joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x6099669c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..rsrc_1
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0xc4909b7
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4082e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x44d1fc], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408329
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x408306
mov dword [edx*4 + 0x44d1f8], eax
inc edx
cmp edx, 0x100
jne 0x4082ff
mov eax, dword [ebp + 8]
not eax
jmp 0x408343
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x44d1f8]
test ebx, ebx
jne 0x408330
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x40a2ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x40a2ef
lcall 0x5de5, 0x8b10c483
jmp loc.00779918
Function at 0x403cf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4529a8
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
xor ecx, ecx
lea edx, [eax + eax*8 - 0x12]
push ecx
push 1
mov dword [esp + 0x20], ecx
mov dword [edi + edx*8], eax
mov edx, dword [esp + 0x3c]
lea eax, [eax + eax*8 - 0x1b]
push ecx
lea esi, [edi + eax*8]
mov eax, dword [esp + 0x30]
mov dword [esi + 0x18], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0x44], ebp
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x44]
lea ebx, [esi + 0x20]
push ecx
mov ecx, ebx
call sym.twinrpg.exe_public:_bool___thiscall_CxImage::CreateImageFromFile_char_const___struct_IDisplay::_SELECT_PARA___unsigned_int__unsigned_long_int__
push 0
mov ecx, ebx
call sym.twinrpg.exe_public:_unsigned_int___thiscall_CxImage::GetWidth_unsigned_int_
xor edx, edx
push 0
div ebp
mov ecx, ebx
mov dword [esi + 0xc], eax
call sym.twinrpg.exe_public:_unsigned_int___thiscall_CxImage::GetHeight_unsigned_int_
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x70c]
inc eax
lea ecx, [esp + 0x38]
mov dword [edi + 0x70c], eax
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x1c
Function at 0x408280
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x452ef0
push eax
mov dword fs:[0], esp
sub esp, 0x10
xor eax, eax
push ebp
push esi
mov esi, ecx
lea ebp, [esi + 0x1c]
mov ecx, ebp
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4083d0
push edi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0
push edx
call fcn.0044cbb7
add esp, 4
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
push 0x466644
push ecx
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::Format
mov eax, dword [esi + 4]
add esp, 0xc
lea ecx, [esp + 0x2c]
mov edx, dword [eax]
push ecx
push 4
push 0x16
push eax
call dword [edx + 0x14]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push 0x466120
push eax
mov byte [esp + 0x30], 3
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
push str..._tmpRelation.txt
call fcn.004328aa
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push ecx
push 0
push str.GameFriend
push edx
call edi
mov ecx, dword [esp + 0x10]
mov dword [ebp], eax
mov eax, dword [esp + 0xc]
push eax
push 0
push str.GameEnemy
push ecx
call edi
mov edx, dword [esp + 0xc]
mov dword [esi + 0x24], eax
push edx
call dword [sym.imp.MSVCRT.dll__unlink]
add esp, 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
mov ecx, dword [esp + 0x18]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x4106f0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4534c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov ebx, dword [esp + 0x64]
mov ebp, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 8
push ebx
call ebp
push sub.MFC42.DLL_CString::CString
push sub.MFC42.DLL_CString::CString_1
push 8
lea eax, [esp + 0x38]
push 4
push eax
call fcn.00432b4a
lea ecx, [esp + 0x10]
mov dword [esp + 0x54], edi
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x54], 1
call sub.MFC42.DLL_CStdioFile::CStdioFile
mov byte [esp + 0x54], 2
xor esi, esi
push esi
push ebx
lea ecx, [esp + 0x18]
push str._sDDP_PlayInfo_d.tga
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x20]
add esp, 0x10
push edx
call ebp
mov eax, dword [esp + 0x10]
push edi
push edi
push eax
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CStdioFile::Open
test eax, eax
je 0x4107a4
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CStdioFile::Close
inc esi
cmp esi, 0x64
jl 0x410766
mov ebp, esi
mov dword [0x48ec14], esi
mov dword [esp + 0x5c], edi
call dword [sym.imp.MSVCRT.dll_rand]
mov dword [esp + 0x14], eax
xor esi, esi
test ebp, ebp
je 0x41083c
mov ecx, dword [esp + 0x14]
lea eax, [ecx + edi]
cdq
idiv ebp
push edx
push ebx
lea edx, [esp + 0x18]
push str._sDDP_PlayInfo_d.tga
push edx
call sub.MFC42.DLL_CString::Format
mov ecx, dword [0x48f138]
mov eax, dword [esp + 0x20]
add esp, 0x10
lea ecx, [esi + ecx + 0x2d44]
push 0
push 0
push 0
push eax
call sym.twinrpg.exe_public:_bool___thiscall_CxImage::CreateImageFromFile_char_const___struct_IDisplay::_SELECT_PARA___unsigned_int__unsigned_long_int__
mov edx, dword [0x48f138]
push 0
lea ecx, [esi + edx + 0x2d44]
call sym.twinrpg.exe_public:_unsigned_int___thiscall_CxImage::GetWidth_unsigned_int_
mov eax, dword [0x48f138]
push 0
lea ecx, [esi + eax + 0x2d44]
call sym.twinrpg.exe_public:_unsigned_int___thiscall_CxImage::GetHeight_unsigned_int_
mov edx, dword [esp + 0x5c]
add esi, 0x24
inc edx
cmp esi, 0x90
mov dword [esp + 0x5c], edx
je 0x41083c
inc edi
cmp edi, 0x64
jl 0x4107bc
cmp edi, 0x64
pop edi
pop esi
pop ebp
pop ebx
je 0x41084c
cmp dword [esp + 0x4c], 4
je 0x410856
mov dword [0x48ec14], 0
lea ecx, [esp + 8]
mov byte [esp + 0x44], 1
call fcn.004328ec
lea ecx, [esp]
mov byte [esp + 0x44], 0
call sub.MFC42.DLL_CString::CString
push sub.MFC42.DLL_CString::CString
push 8
lea ecx, [esp + 0x24]
push 4
push ecx
mov dword [esp + 0x54], 0xffffffff
call fcn.00432bcc
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x4108a0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4534f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
push 0
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov esi, dword [esp + 0x54]
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push sub.MFC42.DLL_CString::CString
push sub.MFC42.DLL_CString::CString_1
push 8
lea eax, [esp + 0x28]
push 4
push eax
call fcn.00432b4a
lea ecx, [esp + 4]
mov dword [esp + 0x44], 0
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 8]
mov byte [esp + 0x44], 1
call sub.MFC42.DLL_CStdioFile::CStdioFile
mov eax, dword [0x48ed24]
mov byte [esp + 0x44], 2
test eax, eax
jne 0x410974
push esi
lea ecx, [esp + 8]
push str._sDDP_Startup.swf
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x10]
add esp, 0xc
lea ecx, [esp + 8]
push 0
push 0
push edx
call sub.MFC42.DLL_CStdioFile::Open
test eax, eax
je 0x410974
lea ecx, [esp + 8]
call sub.MFC42.DLL_CStdioFile::Close
mov eax, dword [esp + 4]
push eax
push 0x466120
push 0x100
push 0x48ec1c
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
mov dword [0x48ed24], 1
lea ecx, [esp + 8]
mov dword [0x48ec18], 0
mov byte [esp + 0x44], 1
call fcn.004328ec
lea ecx, [esp + 4]
mov byte [esp + 0x44], 0
call sub.MFC42.DLL_CString::CString
push sub.MFC42.DLL_CString::CString
push 8
lea ecx, [esp + 0x24]
push 4
push ecx
mov dword [esp + 0x54], 0xffffffff
call fcn.00432bcc
mov ecx, dword [esp + 0x3c]
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x4176c0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x453728
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
test edi, edi
jl 0x4177f7
cmp edi, 4
jge 0x4177f7
call fcn.00417190
test eax, eax
je 0x4177f7
mov ecx, esi
call fcn.00416d40
cmp eax, 1
jne 0x4177f7
push edi
mov ecx, esi
call fcn.004171f0
mov edi, eax
lea ebx, [esi + 4]
push edi
mov ecx, ebx
call fcn.0041a6e0
test eax, eax
je 0x41773d
push edi
mov ecx, ebx
call fcn.0041a6e0
mov ecx, eax
call fcn.00415640
cmp eax, 3
jne 0x4177f7
mov ecx, esi
call fcn.00417180
mov esi, eax
test esi, esi
je 0x4177f7
mov ecx, esi
call fcn.00415640
cmp eax, 3
jne 0x4177f7
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.00431200
test eax, eax
je 0x4177f7
push 0
mov ecx, ebx
call fcn.00431220
mov esi, eax
mov ecx, ebx
push esi
call fcn.004311a0
mov ecx, dword [0x48f130]
push edi
push esi
call fcn.00414d00
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_1
push esi
lea eax, [esp + 0x20]
push str.TWIN_::___nID___d
push eax
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x28]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0x48bb38
call fcn.00416d70
cmp edi, eax
je 0x4177e6
push 1
push esi
push edi
mov ecx, 0x48bb38
call fcn.00416d70
push eax
mov ecx, 0x48bab0
call fcn.004250b0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x41a900
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov edx, ecx
push ebx
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x218]
xor ebx, ebx
xor ecx, ecx
lea eax, [edx + 0xc]
cmp dword [eax + 0x28], ebx
je 0x41a938
cmp edi, dword [eax]
jl 0x41a938
cmp edi, dword [eax + 8]
jge 0x41a938
cmp esi, dword [eax + 4]
jl 0x41a938
cmp esi, dword [eax + 0xc]
jl 0x41a94f
inc ecx
add eax, 0x2c
cmp ecx, 3
jl 0x41a920
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x208
ret 8
mov eax, dword [edx + 0x1a8]
dec eax
cmp eax, 6
ja case.default.0x41a95f
jmp dword [eax*4 + 0x41aad4]
push ebx
push ebx
add edx, 0xa1
push ebx
push edx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret 8
mov edx, dword [edx + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
cmp edx, ebx
mov dword [esp + 0xc], 1
je case.default.0x41a95f
mov eax, dword [edx]
lea ecx, [esp + 0xc]
jmp 0x41aab4
mov edx, dword [edx + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
cmp edx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 4
mov dword [esp + 0x14], 0x7a120
je case.default.0x41a95f
mov eax, dword [edx]
lea ecx, [esp + 0xc]
jmp 0x41aab4
mov edx, dword [edx + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
cmp edx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 4
mov dword [esp + 0x14], 0x493e0
je case.default.0x41a95f
mov eax, dword [edx]
lea ecx, [esp + 0xc]
jmp 0x41aab4
mov edx, dword [edx + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
cmp edx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 4
mov dword [esp + 0x14], 0x18a88
je case.default.0x41a95f
mov eax, dword [edx]
lea ecx, [esp + 0xc]
jmp 0x41aab4
mov edx, dword [edx + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
cmp edx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 4
mov dword [esp + 0x14], 0x31128
je case.default.0x41a95f
mov eax, dword [edx]
lea ecx, [esp + 0xc]
jmp 0x41aab4
mov edx, dword [edx + 8]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
cmp edx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 4
mov dword [esp + 0x14], 0x61a80
je case.default.0x41a95f
mov eax, dword [edx]
lea ecx, [esp + 0xc]
push ecx
push 0x208
push 0x53
push edx
call dword [eax + 0x14]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret 8
Function at 0x421240
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x421250
xor eax, eax
pop esi
ret 0xc
mov eax, dword [esp + 8]
cmp eax, 1
jge 0x42125f
xor eax, eax
pop esi
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x2c]
push eax
push 4
push esi
push 0x421300
push 0
push 0
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x30], edx
mov dword [esi + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x28], eax
test eax, eax
setne cl
test ecx, ecx
mov dword [esi + 0x34], ecx
je 0x4212a5
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0x34]
pop esi
ret 0xc
Function at 0x4225d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x454808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
lea ebp, [ecx + 4]
mov ecx, dword [esp + 0x38]
push edi
push eax
push ecx
mov ecx, ebp
call fcn.00402b80
test eax, eax
je 0x422722
mov ecx, ebp
call fcn.00402bd0
mov ecx, ebp
mov esi, eax
call fcn.00402c00
xor ebx, ebx
mov edi, eax
cmp esi, ebx
jle 0x422722
cmp edi, ebx
jle 0x422722
lea ecx, [esp + 0x1c]
call fcn.004325f8
push ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CDC::Attach
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0x458760
mov eax, esi
push edi
cdq
and edx, 3
mov byte [esp + 0x38], 1
add eax, edx
mov edx, dword [esp + 0x24]
mov esi, eax
sar esi, 2
push esi
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CGdiObject::Attach
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
neg eax
sbb eax, eax
and eax, ecx
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
push edi
push esi
lea ecx, [esi + esi*2]
push 0
push ecx
push 0
lea edx, [esp + 0x30]
push 0
push edx
mov ecx, ebp
mov ebx, eax
call fcn.00402c30
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push 0
push eax
push ecx
call fcn.0044e35f
mov edx, dword [esp + 0x1c]
add esp, 0xc
test ebx, ebx
mov dword [edx + 0x34], eax
je 0x4226d8
mov ebx, dword [ebx + 4]
mov eax, dword [esp + 0x20]
push ebx
push eax
call sub.MFC42.DLL_CDC::SelectGdiObject
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x14], 0x457b64
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0x457b50
mov dword [esp + 0x34], 0xffffffff
call sub.MFC42.DLL_CDC::CDC
mov eax, 1
jmp 0x422724
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x4232b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x618
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.MSVCRT.dll_wcsrchr]
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x423307
lea edx, [esp + 0xc]
push 0x2f
push edx
call edi
add esp, 8
mov esi, eax
mov word [esi], 0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x216]
mov word [esp + 0x214], 0
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x214]
push eax
push str._s..
push 0x103
push ecx
call ebx
add esp, 0x10
push str..config.ini
push 0
push str.Version
push str.Public
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea edx, [esp + 0x214]
mov edi, 0x2710
push edx
xor edx, edx
mov ecx, eax
push 0xffffffffffffffff
div edi
push 0
push 0x804
push 1
push 1
mov eax, ecx
mov edi, 0xf4240
add esi, 2
push edx
xor edx, edx
div edi
mov eax, 0xd1b71759
mul edx
shr edx, 0xd
mov eax, 0x431bde83
push edx
mul ecx
shr edx, 0x12
push edx
lea eax, [esp + 0x30]
push esi
push eax
push esi
push str.QQGame
call fcn.00450560
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x452]
mov word [esp + 0x450], 0
rep stosd dword es:[edi], eax
add esp, 0x34
lea ecx, [esp + 0x214]
lea edx, [esp + 0x41c]
push ecx
push str._sconfigDynamicInfo.ini
push 0x103
push edx
stosw word es:[edi], ax
call ebx
add esp, 0x10
lea eax, [esp + 0x41c]
push eax
push 0x2710
push str.LastQQUin
push 0x4680d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push eax
call fcn.00450bc0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x618
ret
Function at 0x423a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4549a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
mov edi, ecx
push 0x48f23c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
call fcn.0044cbb7
add esp, 4
push str...hcq.dll
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [edi + 0xa94], eax
je 0x423bd6
push str.DllGetClassObject
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x423b35
mov eax, dword [edi + 0xa94]
push eax
jmp 0x423bd0
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 0x45a2c0
push 0x459348
call eax
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x423bc9
test eax, eax
jl 0x423bc9
mov edx, dword [ecx]
lea esi, [edi + 0x430]
push esi
push 0x459328
push 0
push ecx
call dword [edx + 0xc]
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi]
test eax, eax
je 0x423bb4
test ebp, ebp
jl 0x423bb4
mov edx, dword [eax]
push 0x10
push eax
call dword [edx + 0xc]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [edi + 0xa94]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], 0
jmp 0x423bd6
mov ecx, dword [edi + 0xa94]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x423fd0
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x454a28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push 0x48f23c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
call fcn.0044cbb7
add esp, 4
push str...GameListMenu1.dll
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esi + 0x410], eax
je 0x424167
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateRMenuObject
push eax
call edi
mov dword [esi + 0x414], eax
mov eax, dword [esi + 0x410]
push str.ReleaseRMenuWnd
push eax
call edi
mov ecx, dword [esi + 0x410]
push str.AddNewMenu
push ecx
mov dword [esi + 0x418], eax
call edi
mov edx, dword [esi + 0x410]
push str.CreateRMenu
push edx
mov dword [esi + 0x41c], eax
call edi
mov dword [esi + 0x420], eax
mov eax, dword [esi + 0x410]
push str.SetLpIGameSite
push eax
call edi
mov ecx, dword [esi + 0x410]
push str.MenuOnOtherMsg
push ecx
mov dword [esi + 0x424], eax
call edi
mov dword [esi + 0x428], eax
mov eax, dword [esi + 0x414]
cmp eax, ebx
pop edi
je 0x424130
cmp dword [esi + 0x418], ebx
je 0x424130
cmp dword [esi + 0x41c], ebx
je 0x424130
cmp dword [esi + 0x420], ebx
je 0x424130
cmp dword [esi + 0x424], ebx
je 0x424130
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov edx, dword [esi + 0x410]
mov dword [esi + 0x414], ebx
push edx
mov dword [esi + 0x418], ebx
mov dword [esi + 0x41c], ebx
mov dword [esi + 0x420], ebx
mov dword [esi + 0x424], ebx
mov dword [esi + 0x428], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x410], ebx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret