joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d51
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431464]
jne 0x416d5b
repz ret
jmp loc.004882c8

Function at 0x424e93
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x431464]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041c9a1
and dword [ebp - 0x14], 0
cmp dword [0x433250], 0
mov dword [ebp - 0x18], eax
jne 0x424f46
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x424fee
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x424fee
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x433250], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x433254], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x433258], eax
call edi
push eax
call esi
mov dword [0x433260], eax
test eax, eax
je 0x424f46
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43325c], eax
mov eax, dword [0x43325c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x424f9f
cmp dword [0x433260], ecx
je 0x424f9f
push eax
call esi
push dword [0x433260]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x424f9f
test ebx, ebx
je 0x424f9f
call edi
test eax, eax
je 0x424f96
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x424f96
test byte [ebp - 8], 1
jne 0x424f9f
or dword [ebp + 0x10], 0x200000
jmp 0x424fd2
mov eax, dword [0x433254]
cmp eax, dword [ebp - 0x18]
je 0x424fd2
push eax
call esi
test eax, eax
je 0x424fd2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x424fd2
mov eax, dword [0x433258]
cmp eax, dword [ebp - 0x18]
je 0x424fd2
push eax
call esi
test eax, eax
je 0x424fd2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x433250]
call esi
test eax, eax
je 0x424fee
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x424ff0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416d51
leave
ret

Function at 0x8de36c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de372
pop ebp
sub ebp, 6
sub ebp, 0x4de36c
jmp 0x8de3d0
jmp 0x8de3d9
mov eax, 0x4de36c
add eax, ebp
add eax, 0x93
mov ecx, 0x640
mov edx, 0x35a7a4e4
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de3f0
jmp 0x8de403
mov fs, word [esp + ecx*4 - 0x1b1b0b1c]
mov esp, fs
sub al, cl
in al, 0x65
adc al, 0xa8
inc esp
add bl, ah
adc al, 0xa8
inc esp
add bl, ah
xlatb
and al, 0xb4
sbb esi, dword [ecx - 0x28]
lds esp, [eax + 0x296fb4e4]
outsd dx, dword [esi]
insd dword es:[edi], dx
fsub st(4)
in al, 0xe4
and eax, 0xe4e4e41c
out 0x29, eax
pop esp
loop 0x8de41c
in al, 0xe4
pop esi
int3
Function at 0x430001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5a2c567b
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..pdata_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x33306c9d
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401b40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43f646
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esi], fcn.00407b90
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 8], 0x445140
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x1c], 0x4451b4
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0x11
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], 0xa
mov dword [esi + 4], edi
mov eax, dword [esi + 0x20]
cmp eax, edi
mov byte [esp + 0x14], 1
je 0x401bb9
push eax
call sub.MFC71U.DLL_operator_new
add esp, 4
mov dword [esi + 0x20], edi
push 0x2c
call sub.MFC71U.DLL_SerializeElements
mov edi, eax
add esp, 4
mov dword [esi + 0x20], edi
xor eax, eax
mov ecx, 0xb
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x24], 0xb
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x407c20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x624
mov eax, dword [0x45a1b4]
push ebx
mov dword [esp + 0x624], eax
cmp dword [ecx + 0xc8], 0xffffffff
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x407c5f
xor al, al
mov ecx, dword [esp + 0x62c]
call fcn.0043eeed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
xor esi, esi
mov word [esp + 0x218], si
mov ecx, 0x81
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x218]
push 0x104
push eax
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
mov ebx, dword [sym.imp.MSVCR71.dll__snwprintf]
mov word [esp + 0x18], si
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x220]
push ecx
push str._sDownLoad
lea edx, [esp + 0x20]
push 0x104
push edx
stosw word es:[edi], ax
call ebx
mov esi, dword [ebp + 8]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
test edx, edx
jbe 0x407cde
cmp word [esi + edx*2], 0x2f
je 0x407cde
dec edx
jne 0x407cd4
xor eax, eax
mov word [esp + 0x420], 0
mov ecx, 0x81
lea edi, [esp + 0x422]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esi + edx*2 + 2]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x446bb8
lea edx, [esp + 0x42c]
push 0x104
push edx
call ebx
add esp, 0x14
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0xc4]
push 0
add ecx, 0xc4
push 0x1001
lea eax, [esp + 0x428]
push eax
call dword [edx + 0x28]
mov ecx, dword [esp + 0x62c]
test eax, eax
setne al
call fcn.0043eeed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4080b0
Capabilities:
Create process on windows
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43fc8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x480
mov eax, dword [0x45a1b4]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x484], eax
xor eax, eax
xor esi, esi
mov word [esp + 0x70], si
mov ecx, 0x81
lea edi, [esp + 0x72]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], ebx
add ebx, 0xc4
stosw word es:[edi], ax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str..WHD
mov dword [esp + 0x498], esi
call edi
lea ecx, [esp + 0xc]
mov esi, eax
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call edi
sub eax, esi
shl eax, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
mov word [esp + eax + 0x70], 0
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
mov esi, eax
mov eax, dword [ebx]
lea edi, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call dword [eax + 0x54]
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 9
xor ebx, ebx
push ebx
push ebx
lea edx, [esp + 0x7c]
push edx
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
test eax, eax
je 0x408226
mov esi, dword [esp + 0x14]
cmp word [esi + 0x80], bx
je 0x4081be
lea eax, [esp + 0x70]
push eax
push str._s__VERYSILENT
push 0x104
lea ecx, [esp + 0x284]
push ecx
jmp 0x4081d5
lea edx, [esp + 0x70]
push edx
push 0x446c74
push 0x104
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea ecx, [esi + 0xa84]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [esp + 0x298]
push eax
push ebx
mov dword [esp + 0x50], 0x44
mov word [esp + 0x80], 0xa
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x408234
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
xor al, al
jmp 0x408284
cmp dword [esi + 0x20], ebx
jne 0x408266
mov eax, dword [esi + 0xa80]
mov edx, dword [esi]
push ebx
push 0x64
push eax
lea ecx, [esp + 0x24]
push ecx
push 0x40000000
push ebx
push ebx
mov ecx, esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call dword [edx + 0x5c]
mov edx, dword [esi + 0x20]
push ebx
push 0x64
push 0xc8
push edx
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov al, 1
mov ecx, dword [esp + 0x48c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x484]
call fcn.0043eeed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426ef0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x426f04
push 0x64
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x426fd9
mov eax, dword [esi + 0x70]
test eax, eax
je 0x426f5e
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x426f5e
mov ecx, dword [esi + 0x2ac]
test ecx, ecx
je 0x426f40
mov eax, dword [esi + 0x70]
test eax, eax
je 0x426f40
mov edx, dword [ecx]
push 0
push 0
push 0x64
push 2
push eax
call dword [edx + 0x20]
mov eax, dword [esi + 0x5c]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x426f7d
mov ecx, dword [esi + 0x5c]
push 0
push ecx
jmp 0x426f77
mov edx, dword [esi + 0x5c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x426f7d
mov eax, dword [esi + 0x5c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [esi + 0x5c]
push edi
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esi + 0x60]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x426fa5
push eax
call edi
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x426faf
push eax
call edi
xor eax, eax
mov dword [esi + 0x70], 0
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
cmp byte [esp + 0x10], 1
pop edi
jne 0x426fd9
mov ecx, dword [esi + 0x6c]
mov eax, dword [esp + 4]
mov edx, dword [ecx]
push eax
call dword [edx + 0xc]
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x426fe0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x260
mov eax, dword [0x45a1b4]
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x264], eax
mov eax, dword [esi + 0x6c]
xor ebp, ebp
cmp eax, ebp
jne 0x427018
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x25c]
call fcn.0043eeed
add esp, 0x260
ret 4
cmp dword [esi + 0x20], ebp
jne 0x427058
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
call sub.MFC71U.DLL_AfxGetStringManager
cmp eax, ebp
je 0x42703f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x427041
xor eax, eax
mov edx, dword [esi]
push ebp
push 0x64
push eax
lea eax, [esp + 0x14]
push eax
push 0x40000000
push ebp
push ebp
mov ecx, esi
call dword [edx + 0x5c]
cmp dword [esi + 0x2ac], ebp
push ebx
push edi
jne 0x4270ae
lea ecx, [esi + 0x74]
call fcn.004261c0
test al, al
je 0x42717f
mov edi, dword [esi + 0x2ac]
mov edx, dword [esi + 0x54]
mov ebx, dword [edi]
lea ecx, [esi + 0x54]
push 0x6010100
push 0x44d25c
call dword [edx + 4]
push eax
mov ecx, edi
call dword [ebx + 0xc]
test al, al
je 0x42717f
mov ecx, dword [esi + 0x2ac]
mov eax, dword [ecx]
call dword [eax + 0x10]
test al, al
je 0x42717f
mov eax, dword [esi + 0x5c]
cmp eax, ebp
lea ebx, [esi + 0x5c]
je 0x4270fb
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4270fb
mov eax, dword [esi + 0x70]
cmp eax, ebp
je 0x427195
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x427195
mov ecx, dword [esi + 0x6c]
mov edx, dword [ecx]
push 1
call dword [edx + 0x10]
push 0x65
push 2
mov ecx, esi
call fcn.00426670
jmp 0x427195
mov ecx, dword [esi + 0x2ac]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, eax
call dword [sym.imp.PlatformData.dll_public:_static_class_CParameterGlobal____cdecl_CParameterGlobal::GetInstance_void_]
mov ecx, dword [esp + 0x274]
mov eax, edi
cdq
push edx
push eax
push ecx
push 0x44d468
lea edx, [esp + 0x74]
push 0x104
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x18
push ebx
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
push ebp
push ebp
push 0x4000000
push ebp
push ebp
push ebp
lea ecx, [esp + 0x84]
push ecx
push ebp
mov dword [esp + 0x48], 0x44
mov word [esp + 0x78], 3
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x427183
xor edx, edx
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
xor al, al
jmp 0x427197
mov eax, dword [esi + 0x20]
push ebp
push 0x4e20
push 0x64
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov al, 1
mov ecx, dword [esp + 0x26c]
pop edi
pop ebx
pop esi
pop ebp
call fcn.0043eeed
add esp, 0x260
ret 4
Function at 0x4292e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4428a9
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x28]
push esi
push edi
push ebx
mov edi, ecx
call sub.MFC71U.DLL_CListCtrl::GetItemData
test eax, eax
mov esi, dword [esp + 0x1c]
je 0x429359
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x429344
cmp ecx, 5
jne 0x429359
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x429324
lea eax, [edi + 0x68]
jmp 0x429332
call dword [sym.imp.SkinControl.dll_public:_static_class_CSkinResourceManager____cdecl_CSkinResourceManager::GetInstance_void_]
mov ecx, eax
call dword [sym.imp.SkinControl.dll_public:_class_CFont____thiscall_CSkinResourceManager::GetDefaultFont_void_]
test eax, eax
je 0x42937d
mov eax, dword [eax + 4]
test eax, eax
je 0x42937d
mov ecx, dword [esi + 4]
push eax
push ecx
jmp 0x429377
lea eax, [edi + 0x68]
test eax, eax
je 0x42937d
mov eax, dword [eax + 4]
test eax, eax
je 0x42937d
mov edx, dword [esi + 4]
push eax
push edx
jmp 0x429377
call dword [sym.imp.SkinControl.dll_public:_static_class_CSkinResourceManager____cdecl_CSkinResourceManager::GetInstance_void_]
mov ecx, eax
call dword [sym.imp.SkinControl.dll_public:_class_CFont____thiscall_CSkinResourceManager::GetDefaultFont_void_]
test eax, eax
je 0x42937d
mov eax, dword [eax + 4]
test eax, eax
je 0x42937d
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
mov ecx, esi
call sub.MFC71U.DLL_CListCtrl::SetBkImage
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx + 0x38]
add dword [esp + 0x28], 5
push ebx
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call sub.MFC71U.DLL_CListCtrl::GetItemText
mov edi, dword [esi]
push 0x24
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], 0
call dword [sym.imp.MFC71U.DLL_CHtmlView::GetLeft]
push eax
lea ecx, [esp + 0x3c]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
mov ecx, esi
call dword [edi + 0x70]
lea ecx, [esp + 0x30]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x1c
Function at 0x429e00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4428eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x438
mov eax, dword [0x45a1b4]
push ebx
push esi
push edi
mov dword [esp + 0x43c], eax
mov esi, ecx
xor eax, eax
xor ebx, ebx
mov word [esp + 0x28], bx
mov ecx, 0x81
lea edi, [esp + 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
push 0x104
push eax
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
mov word [esp + 0x238], bx
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x23a]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
push ecx
push str._sConstantlyPlayGame.wh
lea edx, [esp + 0x240]
push 0x104
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x18
lea ecx, [esp + 0xc]
call sub.MFC71U.DLL_CFile::CFile
push ebx
push 0x1001
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x458], ebx
call sub.MFC71U.DLL_CDataPathProperty::Open
test eax, eax
je 0x429f14
mov eax, dword [esi + 0x2ac]
xor ecx, ecx
mov dword [esp + 0x1e], ecx
mov dword [esp + 0x22], ecx
mov word [esp + 0x26], cx
mov word [esp + 0x1c], bx
xor cl, cl
lea esp, [esp]
cmp eax, ebx
je 0x429efb
mov edx, eax
mov dx, word [edx + 8]
mov eax, dword [eax]
movzx esi, cl
inc cl
cmp cl, 6
mov word [esp + esi*2 + 0x1c], dx
jb 0x429ee0
push 0xc
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
call sub.MFC71U.DLL_CArchiveStream::Write
lea ecx, [esp + 0xc]
call sub.MFC71U.DLL_CDatabase::Close
lea ecx, [esp + 0xc]
mov dword [esp + 0x44c], 0xffffffff
call sub.MFC71U.DLL_CEvent::CEvent
mov ecx, dword [esp + 0x444]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x43c]
call fcn.0043eeed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42cd70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x15c
cmp word [ebp + 0xc], 0x14a
mov eax, dword [0x45a1b4]
push ebx
push esi
mov dword [esp + 0x160], eax
push edi
mov esi, ecx
je 0x42cdac
xor al, al
mov ecx, dword [esp + 0x164]
call fcn.0043eeed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 8]
cmp word [ebx], 0x12
jne 0x42cdd0
mov edx, dword [ebx + 6]
mov eax, dword [esi + 0x7548]
push edx
lea edx, [ebx + 0x4a]
push edx
lea ecx, [esi + 0x7548]
lea edx, [ebx + 0xa]
push edx
call dword [eax + 0x44]
cmp word [ebx], 0x13
jne 0x42cdf1
mov edx, dword [ebx + 6]
mov eax, dword [esi + 0x7548]
push edx
lea edx, [ebx + 0x4a]
push edx
lea ecx, [esi + 0x7548]
lea edx, [ebx + 0xa]
push edx
call dword [eax + 0x48]
mov ecx, dword [esi + 0xc0]
mov eax, dword [ecx]
call dword [eax + 0x24]
cmp dword [ebx + 2], eax
jne 0x42ce2f
mov ecx, dword [esi + 0xc0]
mov edx, dword [ecx]
call dword [edx + 0x14]
cmp word [ebx], 0x12
jne 0x42ce15
dec word [eax]
cmp word [ebx], 0x13
jne 0x42ce1f
dec word [eax + 2]
mov ecx, dword [esi + 0x1ef8]
test ecx, ecx
je 0x42ce2f
call dword [sym.imp.GameProperty.dll_public:_void___thiscall_CDlgTrumpetItem::UpdateControlSurface_void_]
lea ecx, [esi + 0x1aec]
mov dword [esp + 0xc], ecx
call fcn.004261a0
test al, al
je 0x42ce8b
mov eax, dword [ebx + 2]
mov cx, word [ebx]
mov edx, dword [ebx + 6]
mov word [esp + 0x10], cx
mov dword [esp + 0x14], eax
push 0x14c
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x14]
lea esi, [ebx + 0xa]
mov ecx, 0x10
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push eax
lea esi, [ebx + 0x4a]
mov ecx, 0x40
lea edi, [esp + 0x64]
push 0x68
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
push 5
call fcn.004266a0
call dword [sym.imp.PlatformData.dll_public:_static_class_CParameterGlobal____cdecl_CParameterGlobal::GetInstance_void_]
mov cl, byte [eax + 0x1a]
test cl, cl
je 0x42cf16
call sub.MFC71U.DLL_AfxGetModuleShortFileName
mov esi, dword [eax + 8]
call dword [sym.imp.GameEngine.dll_public:_static_class_CD3DSound____cdecl_CD3DSound::GetInstance_void_]
test eax, eax
je 0x42cecf
cmp word [ebx], 0x12
mov ecx, str.BUGLE
je 0x42ceba
mov ecx, 0x44dfbc
push 0
push 0x44be64
push ecx
push esi
mov ecx, eax
call dword [sym.imp.GameEngine.dll_public:_bool___thiscall_CD3DSound::PlaySoundW_struct_HINSTANCE_____wchar_t_const___wchar_t_const___bool_]
test al, al
jne 0x42cf16
cmp word [ebx], 0x12
mov eax, str.BUGLE
je 0x42cedf
mov eax, 0x44dfbc
push 0x44be64
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42cf16
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42cf0f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push 7
push esi
push eax
call dword [sym.imp.WINMM.dll_PlaySoundW]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [esp + 0x164]
mov al, 1
call fcn.0043eeed
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8