx, dword [ebp - 0x158]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x158]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x158]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x158]
mov dword [edx + 0x1b8], 0
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x38], ecx
push 0x100
lea edx, [ebp - 0x114]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x130]
call fcn.004018c0
mov byte [ebp - 4], 7
lea edx, [ebp - 0x130]
lea ecx, [ebp - 0x14c]
call fcn.00404870
mov dword [ebp - 0x15c], eax
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x160], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x160]
push eax
mov ecx, dword [ebp - 0x158]
add ecx, 0x58
call fcn.00405740
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14c]
call fcn.00401940
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x130]
call fcn.00401940
mov ecx, dword [ebp - 0x158]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp - 0x158]
mov dword [edx + 0x34], 0
mov eax, dword [ebp - 0x158]
mov dword [eax + 0x74], 0
push 0x18
call fcn.00433d86
add esp, 4
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 9
cmp dword [ebp - 0x154], 0
je 0x40c554
mov ecx, dword [ebp - 0x154]
call fcn.00416af0
mov dword [ebp - 0x164], eax
jmp 0x40c55e
mov dword [ebp - 0x164], 0
mov ecx, dword [ebp - 0x164]
mov dword [ebp - 0x150], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x150]
mov dword [0x45f1e4], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x158]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret 4
Function at 0x412470
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a7d7
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x160], ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00403dc0
mov byte [ebp - 4], 2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
lea eax, [ebp + 8]
push eax
call fcn.00401900
mov dword [ebp - 0x164], eax
lea ecx, [ebp - 0x154]
push ecx
call fcn.0041a0d0
add esp, 0x20
mov dword [ebp - 0x168], eax
mov edx, dword [ebp - 0x168]
mov dword [ebp - 0x16c], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405740
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x154]
call fcn.00401940
lea ecx, [ebp - 0x2c]
call fcn.004087f0
movzx ecx, al
test ecx, ecx
je 0x41257b
lea ecx, [ebp - 0x2c]
call fcn.00401960
push eax
lea ecx, [ebp + 8]
call fcn.00401960
push eax
push str.CGameItem_::_ParseVersionIni__s____s._ERROR___n
call fcn.00401010
add esp, 0xc
mov dword [ebp - 0x158], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00401940
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401940
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00401940
mov eax, dword [ebp - 0x158]
jmp 0x412687
lea ecx, [ebp - 0x2c]
call fcn.00401960
push eax
lea ecx, [ebp + 8]
call fcn.00401960
push eax
push str.CGameItem_::_ParseVersionIni__s____s_n
call fcn.00401010
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.00401960
push eax
mov ecx, dword [ebp - 0x160]
add ecx, 0x560
call fcn.0040acc0
lea ecx, [ebp - 0x2c]
call fcn.00401960
push eax
lea edx, [ebp - 0x134]
push edx
call fcn.00435ff0
add esp, 8
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x160]
add ecx, 0x74
call fcn.0041f450
lea ecx, [ebp - 0x2c]
call fcn.00401960
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x160]
add ecx, 0x524
call fcn.004087f0
movzx edx, al
test edx, edx
jne 0x412632
mov eax, dword [ebp - 0x160]
add eax, 0x524
push eax
mov ecx, dword [ebp - 0x160]
add ecx, 0x560
call fcn.00405740
mov ecx, dword [ebp - 0x160]
add ecx, 0xd8
push ecx
mov ecx, dword [ebp - 0x160]
add ecx, 0x598
call fcn.00405740
mov dword [ebp - 0x15c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00401940
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401940
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00401940
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret 0x38
Function at 0x412e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44a91a
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x45d520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x444], ecx
mov dword [ebp - 0x440], 0
lea ecx, [ebp - 0x434]
call fcn.00403dc0
mov dword [ebp - 4], 1
mov dword [ebp - 0x43c], 0x400
mov dword [ebp - 0x418], 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x418]
push edx
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00401960
push eax
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jne 0x412ec4
lea edx, [ebp - 0x414]
push edx
lea ecx, [ebp - 0x434]
call fcn.0040acc0
jmp 0x412ed3
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x434]
call fcn.00405740
lea ecx, [ebp - 0x434]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401900
mov edx, dword [ebp - 0x440]
or edx, 1
mov dword [ebp - 0x440], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x434]
call fcn.00401940
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00433b5e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x412f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov ecx, dword [ebp + 8]
call fcn.00401960
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x412f6b
mov eax, dword [ebp - 4]
jmp 0x412f6e
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x413ee0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44acc8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x45d520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 0x100
push 0
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
call fcn.004340c0
add esp, 0xc
push 0x100
lea ecx, [ebp + 0xc]
call fcn.00401960
push eax
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call fcn.00437580
add esp, 0xc
push str.PMangLauncherProcess
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x104], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x413f7c
push str.Mutex
call fcn.00401010
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401940
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x20