joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e80
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x4289ac
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x404eba
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x404ee8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x404f3c
push esi
nop
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x404f02
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x404f00
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x405190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0c
mov eax, dword [0x43400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x408]
call fcn.004016c0
add esp, 0xc
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0xc08]
push 0x4291e8
push eax
call fcn.00401700
lea eax, [ebp - 0xc08]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4051e8
push 0
lea ecx, [ebp - 0xc0c]
sub eax, edx
push ecx
push eax
lea eax, [ebp - 0xc08]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00424550
mov esp, ebp
pop ebp
ret
Function at 0x405220
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x50ff40
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x40524b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x405256
bts eax, 6
shr ecx, 1
test cl, 1
je 0x405261
bts eax, 5
shr ecx, 1
test cl, 1
je 0x40526c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x405277
bts eax, 3
shr ecx, 1
test cl, 1
je 0x405282
bts eax, 2
shr ecx, 1
test cl, 1
je 0x40528d
bts eax, 1
test cl, 2
je 0x405296
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x40532f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x405320
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x50ff40], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x405240
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405360
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x43400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x4289b0
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0
push eax
or ebx, 0xffffffff
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x4053b2
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424550
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x405402
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x50ff40]
sub edx, 1
jne 0x4053e0
cmp edi, 0x400
je 0x4053b4
push dword [ebp - 0x408]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.00424550
mov esp, ebp
pop ebp
ret 4
Function at 0x405990
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 0x20
push 3
push 0
push 1
push bind
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405a17
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [0x434224]
mov dword [0x434228], eax
test ecx, ecx
je 0x4059e3
push ecx
call fcn.00424b9b
mov eax, dword [0x434228]
add esp, 4
mov dword [0x434224], 0
push eax
call fcn.00424ba0
add esp, 4
mov dword [0x434224], eax
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push 0
push ecx
push dword [0x434228]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x405a1e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x405a30
Capabilities:
Encode data using xor
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x43400c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push ebx
push 0x429264
push eax
mov dword [ebp - 0x354], ebx
call esi
add esp, 0xc
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x358], eax
cmp eax, 0xffffffff
je 0x405bde
nop word [eax + eax]
test byte [ebp - 0x34c], 0x10
lea eax, [ebp - 0x320]
jne 0x405bf1
push eax
push ebx
lea eax, [ebp - 0x10c]
push 0x429268
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
call fcn.00405990
test al, al
je 0x405bc3
cmp dword [0x434228], 8
jb 0x405af2
mov ecx, dword [0x434224]
mov eax, dword [ecx]
cmp eax, dword [0x428c34]
jne 0x405af2
mov eax, dword [ecx + 4]
cmp eax, dword [0x428c38]
je 0x405bc3
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405bbd
mov ecx, dword [0x434228]
add ecx, 8
push ecx
call fcn.00424ba0
mov ecx, dword [0x428c34]
mov ebx, eax
mov edx, dword [0x428c38]
add esp, 4
mov dword [ebx], ecx
lea edi, [ebx + 8]
mov dword [ebx + 4], edx
push dword [0x434228]
push dword [0x434224]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x434228]
add esp, 0xc
xor edx, edx
test eax, eax
jle 0x405b91
mov eax, edx
and eax, 0xf
mov al, byte [eax + 0x428c24]
xor byte [edi + edx], al
mov eax, edx
and eax, 0x1f
movsx eax, byte [eax + 0x5103a8]
and eax, 0xf
mov al, byte [eax + 0x428c24]
add byte [edi + edx], al
inc edx
mov eax, dword [0x434228]
cmp edx, eax
jl 0x405b61
push 0
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x350], 0
push ecx
add eax, 8
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x354]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x358]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405a90
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424550
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x42927c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x405c16
test dl, dl
je 0x405c12
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x405c16
add eax, 2
add ecx, 2
test dl, dl
jne 0x405bf6
xor eax, eax
jmp 0x405c1b
sbb eax, eax
or eax, 1
test eax, eax
je 0x405bc3
mov eax, 0x429270
lea ecx, [ebp - 0x320]
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x405c50
test dl, dl
je 0x405c4c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x405c50
add ecx, 2
add eax, 2
test dl, dl
jne 0x405c30
xor eax, eax
jmp 0x405c55
sbb eax, eax
or eax, 1
test eax, eax
je 0x405bc3
lea eax, [ebp - 0x320]
push eax
push ebx
lea eax, [ebp - 0x10c]
push 0x429274
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x10c]
mov ecx, 0x434220
push eax
call fcn.00405a30
jmp 0x405bc3
Function at 0x4070c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push str..Settings.ini
push 0x20
push 0x5103a8
push 0x4289a0
push str.ServerName
push str.SilentGameGuardInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x4294cc
call fcn.00405a30
call fcn.00405220
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
push 0x4289b8
push str..DataProtectDump.List.db
push 0x50ff18
call esi
add esp, 0xc
push 0x4289b8
push str..DataProtectChecksum.List.db
push 0x50ff14
call esi
add esp, 0xc
xor edx, edx
mov ecx, str..DataProtectDump_
call fcn.004071b0
mov edx, 1
mov ecx, str..DataProtectChecksum_
call fcn.004071b0
mov edx, 2
mov ecx, str..DataProtectEncrypt_Protect_
call fcn.004071b0
push dword [0x50ff18]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
push 0x42906c
call esi
push dword [0x50ff14]
push 0x42906c
call esi
push dword [0x50ff18]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call esi
add esp, 0x14
push dword [0x50ff14]
call esi
add esp, 4
push str._Silent_GameGuard_____System__:_HackList_Generate_successfully
push 2
call fcn.0041a050
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4071b0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x764
mov eax, dword [0x43400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x508]
push esi
push edi
mov edi, ecx
mov esi, edx
push edi
push 0x429608
push eax
mov dword [ebp - 0x75c], esi
call ebx
add esp, 0xc
lea eax, [ebp - 0x758]
push eax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
je 0x407380
nop dword [eax + eax]
test byte [ebp - 0x758], 0x10
lea eax, [ebp - 0x72c]
jne 0x4072c7
push eax
push edi
lea eax, [ebp - 0x208]
push str._s_s
push eax
call ebx
mov eax, esi
add esp, 0x10
sub eax, 0
je 0x4072b7
sub eax, 1
je 0x40725e
sub eax, 1
jne 0x407365
lea eax, [ebp - 0x208]
push eax
call fcn.00405360
mov edx, str..DataProtectEncrypt_Protect_
jmp 0x40726f
lea eax, [ebp - 0x208]
push eax
call fcn.00405360
mov edx, str..DataProtectChecksum_
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.004076a0
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x308]
push str.__S__t_t_t_0x_X__r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push dword [0x50ff14]
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
mov esi, dword [ebp - 0x75c]
add esp, 0x18
jmp 0x407365
lea ecx, [ebp - 0x208]
call fcn.00407520
jmp 0x407365
mov ecx, 0x42961c
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4072f6
test dx, dx
je 0x4072f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4072f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4072d0
xor eax, eax
jmp 0x4072fb
sbb eax, eax
or eax, 1
test eax, eax
je 0x407365
mov eax, 0x429620
lea ecx, [ebp - 0x72c]
nop word [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x407336
test dx, dx
je 0x407332
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x407336
add ecx, 4
add eax, 4
test dx, dx
jne 0x407310
xor eax, eax
jmp 0x40733b
sbb eax, eax
or eax, 1
test eax, eax
je 0x407365
lea eax, [ebp - 0x72c]
push eax
push edi
lea eax, [ebp - 0x208]
push str._s_s_
push eax
call ebx
add esp, 0x10
lea ecx, [ebp - 0x208]
mov edx, esi
call fcn.004071b0
lea eax, [ebp - 0x758]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407210
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424550
mov esp, ebp
pop ebp
ret
Function at 0x4073a0
Capabilities:
Parse pe header
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x43400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0
push 3
push 0
push 1
push bind
push ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407509
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x407502
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x407502
push ebx
push esi
push dword [ebp - 0x14]
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x4074e1
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x4074da
mov esi, dword [ebx + 0x3c]
add esi, ebx
cmp dword [esi], 0x4550
jne 0x4074da
movzx eax, word [esi + 4]
mov ecx, 0x14c
cmp ax, cx
je 0x40745f
mov ecx, 0x8664
cmp ax, cx
jne 0x4074da
push dword [esi + 0x28]
push dword [esi + 0x34]
push esi
call dword [sym.imp.dbghelp.dll_ImageRvaToSection]
test eax, eax
je 0x4074da
mov ecx, dword [eax + 0x14]
sub ecx, dword [eax + 0xc]
add ecx, dword [esi + 0x28]
push 0
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4074da
push 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0
push eax
push 0x20
push dword [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4074da
mov eax, dword [esi + 0x28]
mov ecx, dword [ebp - 0x48]
add eax, dword [esi + 0x34]
push ebx
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424550
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424550
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.00424550
mov esp, ebp
pop ebp
ret
Function at 0x40a0f0
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x43400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x90]
push edi
push str..Settings.ini
push 0x20
xorps xmm0, xmm0
push eax
push 0x4289a0
push 0x429c60
push str.SilentGameGuardInfo
movaps xmmword [ebp - 0x90], xmm0
movaps xmmword [ebp - 0x80], xmm0
movaps xmmword [ebp - 0x30], xmm0
movaps xmmword [ebp - 0x20], xmm0
movaps xmmword [ebp - 0x50], xmm0
movaps xmmword [ebp - 0x40], xmm0
movaps xmmword [ebp - 0x70], xmm0
movaps xmmword [ebp - 0x60], xmm0
call esi
push str..Settings.ini
push 0x20
lea eax, [ebp - 0x30]
push eax
push 0x4289a0
push str.DataBase
push str.SilentGameGuardInfo
call esi
push str..Settings.ini
push 0x20
lea eax, [ebp - 0x50]
push eax
push 0x4289a0
push str.User
push str.SilentGameGuardInfo
call esi
push str..Settings.ini
push 0x20
lea eax, [ebp - 0x70]
push eax
push 0x4289a0
push str.Pass
push str.SilentGameGuardInfo
call esi
push str.._Settings.ini
push 0
push str.InstallDB
push str.SilentGameGuardInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov edi, eax
lea eax, [ebp - 0x30]
push eax
push 0x20
push 0x441808
call esi
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0x20
push 0x441828
call esi
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 0x20
push 0x441848
call esi
mov esi, dword [sym.imp.ODBC32.dll_SQLAllocHandle]
add esp, 0xc
push 0x441800
push dword [0x4417fc]
push 2
call esi
test ax, 0xfffe
jne 0x40a25d
push 0xfffffffffffffffd
push 0x441848
push 0xfffffffffffffffd
push 0x441828
push 0xfffffffffffffffd
push 0x441808
push dword [0x441800]
call dword [sym.imp.ODBC32.dll_SQLConnect]
test ax, 0xfffe
jne 0x40a25d
push 0x441804
push dword [0x441800]
push 3
call esi
test ax, 0xfffe
je 0x40a26c
push str.Could_Not_Connect_Into_DataBase___
push 1
call fcn.0041a050
add esp, 8
test edi, edi
jne 0x40a2d4
push str.CREATE_TABLE_dbo_._SGG_HISTORY_DETECTIONS___id__int__IDENTITY_1__1__NOT_NULL___Account__varchar__500__NULL___Player__varchar__500__NULL___IpAddress__varchar__500__NULL___HardwareId__varchar__500__NULL___DetectionType__varchar__500__NULL___CaptionName__varchar__500__NULL___Date__smalldatetime__NULL_
push 0x4417f8
call fcn.00411fc0
push str.ALTER_TABLE_dbo.Character_ADD__UnBanDate__smalldatetime__NULL
push 0x4417f8
call fcn.00411fc0
add esp, 0x10
push str..Settings.ini
push 0x429e14
push str.InstallDB
push str.SilentGameGuardInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str._Silent_GameGuard_____DataBase__:__SGG_HISTORY_DETECTIONS__TABLE_AND__UnBanDate__Create_successfully
push 2
call fcn.0041a050
add esp, 8
push dword [0x441804]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x441804]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00424550
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40a2f0
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x43400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x90]
push edi
push str..Settings.ini
push 0x20
xorps xmm0, xmm0
push eax
push 0x4289a0
push 0x429c60
push str.SilentGameGuardInfo
movaps xmmword [ebp - 0x90], xmm0
movaps xmmword [ebp - 0x80], xmm0
movaps xmmword [ebp - 0x30], xmm0
movaps xmmword [ebp - 0x20], xmm0
movaps xmmword [ebp - 0x50], xmm0
movaps xmmword [ebp - 0x40], xmm0
movaps xmmword [ebp - 0x70], xmm0
movaps xmmword [ebp - 0x60], xmm0
call esi
push str..Settings.ini
push 0x20
lea eax, [ebp - 0x30]
push eax
push 0x4289a0
push str.DataBase
push str.SilentGameGuardInfo
call esi
push str..Settings.ini
push 0x20
lea eax, [ebp - 0x50]
push eax
push 0x4289a0
push str.User
push str.SilentGameGuardInfo
call esi
push str..Settings.ini
push 0x20
lea eax, [ebp - 0x70]
push eax
push 0x4289a0
push str.Pass
push str.SilentGameGuardInfo
call esi
push str.._Settings.ini
push 0
push str.InstallDB
push str.SilentGameGuardInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov edi, eax
lea eax, [ebp - 0x30]
push eax
push 0x20
push 0x441808
call esi
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0x20
push 0x441828
call esi
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
push 0x20
push 0x441848
call esi
mov esi, dword [sym.imp.ODBC32.dll_SQLAllocHandle]
add esp, 0xc
push 0x441800
push dword [0x4417fc]
push 2
call esi
test ax, 0xfffe
jne 0x40a45d
push 0xfffffffffffffffd
push 0x441848
push 0xfffffffffffffffd
push 0x441828
push 0xfffffffffffffffd
push 0x441808
push dword [0x441800]
call dword [sym.imp.ODBC32.dll_SQLConnect]
test ax, 0xfffe
jne 0x40a45d
push 0x441804
push dword [0x441800]
push 3
call esi
test ax, 0xfffe
je 0x40a46c
push str.Could_Not_Connect_Into_DataBase___
push 1
call fcn.0041a050
add esp, 8
cmp edi, 1
jne 0x40a4d4
push str.DROP_TABLE__dbo_._SGG_HISTORY_DETECTIONS_
push 0x4417f8
call fcn.00411fc0
push str.ALTER_TABLE_dbo.Character_DROP_COLUMN_UnBanDate
push 0x4417f8
call fcn.00411fc0
add esp, 0x10
push str..Settings.ini
push 0x429edc
push str.InstallDB
push str.SilentGameGuardInfo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str._Silent_GameGuard_____DataBase__:__SGG_HISTORY_DETECTIONS__TABLE_AND__UnBanDate__Delete_successfully
push edi
call fcn.0041a050
add esp, 8
push dword [0x441804]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x441804]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00424550
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40f610
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4349e8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
test eax, eax
js 0x40f71a
cmp eax, 3
jge 0x40f71a
imul edi, eax, 0x214
inc eax
push ecx
mov dword [0x4349e8], eax
mov eax, dword [ebp + 8]
push 0x100
add edi, 0x4343ac
lea ebx, [edi + 4]
mov dword [edi], eax
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
cmp dword [edi], 0
je 0x40f71a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x14]
lea esi, [edi + 0x110]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0xe]
push eax
push ecx
push edx
push ebx
push str.._sSGG__02d__02d__04d.txt
push esi
mov dword [edi + 0x104], edx
mov dword [edi + 0x108], ecx
mov dword [edi + 0x10c], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0x210], eax
cmp eax, 0xffffffff
jne 0x40f6f6
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424550
mov esp, ebp
pop ebp
ret 8
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40f71a
push dword [edi + 0x210]
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00424550
mov esp, ebp
pop ebp
ret 8