joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459de0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x490
cmp byte [0x6a4010], 0
je 0x459e0c
push 0x6a4010
call fcn.00441510
add esp, 4
test al, al
jne 0x459f1d
call fcn.00459da0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
je 0x459e2a
mov dword [0x6ea840], 0x1a
xor al, al
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x490]
push 0x400
push ecx
call fcn.00451e50
add esp, 8
test al, al
jne 0x459e63
push str.___Unable_to_find_Temp_directory____r
push 5
push 0
call fcn.004adea0
add esp, 0xc
mov dword [0x6ea840], 0x1b
xor al, al
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x90]
push eax
call fcn.0045cc90
add esp, 8
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
jne 0x459e9e
mov dword [0x6ea840], 0x1c
xor al, al
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x459ed1
push str.___Anti_Virus_or_Firewall_software_is_blocking_interfering_with_GameRanger____r
push 5
push eax
call fcn.004adea0
add esp, 0xc
mov dword [0x6ea840], 0x1d
xor al, al
mov esp, ebp
pop ebp
ret
push 0
push 0x2000000
push 3
push 0
push 1
push closesocket
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x6a4008], eax
xor eax, eax
jmp 0x459f00
mov cl, byte [ebp + eax - 0x490]
mov byte [eax + 0x6a4010], cl
inc eax
test cl, cl
jne 0x459f00
push 0x6a4010
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x459f80
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dfd98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
call fcn.004391e0
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push esi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x459fe9
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call sym.GameRanger.exe_public_virtual:_void___thiscall_CFile_MFC_Clash::destructor_void_
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push str.___CopyDLLFile::CopyFile_failed:__d____r
push 5
push edi
call fcn.004adea0
push 0x6a4010
push str.___Dir:__s____r
push 5
push edi
call fcn.004adea0
push esi
call fcn.004526a0
add esp, 0x24
lea ecx, [ebp - 0x430]
push ecx
push edi
push 0x607bd4
push 0x6a4010
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x45a06b
call ebx
push eax
push str.___CopyDLLFile::GetTempFileName_failed:__d____r
push 5
push edi
call fcn.004adea0
add esp, 0x10
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call sym.GameRanger.exe_public_virtual:_void___thiscall_CFile_MFC_Clash::destructor_void_
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x430]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x45a086
call ebx
push eax
push str.___CopyDLLFile::PathFileExists_failed:__d____r
jmp 0x45a03e
mov eax, dword [ebp + 8]
push 0x5f6670
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.004394f0
mov edi, dword [ebp - 0x2c]
push edi
call fcn.00401148
add esp, 4
mov esi, eax
push edi
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], esi
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Read_data_void___unsigned_int_
lea ecx, [ebp - 0x30]
call fcn.00439210
lea ecx, [ebp - 0x430]
push ecx
mov dword [ebp - 4], 0
call fcn.004526a0
add esp, 4
push 0x5f6698
lea edx, [ebp - 0x430]
push edx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.004394f0
push edi
push esi
lea ecx, [ebp - 0x30]
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_data_void_const___unsigned_int_
lea ecx, [ebp - 0x30]
call fcn.00439210
push esi
mov dword [ebp - 4], 0
call fcn.0040107c
mov eax, dword [ebp + 0xc]
add esp, 4
push eax
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x459fc7
call ebx
push eax
push str.___CopyDLLFile::MoveFile_failed:__d____r
push 5
push 0
jmp 0x45a041
Function at 0x45a1a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
call fcn.00459de0
test al, al
jne 0x45a1b6
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x6a4010
push ebx
mov esi, edi
call fcn.0045b740
add esp, 8
sub eax, edi
mov cl, byte [esi]
mov byte [eax + esi], cl
inc esi
test cl, cl
jne 0x45a1d1
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push ebx
call esi
test eax, eax
jne 0x45a261
lea eax, [ebp - 0x400]
push edi
push eax
call fcn.00459f30
add esp, 8
lea ecx, [ebp - 0x400]
push ecx
call esi
test eax, eax
jne 0x45a228
push str.___Anti_Virus_or_Firewall_software_is_blocking_interfering_with_GameRanger____r
push 5
push eax
call fcn.004adea0
add esp, 0xc
pop edi
pop esi
mov dword [0x6ea840], 0x38
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
lea edx, [ebp - 0x400]
push ebx
push edx
call fcn.00459f80
add esp, 0xc
test al, al
jne 0x45a261
push str.___Anti_Virus_or_Firewall_software_is_blocking_interfering_with_GameRanger____r
push 5
push 0
call fcn.004adea0
add esp, 0xc
pop edi
pop esi
mov dword [0x6ea840], 0x1e
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a6e0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x45a8f9
cmp byte [esi], 0
je 0x45a8f9
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
test eax, eax
je 0x45a714
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [ecx], 0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov dword [ecx], 0
mov dword [ebp - 4], esi
push edi
nop
push 7
lea eax, [ebp - 4]
push str.http:__
push eax
call fcn.0045a600
add esp, 0xc
test eax, eax
jne 0x45a8ce
push 8
lea ecx, [ebp - 4]
push str.https:__
push ecx
call fcn.0045a600
add esp, 0xc
test eax, eax
jne 0x45a8ce
push 6
lea edx, [ebp - 4]
push str.ftp:__
push edx
call fcn.0045a600
add esp, 0xc
test eax, eax
jne 0x45a8ce
push 7
lea eax, [ebp - 4]
push str.rtsp:__
push eax
call fcn.0045a600
add esp, 0xc
test eax, eax
jne 0x45a8ce
push 4
lea ecx, [ebp - 4]
push str.www.
push ecx
call fcn.0045a600
add esp, 0xc
test eax, eax
jne 0x45a8ce
push 4
lea edx, [ebp - 4]
push str.ftp.
push edx
call fcn.0045a600
add esp, 0xc
test eax, eax
jne 0x45a8ce
push 7
lea eax, [ebp - 4]
push str.mailto:
push eax
call fcn.0045a600
add esp, 0xc
test eax, eax
jne 0x45a8ce
cmp byte [esi], 0x40
jne 0x45a8c8
mov edx, dword [ebp + 8]
mov ebx, esi
mov eax, esi
dec esi
xor edi, edi
cmp esi, edx
jb 0x45a832
mov cl, byte [esi]
cmp cl, 0x2d
jge 0x45a80a
cmp cl, 0x26
je 0x45a80a
cmp cl, 0x23
je 0x45a80a
cmp cl, 0x2b
jne 0x45a832
cmp cl, 0x39
jle 0x45a814
cmp cl, 0x41
jl 0x45a832
cmp cl, 0x5b
jl 0x45a81e
cmp cl, 0x5e
jle 0x45a832
cmp cl, 0x7e
jg 0x45a832
cmp cl, 0x2e
jne 0x45a82d
cmp byte [esi + 1], cl
je 0x45a832
dec esi
cmp esi, edx
jae 0x45a7f4
mov cl, byte [eax + 1]
inc eax
inc esi
mov dword [ebp - 4], esi
test cl, cl
je 0x45a887
mov edi, edi
cmp cl, 0x2d
jge 0x45a859
cmp cl, 0x26
je 0x45a859
cmp cl, 0x25
je 0x45a859
cmp cl, 0x23
je 0x45a859
cmp cl, 0x2b
jne 0x45a887
mov dl, byte [esi]
cmp dl, 0x39
jle 0x45a865
cmp dl, 0x41
jl 0x45a887
cmp cl, 0x5b
jl 0x45a86f
cmp cl, 0x5e
jle 0x45a887
cmp cl, 0x7e
jg 0x45a887
cmp cl, 0x2e
jne 0x45a87f
cmp byte [eax + 1], cl
je 0x45a887
inc edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x45a840
cmp byte [eax - 1], 0x2e
jne 0x45a894
add edi, 0xffff
dec eax
cmp byte [eax - 1], 0x3f
jne 0x45a89b
dec eax
test di, di
je 0x45a8c0
sub eax, esi
test eax, eax
jne 0x45a8ce
cmp byte [esi], 0
jne 0x45a720
sub esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [edx], esi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea esi, [ebx + 1]
mov dword [ebp - 4], esi
jmp 0x45a8a6
inc esi
mov dword [ebp - 4], esi
jmp 0x45a8a6
mov ecx, esi
sub ecx, dword [ebp + 8]
jne 0x45a8e3
mov edx, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [edx], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
sub esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
pop edi
mov dword [ecx], eax
pop ebx
mov dword [edx], esi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45aa60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push 1
push eax
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x45aa7f
xor al, al
pop ebx
pop ebp
ret
push esi
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x45aabd
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45aa91
sub eax, esi
lea edi, [ebx - 1]
lea ecx, [ecx]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x45aaa0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov esi, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45aad0
sub eax, esi
lea edi, [ebx - 1]
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x45aae0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str..lnk
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x45ad00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x208]
push ecx
push 0
lea edx, [ebp - 0x104]
push 7
push edx
call fcn.0045aa60
add esp, 0x10
test al, al
jne 0x45ad3f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esp, ebp
pop ebp
ret

Function at 0x45d120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x607eb4
push 0x83
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x45d1d4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x45d1d4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x45d1d3
mov cl, byte [esi]
mov eax, dword [0x6a4410]
mov edx, esi
test cl, cl
je 0x45d179
cmp cl, 0x76
jne 0x45d16c
inc eax
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x45d166
mov dword [0x6a4410], eax
xor ecx, ecx
mov edx, 0x10
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.00401148
xor edi, edi
add esp, 4
cmp byte [esi], 0
mov dword [0x6a4414], eax
mov dword [0x6a4410], edi
mov ecx, eax
mov edx, esi
je 0x45d1d2
mov esi, eax
jmp 0x45d1b0
mov al, byte [edx]
xor al, 0x7b
cmp al, 0xd
jne 0x45d1c3
inc edi
add esi, 0x10
mov byte [ecx], 0
mov ecx, esi
jmp 0x45d1c6
mov byte [ecx], al
inc ecx
inc edx
cmp byte [edx], 0
jne 0x45d1b0
mov dword [0x6a4410], edi
pop edi
pop esi
ret
Function at 0x4600b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x6a3108]
push esi
call fcn.004475b0
mov ecx, dword [0x6a3108]
mov word [0x6e73c0], ax
call fcn.004475e0
mov word [0x6a84bc], ax
call fcn.00456e70
mov esi, dword [ebp + 8]
cmp eax, 0x1770
setle al
mov byte [0x6a8497], al
mov byte [0x6a8496], 0
cmp esi, 0x40
jbe 0x460101
mov dword [ebp + 8], 0x40
mov esi, dword [ebp + 8]
mov eax, esi
imul eax, eax, 0x4b
xor ecx, ecx
mov edx, 0x21
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00401148
add esp, 4
mov dword [0x6a84b4], eax
test eax, eax
je 0x4601e9
push ebx
mov ebx, eax
mov dword [0x6a84b8], esi
test esi, esi
je 0x4601e1
mov eax, dword [ebp + 8]
push edi
mov esi, 0x6a84c4
mov edi, 0x6a8734
mov dword [ebp + 8], eax
mov edi, edi
mov dword [esi - 4], 0
mov dword [esi], 0
call fcn.004dc830
mov dword [esi + 4], eax
xor ecx, ecx
mov eax, 0xffff
mov dword [esi + 0xa], ecx
mov word [esi + 0xe], ax
lea eax, [esi + 0x11]
mov ecx, 0x4b
jmp 0x460180
mov dword [eax + 3], ebx
mov word [eax - 1], 0
add ebx, 0x21
add eax, 8
dec ecx
jne 0x460180
mov word [esi + 0x268], cx
mov byte [esi + 0x26a], cl
lea ecx, [esi + 0x280]
lea edx, [esi + 0x500]
mov dword [edi - 4], ecx
mov dword [edi], edx
lea eax, [esi + 0x780]
lea ecx, [esi + 0xa00]
lea edx, [esi + 0xc80]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
add esi, 0xfbc
add edi, 0xfbc
dec dword [ebp + 8]
jne 0x460150
pop edi
pop ebx
pop esi
pop ebp
jmp fcn.0045fe70
pop esi
pop ebp
ret

Function at 0x460390
Capabilities:
Capture microphone audio

Disassembly:
push str.vl_rs_n
call fcn.004608a0
mov ecx, dword [0x6a3108]
add esp, 4
call fcn.00447340
mov ecx, dword [0x6e7408]
movzx eax, al
push str.vl_rs:wiph_n
mov dword [0x6e73d0], eax
mov dword [0x6e73d4], ecx
mov dword [0x6e73d8], 0x140
mov dword [0x6e73e4], 0
call fcn.004608a0
mov edx, dword [0x6e7404]
add esp, 4
push 0x20
push 0x6e73d4
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
test eax, eax
je 0x460403
push eax
push str.VoiceLevel::RecordSample:_waveInPrepareHeader_error:__d_n
call fcn.00450df0
add esp, 8
push str.vl_rs:wiab_n
call fcn.004608a0
mov eax, dword [0x6e7404]
add esp, 4
push 0x20
push 0x6e73d4
push eax
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
test eax, eax
je 0x460435
push eax
push str.VoiceLevel::RecordSample:_waveInAddBuffer_error:__d_n
call fcn.00450df0
add esp, 8
push str.vl_rs:wis_n
call fcn.004608a0
mov ecx, dword [0x6e7404]
add esp, 4
push ecx
call dword [sym.imp.WINMM.dll_waveInStart]
push str.vl_rs__n
call fcn.004608a0
pop ecx
ret

Function at 0x460970
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push str.vi_o_n
call fcn.004608a0
mov eax, dword [ebp + 0xc]
add esp, 4
cmp eax, 0xffffffff
je 0x46098c
or dword [ebp + 0x1c], 4
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push esi
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WINMM.dll_waveInOpen]
mov esi, eax
push esi
push str.vi_o_r_u_n
call fcn.004608a0
add esp, 8
mov eax, esi
pop esi
pop ebp
ret
Function at 0x472e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5e116b
push eax
mov dword fs:[0], esp
sub esp, 0x16c
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x6e7454
push edi
mov eax, esi
sub edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x472eb0
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov eax, dword [0x6e7418]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x38]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x472ee8
mov ecx, dword [0x60abec]
mov edx, dword [0x60abf0]
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x38]
push 0x1c
push ecx
mov dword [ebp - 0x20], edx
call fcn.005d5c40
mov edx, dword [0x60abe0]
mov eax, dword [0x60abe4]
lea ecx, [ebp - 0x48]
push ecx
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x38]
push 0x1c
push edx
mov dword [ebp - 0x20], eax
call fcn.005d5c40
xor eax, eax
lea edx, [ebp - 0x1c]
add esp, 0x18
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, esi
sub edx, esi
jmp 0x472f50
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x472f50
lea eax, [ebp - 0x1c]
mov edx, eax
mov edi, 2
sub edi, edx
mov esi, 1
mov edx, 3
xor ecx, ecx
sub esi, eax
sub edx, eax
lea eax, [ebp + ecx - 0x1c]
mov ebx, ecx
and ebx, 0xf
movzx ebx, byte [ebp + ebx - 0x48]
xor byte [eax], bl
lea ebx, [esi + eax]
and ebx, 0xf
movzx ebx, byte [ebp + ebx - 0x48]
xor byte [eax + 1], bl
lea ebx, [edi + eax]
and ebx, 0xf
movzx ebx, byte [ebp + ebx - 0x48]
xor byte [eax + 2], bl
lea ebx, [edx + eax]
and ebx, 0xf
movzx ebx, byte [ebp + ebx - 0x48]
xor byte [eax + 3], bl
add ecx, 4
cmp ecx, 0x10
jb 0x472f76
push 0x60
lea ecx, [ebp - 0x178]
call fcn.00446710
push 0x10
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_data_void_const___unsigned_int_
push 0x10
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x178]
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_data_void_const___unsigned_int_
lea eax, [ebp - 0x178]
push eax
call fcn.0046bef0
add esp, 4
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.004465d0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x474c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x458], 0
jne 0x474d24
mov eax, dword [esi + 0xdfc]
push edi
push eax
push 0x456
lea ecx, [esi + 0x438]
call sub.MFC42.dll_CWnd::SubclassDlgItem
lea ecx, [esi + 0x438]
call fcn.0047b040
mov edx, dword [esi + 0x478]
mov eax, dword [edx + 0x5c]
lea edi, [esi + 0x478]
mov ecx, edi
mov byte [esi + 0x4b8], 1
call eax
push 0x60b104
push 0x84
push 0
mov byte [esi + 0x4b8], 0
mov byte [esi + 0x4f2], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x474d23
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x474d22
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x474d22
lea ecx, [ebx + 1]
push ecx
call fcn.00401148
mov esi, eax
add esp, 4
test esi, esi
je 0x474d22
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x474d22
push ebx
push eax
push esi
call sub.msvcrt.dll_memcpy
mov byte [esi + ebx], 0
mov eax, dword [edi]
mov edx, dword [eax + 0x50]
add esp, 0xc
push esi
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x34]
mov ecx, edi
call edx
push esi
call fcn.0040107c
add esp, 4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x478960
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [ecx + 0x20]
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x478af4
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
push edi
push 0xd
call esi
mov edi, eax
test edi, edi
je 0x478a51
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor ecx, ecx
mov word [ebp - 0x204], cx
mov ecx, eax
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4789b0
sub ecx, esi
sar ecx, 1
cmp ecx, 0x100
jae 0x4789df
lea edx, [ebp - 0x204]
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4789d0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.004788f0
xor edx, edx
mov word [ebp + eax*2 - 0x204], dx
lea eax, [ebp - 0x204]
cmp word [ebp - 0x204], dx
je 0x478a32
lea esp, [esp]
movzx ecx, word [eax]
cmp ecx, 0xa
je 0x478a22
cmp ecx, 0xd
je 0x478a22
cmp ecx, 9
jne 0x478a2a
mov ecx, 0x20
mov word [eax], cx
add eax, 2
cmp word [eax], dx
jne 0x478a10
lea edx, [ebp - 0x204]
push edx
push 0x4b0
mov ecx, esi
call fcn.00478850
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 1
call esi
mov esi, eax
test esi, esi
je 0x478aec
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov byte [ebp - 0x104], 0
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x478a72
sub ecx, edi
cmp ecx, 0x100
jae 0x478a9a
lea edx, [ebp - 0x104]
sub edx, eax
jmp 0x478a90
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478a90
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.004788f0
mov byte [ebp + eax - 0x104], 0
cmp byte [ebp - 0x104], 0
lea eax, [ebp - 0x104]
je 0x478adc
mov cl, byte [eax]
cmp cl, 0xa
je 0x478ad3
cmp cl, 0xd
je 0x478ad3
cmp cl, 9
jne 0x478ad6
mov byte [eax], 0x20
inc eax
cmp byte [eax], 0
jne 0x478ac2
lea eax, [ebp - 0x104]
push eax
push 0
mov ecx, esi
call fcn.00478850
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47ff30
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x6e94bc]
sub esp, 0x808
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x47ff72
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x47ff66
mov eax, dword [0x6e94bc]
push eax
call fcn.0040107c
add esp, 4
mov dword [0x6e94bc], ebx
jmp 0x47ff72
cmp dword [0x6e94bc], ebx
jne 0x4800a9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 4]
push ecx
push 0x20019
push ebx
push str.SoftwareValveSteam
push reloc.WS2_32.dll_accept
mov byte [ebp - 0x408], bl
call esi
test eax, eax
jne 0x47ffc2
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x408]
push eax
push ebx
push ebx
push str.SteamPath
push ecx
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
jmp 0x480003
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SoftwareValveSteam
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x48000c
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x408]
push edx
push ebx
push ebx
push str.InstallPath
push eax
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 9], bl
pop esi
cmp byte [ebp - 0x408], bl
je 0x4800a3
lea edx, [ebp - 0x408]
push edx
call fcn.0047fed0
add esp, 4
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4800a3
movsx edx, byte [ebp - 0x408]
push edx
call dword [sym.imp.msvcrt.dll_toupper]
add esp, 4
mov byte [ebp - 0x408], al
push 0x400
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x400
lea edx, [ebp - 0x408]
push edx
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea ecx, [ebp - 0x408]
push ecx
call sym.GameRanger.exe_char____cdecl_new_string_char_const__
add esp, 4
mov dword [0x6e94bc], eax
cmp dword [0x6e94bc], ebx
setne al
pop ebx
mov esp, ebp
pop ebp
ret