joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428a39
Capabilities:
Get file system object information

Disassembly:
push 0x6f8
mov eax, 0x546e89
call fcn.005284dc
mov edi, ecx
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
mov esi, dword [ebp + 8]
xor eax, eax
test ecx, ecx
mov dword [ebp - 0x704], ebx
setne al
test eax, eax
jne 0x428a68
call fcn.0040adb0
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x428b96
sub eax, 1
je 0x428ac0
sub eax, 1
je 0x428a98
sub eax, 1
je 0x428ac0
push 0x584f04
mov ecx, esi
call fcn.00402650
mov eax, esi
call fcn.00528486
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x428a82
lea eax, [ebp - 0x4e8]
push eax
jmp 0x428a87
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x428a82
push ebx
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], ebx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x444], ebx
push eax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
call fcn.00424fc3
test eax, eax
je 0x428a82
call fcn.0040b30a
push eax
lea ecx, [ebp - 0x700]
call fcn.00402870
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], ebx
jne 0x428b56
test byte [ebp - 0x428], 0x18
jne 0x428b6e
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov ecx, edi
push dword [ebp - 0x430]
call dword [eax + 0x1a0]
jmp 0x428b6e
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov ecx, edi
call dword [eax + 0x1a4]
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.0040b3e6
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [esi], eax
lea ecx, [ecx - 0x10]
call fcn.004029b0
jmp 0x428a8e
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x428a82
lea eax, [ebp - 0x6f0]
jmp 0x428abd

Function at 0x428d45
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.0043fd8f
call fcn.00412d39
cmp dword [eax + 0x14], 0
jne 0x428d60
mov ecx, esi
pop esi
jmp fcn.00428114
pop esi
ret
Function at 0x43d614
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.004021e0
call fcn.00412d39
cmp dword [eax + 0x14], 0
jne 0x43d62f
mov ecx, esi
pop esi
jmp fcn.0043cef1
pop esi
ret
Function at 0x4d6d8b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5a5788], 0
push esi
je 0x4d6e6c
cmp dword [0x5a5aec], 0xfffffffe
jne 0x4d6e59
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x4d6e6c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5bac98]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5b9d60]
cmp eax, dword [ecx + 4]
jle 0x4d6e03
mov ebx, 0x5b9d60
push ebx
call fcn.0052835f
cmp dword [0x5b9d60], 0xffffffff
pop ecx
jne 0x4d6e03
mov ecx, 0x5b9d40
call fcn.00443ded
push 0x552e7c
call fcn.0052822f
push ebx
call fcn.00528320
pop ecx
pop ecx
mov ebx, 0x5b9d48
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x5b9d2c], 0
jne 0x4d6e6f
push 0
push 0
push 0x4d6e75
call fcn.0052fd55
add esp, 0xc
mov dword [0x5b9d2c], eax
test eax, eax
je 0x4d6e48
cmp eax, 0xffffffff
je 0x4d6e48
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x5a5aec], esi
jmp 0x4d6e4f
and dword [0x5b9d2c], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
jmp 0x4d6e6c
mov eax, dword [ebp + 8]
mov dword [0x5a5aec], eax
inc eax
neg eax
sbb eax, eax
and dword [0x5b9d2c], eax
pop esi
pop ebp
ret
call fcn.0040adb0
int3
Function at 0x4eca5e
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x548012
call fcn.005284a8
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x100
jne 0x4ecb44
mov edi, dword [ebx + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x4ecb44
cmp edi, 0x43
je 0x4ecaa3
cmp edi, 0x2d
jne 0x4ecb44
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4ecb44
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.0040b30a
push eax
lea ecx, [ebp + 8]
call fcn.00402870
movzx eax, byte [esi + 0xe6]
and dword [ebp - 4], 0
push eax
movzx eax, byte [esi + 0xe5]
push eax
movzx eax, byte [esi + 0xe4]
push eax
lea eax, [ebp + 8]
push 0x5726b0
push eax
call fcn.00402c60
mov esi, dword [ebp + 8]
add esp, 0x14
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.004029b0
mov esi, dword [ebp - 0x10]
push ebx
mov ecx, esi
call fcn.004eafb9
call fcn.00528471
ret 4
Function at 0x403b10
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x6f405c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x5c], ecx
push 0
push str.data
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push str.data_aiconfig
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x704164]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 0x125]
mov dword [ebp - 0x58], edx
mov ax, word [ebp - 0x58]
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
push ecx
push str.._data_aiconfig__d.dat
lea edx, [ebp - 0x50]
push edx
call fcn.0059ec3f
add esp, 0xc
push 0x5ca6a4
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.0059ebf8
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x403bb2
mov edx, dword [ebp - 4]
push edx
push 1
push 0x1c64
mov eax, dword [ebp - 0x5c]
add eax, 0xea
push eax
call fcn.0059eaab
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.0059e8e0
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0059e593
mov esp, ebp
pop ebp
ret

Function at 0x403bc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x6f405c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x5c], ecx
mov eax, dword [0x704164]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 0x125]
mov dword [ebp - 0x58], edx
mov ax, word [ebp - 0x58]
mov word [ebp - 8], ax
movzx ecx, word [ebp - 8]
push ecx
push str.._data_aiconfig__d.dat
lea edx, [ebp - 0x50]
push edx
call fcn.0059ec3f
add esp, 0xc
push 0x1c64
push 0
mov eax, dword [ebp - 0x5c]
add eax, 0xea
push eax
call fcn.0059e5b0
add esp, 0xc
push 0x5ca6d8
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.0059ebf8
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x403cab
mov eax, dword [ebp - 4]
push eax
push 1
push 0x1c64
mov ecx, dword [ebp - 0x5c]
add ecx, 0xea
push ecx
call fcn.0059ef2b
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.0059e8e0
add esp, 4
call fcn.00401550
mov eax, dword [eax + 0x226]
imul eax, eax, 0x64
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], 0
fild qword [ebp - 0x64]
mov ecx, dword [ebp - 0x5c]
fstp dword [ecx + 0xde]
call fcn.00401550
mov edx, dword [eax + 0x22a]
imul edx, edx, 0x64
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
mov eax, dword [ebp - 0x5c]
fstp dword [eax + 0xe6]
jmp 0x403cb3
mov ecx, dword [ebp - 0x5c]
call fcn.00403cd0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0059e593
mov esp, ebp
pop ebp
ret

Function at 0x410fa0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0x410f20
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6f5cf4], eax
pop ebp
ret 4
Function at 0x411610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov ecx, 0x6f7a90
call fcn.0042bba0
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6f57d4], esi
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x72e648]
xor edx, edx
mov eax, esi
div dword [0x72dbd4]
mov eax, dword [0x72dbd8]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x41166e
cmp dword [edx], esi
je 0x4116b5
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x411663
mov edx, dword [ebp + 8]
push 0
push edx
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6f57d8
push 0x6f59f0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6f57c0], esi
test esi, esi
jne 0x4116d4
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x41166e
mov eax, dword [ebp + 8]
push 0
push eax
mov eax, dword [edx + 8]
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x411686
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6f5d20
call fcn.00412e70
cmp dword [0x705f08], 0
push 0
mov ecx, 0x6f5d20
push 0
jne 0x411724
push 1
call fcn.00412cd0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push 2
call fcn.00412cd0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x411f40
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00410fa0
mov eax, dword [ebp + 0x10]
mov dword [0x6f57b8], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411f82
test dl, dl
je 0x411f7e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411f82
add eax, 2
add ecx, 2
test dl, dl
jne 0x411f62
xor eax, eax
jmp 0x411f87
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x411fa8
push 0
push str.Error__
push 0x5caae4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.00411240
test eax, eax
je 0x411f9f
push esi
call fcn.00410fa0
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x5caad0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x713650
call fcn.00537b40
push str._____________________Client_Start______________________
push 0x713650
call fcn.00537b40
push str._______________________________________________________
push 0x713650
call fcn.00537b40
add esp, 0x18
call fcn.00411180
mov ecx, 0x714c28
call fcn.0054bec0
push 0x72daa8
push 0x6f57d8
call fcn.0059ec3f
push 0x72daa8
push 0x6f59f0
call fcn.0059ec3f
push esi
call fcn.00411ee0
add esp, 0x14
mov ecx, 0x714c28
call fcn.00544770
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x7118c8
call fcn.004fe3e0
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x7118c8
call fcn.004ff010
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x7118c8
call fcn.004fd040
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x7118c8
call fcn.004fe5c0
mov ecx, 0x7036f0
call fcn.0043ac70
mov eax, dword [ebp + 0x14]
push eax
push esi
call fcn.00411610
add esp, 8
test eax, eax
jne 0x4120a4
call fcn.00411250
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call esi
test eax, eax
je 0x4120d8
lea edx, [ebp - 0x1c]
push edx
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
jmp 0x4120b8
mov ecx, 0x6f5d20
call fcn.00413260
cmp eax, 0xffffffff
jne 0x4120b8
call fcn.00411250
mov eax, dword [ebp - 0x14]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425d10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x6f405c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x130], eax
cmp eax, ebx
je 0x425f1a
cmp byte [eax], bl
je 0x425f1a
lea eax, [ebp - 0x118]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [ebp - 0x118], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425f1a
mov edx, dword [ebp - 0x118]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x11c]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [ebp - 0x11c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x425d9c
mov dword [ebp - 0x11c], 0x64
push edi
xor edi, edi
mov dword [ebp - 0x12c], ebx
cmp dword [ebp - 0x11c], ebx
jbe 0x425ef5
push esi
xor eax, eax
push edi
push str._04u
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], al
lea eax, [ebp - 0xc]
push 5
push eax
call fcn.00426280
mov eax, dword [ebp - 0x118]
add esp, 0x10
lea ecx, [ebp - 0x114]
push ecx
push 0x20019
push ebx
lea edx, [ebp - 0xc]
push edx
push eax
mov dword [ebp - 0x114], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425eb5
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x120]
push ecx
mov ecx, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x124]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], 0x104
call esi
test eax, eax
je 0x425e47
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x425eb5
mov eax, dword [ebp - 0x130]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x425e6e
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x425eb5
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x124]
push edx
push ebx
push str.Characteristics
push eax
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x120], 4
call esi
mov ecx, dword [ebp - 0x114]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x425ee8
inc edi
cmp edi, dword [ebp - 0x11c]
jb 0x425db2
mov eax, dword [ebp - 0x118]
pop esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x12c]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059e593
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x12c], edx
pop esi
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x12c]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059e593
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0059e593
mov esp, ebp
pop ebp
ret 4
Function at 0x425f30
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x425f71
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push ecx
call fcn.00426280
add esp, 0x10
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 4]
push esi
push edx
call fcn.005a0927
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
cmp esi, edi
jne 0x425fa0
mov eax, dword [ebp + 8]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 4]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x425fd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.00426280
push esi
call fcn.005a08ed
add esp, 0x14
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x426017
cmp eax, 8
ja 0x426017
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.0059f260
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00425d10
test al, 4
jne 0x42601d
mov esi, dword [esi]
test esi, esi
jne 0x425fe0
mov edx, dword [ebp - 0xc]
push edx
call fcn.005a08ed
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4478b0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bc363
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6f405c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00439880
xor edi, edi
lea ecx, [esi + 0x4c]
mov dword [ebp - 4], edi
mov dword [esi], vtable.cWindow.0
call fcn.00438bd0
mov ebx, 1
lea ecx, [esi + 0x18e]
mov byte [ebp - 4], bl
call fcn.004353e0
fldz
fst dword [esi + 0x1de]
xor eax, eax
fstp dword [esi + 0x1e2]
mov ecx, ebx
fld1
xor edx, edx
fst dword [esi + 0x1ea]
mov word [esi + 0x1a], ax
fstp dword [esi + 0x1ee]
mov dword [esi + 8], edi
mov word [esi + 0xc], cx
mov dword [esi + 0xe], ebx
mov dword [esi + 0x12], edi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x1e6], edx
mov dword [esi + 0x1ae], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edi
mov dword [esi + 4], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x1b2], 0xffffff
mov dword [esi + 0x1b6], 0xff
mov dword [esi + 0x1ba], 0x64
mov dword [esi + 0x16], 0x4478a0
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x448ef0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0xc]
pop ebp
jmp fcn.00441810

Function at 0x449440
Capabilities:
Delete file

Disassembly:
push esi
push edi
push 0x5ca6a0
push str.._image_InterfaceScript_AdvancedSetDlg.bin
mov edi, ecx
call fcn.00448ef0
mov ecx, dword [edi + 0x18]
mov esi, eax
push esi
call fcn.00599040
mov ecx, esi
call fcn.0051e820
pop edi
mov dword [0x6f6584], esi
mov ecx, esi
pop esi
jmp fcn.0051f3a0

Function at 0x463170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bcf66
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6f405c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
xor edi, edi
mov dword [esi], vtable.CReinforceManager.0
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
push 0x14
mov byte [ebp - 4], 1
call fcn.004d4860
push 0x14
lea ecx, [esi + 0x28]
call fcn.004d4860
mov dword [esi + 0x4c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x50], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46ca30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd696
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6f405c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 4]
xor eax, eax
mov dword [edi], vtable.CMunpaMarkManager.0
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
push 0x40
mov byte [ebp - 4], 1
mov dword [edi + 0x4c], eax
call fcn.004d4860
push 0x40
lea ecx, [edi + 0x28]
call fcn.004d4860
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47c9d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
push edi
mov edi, ecx
test eax, eax
jne 0x47c9f3
push str.Item_DB_idx__0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop ebx
pop ebp
ret 4
push esi
push eax
mov ecx, 0x704d70
call fcn.004b5430
mov esi, eax
test esi, esi
je 0x47ca12
mov ax, word [ebx + 6]
mov word [esi + 0x288], ax
jmp 0x47ca41
push str.CItemShopGridDialog::AddItem
push ebx
mov ecx, 0x704d70
call fcn.004b86b0
mov esi, eax
test esi, esi
jne 0x47ca2f
pop esi
pop edi
pop ebx
pop ebp
ret 4
push esi
mov ecx, 0x704d70
mov dword [esi + 0x20], 1
call fcn.004c2020
mov edx, dword [esi]
mov eax, dword [edx + 0x7c]
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.0047c8f0
movzx eax, ax
push esi
push eax
mov ecx, edi
call fcn.00435040
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x498590
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 1
jne 0x4985d3
mov eax, dword [0x70508c]
add eax, 0x1d4c0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x232], eax
mov ecx, dword [ebp - 4]
add ecx, 0x27e
call fcn.00450070
push str.ANRaster.tga
mov ecx, dword [ebp - 4]
add ecx, 0x27e
call fcn.004500a0
jmp 0x4985ec
mov ecx, dword [ebp - 4]
add ecx, 0x27e
call fcn.00450070
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.004301b0
mov esp, ebp
pop ebp
ret 4
Function at 0x498600
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 1
jne 0x498648
mov eax, dword [ebp + 0xc]
imul eax, eax, 0x3e8
add eax, dword [0x70508c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x232], eax
mov ecx, dword [ebp - 4]
add ecx, 0x27e
call fcn.00450070
push str.ANRaster.tga
mov ecx, dword [ebp - 4]
add ecx, 0x27e
call fcn.004500a0
jmp 0x498661
mov ecx, dword [ebp - 4]
add ecx, 0x27e
call fcn.00450070
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.004301b0
mov esp, ebp
pop ebp
ret 8

Function at 0x49a900
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bf078
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6f405c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xa
call fcn.00598c60
xor eax, eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
push 0xa
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 2
call fcn.00598c60
push 0xa
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 3
call fcn.00598c60
push 0xa
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 4
call fcn.00598c60
push 0xa
lea ecx, [esi + 0xc8]
mov byte [ebp - 4], 5
call fcn.00598c60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret