joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x455377
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46a630]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [esp + 0xa8]
mov eax, dword [esp + 0xac]
push 0x30
push eax
push 0x84
mov ecx, ebx
call fcn.004218e8
push 0x401730
push 0x4016f0
push 0x18
push 8
lea ecx, [ebx + 0x88]
xor ebp, ebp
mov dword [esp + 0xb0], ebp
push ecx
mov dword [ebx], vtable.ButtonPage.0
call fcn.0043630d
mov dword [ebx + 0x160], ebp
mov dword [ebx + 0x164], ebp
mov dword [ebx + 0x168], ebp
push fcn.004017e0
push 0x401780
push 0x18
push 0x74
lea edx, [ebx + 0x16c]
push edx
mov byte [esp + 0xb4], 2
call fcn.0043630d
lea esi, [ebx + 0xc4c]
mov byte [esp + 0xa0], 3
call fcn.00403ad0
mov byte [esp + 0xa0], 4
mov eax, edi
mov dword [ebx + 0x148], edi
mov dword [ebx + 0xd38], ebp
call fcn.004184b0
cmp byte [0x46ff88], 0
mov ecx, dword [eax]
mov dword [ebx + 0x14c], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 0x150], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 0x154], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x158], edx
jne 0x4044a0
mov dword [esp + 0x14], 0x4702e4
mov edi, 0x46c1d0
jmp 0x404392
xor ebp, ebp
movzx eax, word [edi]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0xa
push eax
push ebp
call esi
cmp eax, ebp
je 0x4043af
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
movzx eax, word [edi]
push 0xa
push eax
push 0
call esi
test eax, eax
jne 0x4043c1
xor esi, esi
jmp 0x4043cc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
lea eax, [esp + 0x18]
push eax
call fcn.004062b0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], vtable.ysl::storage::memory_streambuf.0
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], ebp
mov dword [ecx], esi
mov edx, dword [esp + 0x3c]
mov dword [edx], esi
mov ecx, dword [esp + 0x4c]
lea eax, [esi + ebp]
sub eax, esi
mov dword [ecx], eax
mov edx, dword [esp + 0x28]
mov dword [edx], esi
mov ecx, dword [esp + 0x38]
mov dword [ecx], esi
mov edx, dword [esp + 0x48]
mov dword [edx], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x60]
push ecx
mov byte [esp + 0xa8], 5
call fcn.00406100
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x5c]
push edx
mov ecx, esi
mov byte [esp + 0xa4], 6
call fcn.00403610
mov byte [esp + 0xa0], 5
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x64]
mov dword [esp + ecx + 0x5c], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
push edx
mov dword [esp + 0x68], vtable.std::ios_base.0
call fcn.0044ff2a
mov byte [esp + 0xa4], 4
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], vtable.ysl::storage::memory_streambuf.0
call fcn.004063b0
add edi, 0xc
add esi, 0x3c
cmp edi, 0x46c2f0
mov dword [esp + 0x14], esi
jl 0x404390
mov byte [0x46ff88], 1
mov ecx, ebx
call fcn.004203a4
add eax, 4
and dword [eax], 0xffffffdf
mov eax, ebx
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret 8
Function at 0x4062b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4542eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46a630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0044fe7e
push 4
mov dword [esp + 0x20], 0
call fcn.00418fff
mov edi, eax
add esp, 4
test edi, edi
je 0x406330
call fcn.0044fa13
mov dword [edi], eax
call fcn.0044f847
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0044fcb9
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406325
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0044fcda
jmp 0x406332
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40b900
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45501b
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x46a630]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
mov eax, dword [0x46a630]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x100
lea ecx, [esp + 0x50]
push ecx
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40ba4f
lea eax, [esp + 0x4c]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], 0
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b980
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x50]
push edx
lea esi, [esp + 0x38]
call fcn.00407450
mov ebx, 8
mov eax, esi
mov dword [esp + 0x260], 0
call fcn.0040c980
cmp eax, 0xffffffff
je 0x40ba3c
cmp dword [esp + 0x48], ebx
mov eax, dword [esp + 0x34]
jae 0x40b9cc
lea eax, [esp + 0x34]
add eax, 0x10
call fcn.0040d090
mov ecx, dword [0x47089c]
mov esi, eax
mov eax, dword [0x4708a0]
push 0
add esi, 0x3980000
push eax
mov edx, esi
push ecx
shr edx, 0x10
push edx
call fcn.004023e0
test eax, eax
je 0x40ba02
push esi
call fcn.00402380
jmp 0x40ba04
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.004027b0
cmp dword [eax + 0x18], ebx
jb 0x40ba1a
mov eax, dword [eax + 4]
jmp 0x40ba1d
add eax, 4
mov edx, dword [esp + 0x10]
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [esp + 0x2c], ebx
jb 0x40ba3c
mov eax, dword [esp + 0x18]
push eax
call fcn.0041902a
add esp, 4
cmp dword [esp + 0x48], ebx
jb 0x40ba4f
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0041902a
add esp, 4
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.004362fe
mov esp, ebp
pop ebp
ret
Function at 0x40ec10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4546e8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x46a630]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [0x46a630]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, ecx
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.00402250
lea ecx, [esp + 0x14]
push ecx
push ecx
push eax
lea edx, [ebp + 0x18]
push edx
lea eax, [ebp + 0xc]
push eax
lea edx, [esp + 0x48]
mov ecx, esi
mov dword [esp + 0x94], 0
call fcn.0040fac0
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00450478
fstp qword [esp + 0x3c]
mov dword [esp + 0x90], 0xffffffff
mov edi, dword [esp + 0x34]
add esp, 0x10
test edi, edi
je 0x40ed02
push 0
lea ecx, [esp + 0x2c]
call fcn.0044fcb9
mov eax, dword [edi + 4]
test eax, eax
jbe 0x40ece0
cmp eax, 0xffffffff
jae 0x40ece0
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.0044fcda
test esi, esi
je 0x40ed02
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
cmp byte [ebp + 0x14], 0
mov edi, dword [ebp + 0x10]
jne 0x40ed47
test edi, edi
je 0x40ed41
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x40ed26
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x40ed26
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x40ed32
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
movzx eax, ax
movzx eax, ax
cmp ax, 0xffff
je 0x40ed41
mov word [ebp + 0x16], ax
jmp 0x40ed43
xor edi, edi
mov byte [ebp + 0x14], 1
cmp byte [ebp + 0x20], 0
mov esi, dword [ebp + 0x1c]
jne 0x40ed7f
test esi, esi
je 0x40ed7d
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x40ed6b
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x40ed6b
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x40ed77
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
movzx eax, ax
cmp ax, 0xffff
jne 0x40ed7f
xor esi, esi
test edi, edi
jne 0x40eda8
test esi, esi
je 0x40edac
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
cmp dword [esp + 0x18], ecx
je 0x40edb5
cmp dword [esp + 0x14], 0
jne 0x40edb5
fld qword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x40edb8
test esi, esi
je 0x40ed87
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x40ed8b
or dword [eax], 2
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004362fe
mov esp, ebp
pop ebp
ret 0x28
Function at 0x40edf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4546e8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x46a630]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov eax, dword [0x46a630]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, ecx
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x24]
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.00402250
lea ecx, [esp + 0x14]
push ecx
push ecx
push eax
lea edx, [ebp + 0x18]
push edx
lea eax, [ebp + 0xc]
push eax
lea edx, [esp + 0x48]
mov ecx, esi
mov dword [esp + 0x94], 0
call fcn.0040fac0
add esp, 0x10
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00450473
fstp qword [esp + 0x3c]
mov dword [esp + 0x90], 0xffffffff
mov edi, dword [esp + 0x34]
add esp, 0x10
test edi, edi
je 0x40eee2
push 0
lea ecx, [esp + 0x2c]
call fcn.0044fcb9
mov eax, dword [edi + 4]
test eax, eax
jbe 0x40eec0
cmp eax, 0xffffffff
jae 0x40eec0
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.0044fcda
test esi, esi
je 0x40eee2
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
cmp byte [ebp + 0x14], 0
mov edi, dword [ebp + 0x10]
jne 0x40ef27
test edi, edi
je 0x40ef21
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x40ef06
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x40ef06
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x40ef12
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
movzx eax, ax
movzx eax, ax
cmp ax, 0xffff
je 0x40ef21
mov word [ebp + 0x16], ax
jmp 0x40ef23
xor edi, edi
mov byte [ebp + 0x14], 1
cmp byte [ebp + 0x20], 0
mov esi, dword [ebp + 0x1c]
jne 0x40ef5f
test esi, esi
je 0x40ef5d
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x40ef4b
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x40ef4b
mov edx, dword [eax]
movzx eax, word [edx]
jmp 0x40ef57
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
movzx eax, ax
cmp ax, 0xffff
jne 0x40ef5f
xor esi, esi
test edi, edi
jne 0x40ef88
test esi, esi
je 0x40ef8c
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
cmp dword [esp + 0x18], ecx
je 0x40ef95
cmp dword [esp + 0x14], 0
jne 0x40ef95
fld qword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x40ef98
test esi, esi
je 0x40ef67
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x40ef6b
or dword [eax], 2
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004362fe
mov esp, ebp
pop ebp
ret 0x28
Function at 0x40f240
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4542eb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46a630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0044fe7e
push 4
mov dword [esp + 0x20], 0
call fcn.00418fff
mov edi, eax
add esp, 4
test edi, edi
je 0x40f2c0
call fcn.0044fa13
mov dword [edi], eax
call fcn.0044f847
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0044fcb9
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40f2b5
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0044fcda
jmp 0x40f2c2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4125e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
push ebx
push edi
push 0
push 0
push 0
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea edi, [esi + 0x10]
push edi
mov dword [esi + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax]
push 0x45cb34
push ebx
call ecx
test eax, eax
jne 0x412693
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 4]
shr eax, 2
lea edx, [eax + eax]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edx
lea eax, [eax + eax*2]
mov dword [esp + 0x28], eax
mov eax, dword [edi]
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [eax]
push 4
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x412687
lea ecx, [esp + 0xc]
push ecx
push ebx
push esi
push 0x412580
push ebx
push ebx
mov dword [esp + 0x24], ebx
mov byte [esi + 0xc], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x412687
mov al, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [edi], ebx
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
mov ebx, ecx
cmp dword [ebx + 0xd4], 0
push esi
push edi
je 0x4131ec
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, esi
mov dword [esp + 0x74], 0x1f40
mov dword [esp + 0x78], 0x2b11
mov dword [esp + 0x7c], 0x5622
mov dword [esp + 0x80], 0xac44
mov dword [esp + 0x84], 0xbb80
mov dword [esp + 0x88], 0x17700
call fcn.00413ed0
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov edi, dword [esp + eax*4 + 0x70]
cmp dword [ebx + 0x58], edi
ja 0x4131cd
cmp edi, dword [ebx + 0x5c]
ja 0x4131cd
mov eax, dword [ebx + 0x54]
test eax, 0x400
je 0x41312e
test eax, 0x100
je 0x41312e
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x44]
push eax
push esi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], edi
call fcn.00413d80
mov eax, dword [ebx + 0x54]
test eax, 0x400
je 0x413163
test eax, 0x200
je 0x413163
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x50]
push edx
push esi
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 8
mov dword [esp + 0x30], edi
call fcn.00413d80
mov eax, dword [ebx + 0x54]
test eax, 0x800
je 0x413198
test eax, 0x100
je 0x413198
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x5c]
push ecx
push esi
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x10
mov dword [esp + 0x3c], edi
call fcn.00413d80
mov eax, dword [ebx + 0x54]
test eax, 0x800
je 0x4131cd
test eax, 0x200
je 0x4131cd
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x68]
push eax
push esi
mov dword [esp + 0x40], 2
mov dword [esp + 0x44], 0x10
mov dword [esp + 0x48], edi
call fcn.00413d80
mov eax, dword [esp + 0xc]
add eax, 1
cmp eax, 6
mov dword [esp + 0xc], eax
jb 0x4130e3
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4177b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x204
mov eax, dword [0x46a630]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
mov ebp, dword [esp + 0x210]
push esi
push edi
xor ecx, ecx
lea edx, [esp + 0x10]
xor eax, eax
mov ah, cl
mov esi, 8
movzx eax, ax
test eax, 0x8000
je 0x4177f4
add eax, eax
xor eax, 0x1021
movzx eax, ax
jmp 0x4177f6
add eax, eax
sub esi, 1
jne 0x4177e1
mov word [edx], ax
add ecx, 1
add edx, 2
cmp cx, 0xff
jbe 0x4177d5
movzx edi, word [ebp + 0xc]
xor eax, eax
mov word [ebp + 0xc], ax
lea ecx, [ebp + 2]
mov esi, 0x8e
lea ecx, [ecx]
movzx ebx, byte [ecx - 2]
movzx edx, ah
xor edx, ebx
xor ebx, ebx
mov bh, al
add ecx, 6
xor bx, word [esp + edx*2 + 0x10]
movzx eax, bx
movzx ebx, byte [ecx - 7]
movzx edx, ah
xor edx, ebx
xor ebx, ebx
mov bh, al
xor bx, word [esp + edx*2 + 0x10]
movzx eax, bx
movzx ebx, byte [ecx - 6]
movzx edx, ah
xor edx, ebx
xor ebx, ebx
mov bh, al
xor bx, word [esp + edx*2 + 0x10]
movzx eax, bx
movzx ebx, byte [ecx - 5]
movzx edx, ah
xor edx, ebx
xor ebx, ebx
mov bh, al
xor bx, word [esp + edx*2 + 0x10]
movzx eax, bx
movzx ebx, byte [ecx - 4]
movzx edx, ah
xor edx, ebx
xor ebx, ebx
mov bh, al
xor bx, word [esp + edx*2 + 0x10]
movzx eax, bx
movzx ebx, byte [ecx - 3]
movzx edx, ah
xor edx, ebx
xor ebx, ebx
mov bh, al
xor bx, word [esp + edx*2 + 0x10]
sub esi, 1
movzx eax, bx
jne 0x417820
mov ecx, dword [esp + 0x210]
mov word [ebp + 0xc], di
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
not eax
call fcn.004362fe
add esp, 0x204
ret 4
Function at 0x417e60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x46a630]
xor eax, esp
mov dword [esp + 0x10c], eax
lea eax, [esp]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea ecx, [esp + 4]
push ecx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x417eb3
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
jmp 0x417ec5
lea ecx, [esp + 8]
push 0x45ec24
push ecx
call fcn.00437431
add esp, 8
mov eax, dword [esp]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea eax, [esp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x417ed7
sub eax, edx
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00406e70
push 8
push str.KONAMI_
mov eax, esi
call fcn.00418a00
push 0x19
push 0x45ec34
mov eax, esi
call fcn.00418a00
push 1
push 0x45ec50
mov eax, esi
call fcn.00418a00
mov ecx, dword [esp + 0x10c]
xor ecx, esp
mov al, 1
call fcn.004362fe
add esp, 0x110
ret
Function at 0x417f30
Capabilities:
Access peb ldr_data
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4549f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x46a630]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x46a630]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea esi, [esp + 8]
mov dword [esp + 0x30], 0
call fcn.00417e60
push 0xc
push str.settings.dat
mov eax, esi
call fcn.00418a00
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x417fa2
lea eax, [esp + 0xc]
push 0x45ec54
push eax
call fcn.004376bc
mov esi, eax
add esp, 8
test esi, esi
je 0x418163
push esi
push 1
push 0x354
push 0x46ff90
call fcn.0043796b
push esi
call fcn.0043757c
add esp, 0x14
cmp dword [0x46ff90], 0x46434557
jne 0x418163
cmp dword [0x46ff94], 2
jne 0x418163
cmp dword [0x46ff98], 0x354
jb 0x418163
push 0x46ff90
call fcn.004177b0
cmp word [0x46ff9c], ax
jne 0x418163
cmp dword [esp + 0x20], 0x10
mov eax, dword [0x4700c4]
mov ecx, dword [0x4700c8]
mov edx, dword [0x4700cc]
mov dword [0x46fab0], eax
mov eax, dword [0x4700d0]
mov dword [0x46fab4], ecx
mov ecx, dword [0x4700d4]
mov dword [0x46fab8], edx
mov edx, dword [0x4700d8]
mov dword [0x46fabc], eax
mov eax, dword [0x4700dc]
mov dword [0x46fac0], ecx
mov ecx, dword [0x4700e0]
mov dword [0x46fac4], edx
mov edx, dword [0x4700e4]
mov dword [0x46fac8], eax
mov eax, dword [0x4700e8]
mov dword [0x46facc], ecx
mov ecx, dword [0x4700ec]
mov dword [0x46fad0], edx
mov edx, dword [0x4700f0]
mov dword [0x46fad4], eax
mov eax, dword [0x4700f4]
mov dword [0x46fad8], ecx
mov ecx, dword [0x4700f8]
mov dword [0x46fadc], edx
mov edx, dword [0x4700fc]
mov dword [0x46fae0], eax
mov eax, dword [0x470100]
mov dword [0x46fae4], ecx
mov ecx, dword [0x470104]
mov dword [0x46fae8], edx
mov edx, dword [0x470108]
mov dword [0x46faec], eax
mov eax, dword [0x47010c]
mov dword [0x46faf0], ecx
mov ecx, dword [0x470110]
mov dword [0x46faf4], edx
mov edx, dword [0x470114]
mov dword [0x46faf8], eax
mov eax, dword [0x470118]
mov dword [0x46fafc], ecx
mov ecx, dword [0x47011c]
mov dword [0x46fb00], edx
mov edx, dword [0x470120]
mov dword [0x46fb04], eax
mov eax, dword [0x46bc54]
mov dword [0x46fb08], ecx
mov ecx, dword [0x46bc58]
mov dword [0x46fb0c], edx
mov edx, dword [0x46bc5c]
mov dword [0x46fb10], eax
mov dword [0x46fb14], ecx
mov dword [0x46fb18], edx
jb 0x41815f
mov eax, dword [esp + 0xc]
push eax
call fcn.0041902a
add esp, 4
mov al, 1
jmp 0x418179
cmp dword [esp + 0x20], 0x10
jb 0x418177
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0041902a
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004362fe
add esp, 0x2c
ret