joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4925f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [esp + 4], 0
je 0x492607
or dword [eax + 0x27b0], 8
mov dword [esp + 4], eax
jmp fcn.00491850
and dword [eax + 0x27b0], 0xfffffff7
mov dword [esp + 4], eax
jmp fcn.00491850

Function at 0x492620
Capabilities:
Hide graphical window

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
push edi
mov esi, eax
mov eax, dword [esi + 0x2630]
push 0x4b691c
xor edi, edi
push eax
mov dword [esi + 0x2fe0], edi
mov dword [esi + 0x2658], edi
call ebp
mov ecx, dword [esi + 4]
push 0x10a
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
and dword [esi + 0x27a8], 0xfffffffe
cmp dword [esp + 0x1c], edi
jne 0x4926d3
mov eax, dword [esi + 0x27b0]
mov edx, dword [esi + 0x27ac]
and eax, 1
push eax
mov edi, edx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push 2
push 1
mov ecx, edi
call eax
mov edx, dword [edi]
mov ebx, eax
mov eax, dword [edx + 4]
mov ecx, edi
call eax
mov edx, ebx
mov ecx, eax
call fcn.0048eb40
add esp, 0xc
mov ebx, 0x4b682c
mov dword [esi + 0x27b0], 9
call fcn.00404730
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esi + 0x27ac]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x40]
call eax
test al, al
je 0x4926d3
or dword [esi + 0x27b0], 4
mov ecx, dword [esi + 0x2630]
push 0x4b6850
push ecx
call ebp
push esi
call fcn.00491850
mov eax, dword [esp + 0x1c]
call fcn.0048d5c0
mov edx, dword [esi + 0x208c]
push eax
push edx
call ebp
call fcn.004904e0
mov eax, dword [esi + 0x2098]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov ecx, dword [esi + 0x21e4]
push 5
push ecx
call edi
mov edx, dword [esi + 0x2330]
push 5
push edx
call edi
mov eax, dword [esi + 0x247c]
push 5
push eax
call edi
call fcn.00490430
call fcn.004905d0
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0x50f
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x493bd0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x496f27
mov eax, dword fs:[0]
push eax
sub esp, 0x1e0
mov eax, dword [0x4c5280]
xor eax, esp
mov dword [esp + 0x1d8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c5280]
xor eax, esp
push eax
lea eax, [esp + 0x1f4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x204]
xor ebx, ebx
mov dword [esp + 0x1c], vtable.WTL::CMessageLoop.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x1fc], ebx
mov edi, dword [0x4ca4a4]
lea eax, [esp + 0x1c]
add edi, 0x10
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x4caec8]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], eax
call fcn.00404580
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x54]
push eax
call fcn.00404040
mov eax, ebp
lea edx, [esp + 0xc4]
mov byte [esp + 0x1fc], 1
call fcn.00410960
lea edi, [esp + 0x54]
call fcn.004046b0
mov ecx, dword [esp + 0x58]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esp + 0x1c]
call fcn.00403c40
mov esi, eax
call fcn.00403eb0
lea edx, [esp + 0x54]
push edx
mov byte [esp + 0x200], bl
call fcn.00404230
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x493ce5
push eax
call fcn.00475125
add esp, 4
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
cmp eax, ebx
je 0x493cfe
push eax
call fcn.00475125
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1f4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d8]
xor ecx, esp
call fcn.00474db0
add esp, 0x1ec
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401080
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push section..text
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6c0a34], eax
pop ebp
ret 4
Function at 0x4016c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov ecx, 0x6c3240
call fcn.0041ade0
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6c0514], esi
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x6fb81c]
xor edx, edx
mov eax, esi
div dword [0x6fada8]
mov eax, dword [0x6fadac]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40171e
cmp dword [edx], esi
je 0x401765
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x401713
mov edx, dword [ebp + 8]
push 0
push edx
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6c0518
push 0x6c0730
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6c0500], esi
test esi, esi
jne 0x401784
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40171e
mov eax, dword [ebp + 8]
push 0
push eax
mov eax, dword [edx + 8]
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x401736
mov eax, dword [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6c1368
call fcn.00403050
cmp dword [0x6d17f8], 0
push 0
mov ecx, 0x6c1368
push 0
jne 0x4017d4
push 1
call fcn.00402eb0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push 2
call fcn.00402eb0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x401fc0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00401080
mov eax, dword [ebp + 0x10]
mov dword [0x6c04f8], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402002
test dl, dl
je 0x401ffe
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402002
add eax, 2
add ecx, 2
test dl, dl
jne 0x401fe2
xor eax, eax
jmp 0x402007
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402028
push 0
push str.Error__
push 0x5a1804
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
call fcn.004012f0
test eax, eax
je 0x40201f
push esi
call fcn.00401080
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x5a17f0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x6e0258
call fcn.00526e00
push str._____________________Client_Start______________________
push 0x6e0258
call fcn.00526e00
push str._______________________________________________________
push 0x6e0258
call fcn.00526e00
add esp, 0x18
call fcn.00401260
mov ecx, 0x6e1830
call fcn.0053a030
push 0x6fac7a
push 0x6c0518
call fcn.0058408f
push 0x6fac7a
push 0x6c0730
call fcn.0058408f
push esi
call fcn.00401f60
add esp, 0x14
mov ecx, 0x6e1830
call fcn.00532ff0
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6db278
call fcn.004e4980
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6db278
call fcn.004e5540
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6db278
call fcn.004e3680
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6db278
call fcn.004e4b50
mov ecx, 0x6ceea0
call fcn.004290b0
mov eax, dword [ebp + 0x14]
push eax
push esi
call fcn.004016c0
add esp, 8
test eax, eax
jne 0x402124
call fcn.00401300
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call esi
test eax, eax
je 0x402158
lea edx, [ebp - 0x1c]
push edx
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
jmp 0x402138
mov ecx, 0x6c1368
call fcn.00403350
cmp eax, 0xffffffff
jne 0x402138
call fcn.00401300
mov eax, dword [ebp - 0x14]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x415430
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x6bef0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x130], eax
cmp eax, ebx
je 0x41563a
cmp byte [eax], bl
je 0x41563a
lea eax, [ebp - 0x118]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [ebp - 0x118], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41563a
mov edx, dword [ebp - 0x118]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x11c]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [ebp - 0x11c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x4154bc
mov dword [ebp - 0x11c], 0x64
push edi
xor edi, edi
mov dword [ebp - 0x12c], ebx
cmp dword [ebp - 0x11c], ebx
jbe 0x415615
push esi
xor eax, eax
push edi
push str._04u
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], al
lea eax, [ebp - 0xc]
push 5
push eax
call fcn.004158e0
mov eax, dword [ebp - 0x118]
add esp, 0x10
lea ecx, [ebp - 0x114]
push ecx
push 0x20019
push ebx
lea edx, [ebp - 0xc]
push edx
push eax
mov dword [ebp - 0x114], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4155d5
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x120]
push ecx
mov ecx, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x124]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], 0x104
call esi
test eax, eax
je 0x415567
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4155d5
mov eax, dword [ebp - 0x130]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41558e
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4155d5
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x114]
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x124]
push edx
push ebx
push str.Characteristics
push eax
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x120], 4
call esi
mov ecx, dword [ebp - 0x114]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x415608
inc edi
cmp edi, dword [ebp - 0x11c]
jb 0x4154d2
mov eax, dword [ebp - 0x118]
pop esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x12c]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00583b0e
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x128]
mov dword [ebp - 0x12c], edx
pop esi
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x12c]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00583b0e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00583b0e
mov esp, ebp
pop ebp
ret 4
Function at 0x415650
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x415691
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push ecx
call fcn.004158e0
add esp, 0x10
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 4]
push esi
push edx
call fcn.00584dc7
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
cmp esi, edi
jne 0x4156c0
mov eax, dword [ebp + 8]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 4]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x4156f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.004158e0
push esi
call fcn.00584d8d
add esp, 0x14
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x415737
cmp eax, 8
ja 0x415737
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.005843e0
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00415430
test al, 4
jne 0x41573d
mov esi, dword [esi]
test esi, esi
jne 0x415700
mov edx, dword [ebp - 0xc]
push edx
call fcn.00584d8d
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x437570
Capabilities:
Delete file

Disassembly:
push esi
push edi
push 0x5a1d48
push str.._image_InterfaceScript_AdvancedSetDlg.bin
mov edi, ecx
call fcn.00437020
mov ecx, dword [edi + 0x18]
mov esi, eax
push esi
call fcn.0057e9e0
mov ecx, esi
call fcn.00503800
pop edi
mov dword [0x6c1d3c], esi
mov ecx, esi
pop esi
jmp fcn.00504380

Function at 0x467c00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
push edi
mov edi, ecx
test eax, eax
jne 0x467c23
push str.Item_DB_idx__0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop ebx
pop ebp
ret 4
push esi
push eax
mov ecx, 0x6d0518
call fcn.0049d7d0
mov esi, eax
test esi, esi
je 0x467c42
mov ax, word [ebx + 6]
mov word [esi + 0x28e], ax
jmp 0x467c71
push str.CItemShopGridDialog::AddItem
push ebx
mov ecx, 0x6d0518
call fcn.004a09f0
mov esi, eax
test esi, esi
jne 0x467c5f
pop esi
pop edi
pop ebx
pop ebp
ret 4
push esi
mov ecx, 0x6d0518
mov dword [esi + 0x24], 1
call fcn.004a9ed0
mov edx, dword [esi]
mov eax, dword [edx + 0x7c]
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.00467b20
movzx eax, ax
push esi
push eax
mov ecx, edi
call fcn.00423990
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x482870
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 1
jne 0x4828b3
mov eax, dword [0x6d0834]
add eax, 0x1d4c0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x238], eax
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043de00
push str.ANRaster.tga
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043de30
jmp 0x4828cc
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043de00
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041ef80
mov esp, ebp
pop ebp
ret 4

Function at 0x4828e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 1
jne 0x482928
mov eax, dword [ebp + 0xc]
imul eax, eax, 0x3e8
add eax, dword [0x6d0834]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x238], eax
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043de00
push str.ANRaster.tga
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043de30
jmp 0x482941
mov ecx, dword [ebp - 4]
add ecx, 0x284
call fcn.0043de00
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0041ef80
mov esp, ebp
pop ebp
ret 8
Function at 0x4a5440
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x6bef0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push esi
mov esi, ecx
call ebx
cmp dword [esi + 0xf4], 0
jne 0x4a546e
mov dword [esi + 0xf4], eax
sub eax, dword [esi + 0xf4]
cmp eax, 0x1388
jbe 0x4a555c
mov ecx, dword [esi + 0xd0]
mov eax, dword [esi + 0xdc]
mov dword [esi + 0xe4], eax
test ecx, ecx
jle 0x4a54a4
test eax, eax
je 0x4a54a1
mov eax, dword [eax]
mov dword [esi + 0xe4], eax
dec ecx
jne 0x4a5495
push edi
push 0
push 2
mov dword [ebp - 0x1ac], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4a555b
lea ecx, [ebp - 0x1ac]
push ecx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4a554c
jmp 0x4a54e0
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x84]
push 0x5a167c
push eax
call fcn.0058408f
add esp, 0xc
lea ecx, [ebp - 0x84]
push ecx
mov ecx, esi
call fcn.004a07f0
test eax, eax
je 0x4a553b
mov ecx, 0x6e1050
call fcn.0052c170
push 0x230
mov ecx, 0x6d18c8
call fcn.004c65f0
push eax
push 1
push 0x179e
push 0x6cf010
call fcn.0043a580
add esp, 0x10
lea edx, [ebp - 0x1ac]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4a54e0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [esi + 0xf4], eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00583b0e
mov esp, ebp
pop ebp
ret
Function at 0x4b8750
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x6baa7d], 0
push esi
mov esi, ecx
je 0x4b8773
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
mov dword [0x6d0848], eax
mov byte [0x6baa7d], 0
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xc]
mov edx, eax
sub edx, ecx
mov dword [0x6d0848], eax
cmp eax, ecx
jae 0x4b878a
dec edx
mov dword [0x6d0830], edx
mov dword [esi + 0xc], eax
mov eax, dword [0x6d0830]
add dword [0x6d0834], eax
add dword [esi + 8], eax
cmp dword [esi + 8], 0x5265c00
jb 0x4b87b4
inc dword [esi + 4]
add dword [esi + 8], 0xfad9a400
pop esi
ret
Function at 0x4c0c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c0c42
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp + 8]
push ecx
push 0x500
lea edx, [edi + 0x504]
push edx
push esi
call ebx
test eax, eax
jne 0x4c0c72
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push 0
lea eax, [ebp + 8]
push eax
push 0xc0
add edi, 0xac4
push edi
push esi
call ebx
push esi
test eax, eax
je 0x4c0c63
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
Function at 0x4c49c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c49f6
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x4c4a36
cmp dword [ebp - 8], 0x61208
jne 0x4c4a36
push 0
lea edx, [ebp - 4]
push edx
push 0xa8
add ebx, 4
push ebx
push esi
call edi
test eax, eax
jne 0x4c4a46
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], 0xa8
push esi
ja 0x4c4a37
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c4a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c4ad5
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 4]
push ecx
push esi
mov dword [ebp - 4], 0x61208
call edi
push 0
lea edx, [ebp - 8]
push edx
push 0xa8
add ebx, 4
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c5520
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x6bef0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x9720], eax
push edi
lea edi, [ecx + 0x9720]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
mov eax, dword [ecx + 0x9708]
mov ecx, dword [ecx + eax*4 + 0x96e0]
push edx
mov dword [ebp - 0x20], edi
call fcn.00426360
test eax, eax
je 0x4c5706
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4c559f
cmp ecx, 0xffb9f145
je 0x4c559f
cmp ecx, 0xff01d1f7
je 0x4c559f
cmp ecx, 0xfff0ff00
je 0x4c559f
cmp ecx, 0xfff7b618
je 0x4c559f
cmp ecx, 0xffebc3ce
jne 0x4c5706
push ebx
lea ebx, [eax + 4]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c55a8
sub eax, edx
push esi
mov dword [ebp - 0x2c], eax
mov esi, 0
je 0x4c55be
mov esi, ebx
xor ebx, ebx
cmp byte [esi], 0x5b
jne 0x4c5704
xor ecx, ecx
inc esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], ecx
cmp eax, ecx
jle 0x4c5704
lea ecx, [ecx]
cmp byte [ecx + esi], 0x5d
jne 0x4c564f
lea edi, [ebx + 1]
xor eax, eax
push edi
lea ecx, [ebp - 0x18]
push esi
push ecx
mov dword [ebp - 0x28], 1
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
call fcn.0052d9a0
push 5
push 0x5ad9a0
push esi
call fcn.00585d8a
add esp, 0x18
test eax, eax
je 0x4c5635
push 5
push 0x5ad998
push esi
call fcn.00585d8a
add esp, 0xc
test eax, eax
jne 0x4c565a
cmp dword [ebp - 0x1c], 0
jne 0x4c565a
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov ebx, edi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
jmp 0x4c5650
inc ebx
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, eax
jl 0x4c55e0
jmp 0x4c565d
mov edi, dword [ebp - 0x20]
cmp ebx, 0x10
jg 0x4c5704
cmp dword [ebp - 0x28], 0
je 0x4c5704
cmp dword [ebp - 0x1c], 0
je 0x4c567b
add ebx, 2
jmp 0x4c567c
inc ebx
push ebx
push esi
push edi
call fcn.0052d9a0
mov edx, dword [0x6c0500]
add esp, 0xc
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c5704
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x12
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4c56d7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x12
push edi
push eax
mov byte [eax], 0
call fcn.0052d9a0
add esp, 0xc
push esi
push 7
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
push 0x65e
mov ecx, 0x6d18c8
call fcn.004c65f0
push eax
push 0x1d
push 0x6d18c8
call fcn.004c7880
add esp, 0x10
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00583b0e
mov esp, ebp
pop ebp
ret 4