joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e3f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413df8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 0x41ec42
call fcn.00412f13
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40e430
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40e4e0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.0040e500
test al, al
je 0x40e489
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40e4cc
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e4c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40e4c2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00411fb1
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411cf3
mov esp, ebp
pop ebp
ret

Function at 0x40e870
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x41d008]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov ecx, 0x41ec42
push edi
mov edi, dword [esp + 0x14]
call fcn.00412f13
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x40e8e1
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e8bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40e8e1
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00411cf3
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00411cf3
add esp, 8
ret 4
Function at 0x40f750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4149f5
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov ecx, 0x41ec42
mov dword [ebp - 0x2c], eax
call fcn.00412f13
mov esi, dword [edi]
test esi, esi
je 0x40f89e
cmp byte [esi + 0x54], 0
je 0x40f89e
add esi, 0x1c
xor bl, bl
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x38], bl
test esi, esi
je 0x40f7de
mov eax, dword [esi]
test eax, eax
je 0x40f7db
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40f7d5
cmp eax, 0x80
je 0x40f7d5
xor bl, bl
jmp 0x40f7db
mov byte [esi + 4], 1
mov bl, 1
mov byte [ebp - 0x38], bl
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0040c5b0
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x40f816
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40f864
push 2
push 0
push 0
push edi
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00409b00
mov dword [ebp - 4], 3
test esi, esi
je 0x40f890
test bl, bl
je 0x40f890
mov eax, dword [esi]
test eax, eax
je 0x40f88c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411cf3
mov esp, ebp
pop ebp
ret 4
Function at 0x40fc30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413c48
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, 0x41ec42
call fcn.00412f13
mov eax, dword [esi]
test eax, eax
je 0x40fc7d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
lea ecx, [ebp - 0x14]
mov word [esi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0040dee0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x40fca6
add eax, 8
jmp 0x40fca8
xor eax, eax
cmp dword [edi + 0x10], 0
je 0x40fcb8
cmp dword [edi + 0x14], 8
jb 0x40fcba
mov edi, dword [edi]
jmp 0x40fcba
xor edi, edi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x40fcdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40fcdb
mov byte [esi + 5], 1
cmp dword [esi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040e020
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411cf3
mov esp, ebp
pop ebp
ret 4
Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401533
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401dc7
sub eax, fcn.00401592
push eax
push fcn.00401592
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107a
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401461
mov eax, ebx
lea ecx, [ebx + 0x1b600]
call fcn.004014b3
mov esi, ecx
mov eax, ebx
or si, 1
cdq
idiv esi
lea edx, [eax + ecx]
mov eax, ebx
lea ebx, [ebp - 2]
or eax, 0x402054
call fcn.00401592
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401533
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
enter 0x11c, 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x401e60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401ebb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401ebb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x401ea8
cmp esi, edx
jae 0x401ebb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x401e96
cmp esi, edx
jae 0x401ebb
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x404580
Capabilities:
Resume thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov esi, ecx
mov dword [eax], 0
push 0x401
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov edi, 0x64
lea ebx, [esi + 0x348]
push ebx
dec edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x370], 0
push ebx
je 0x4045d8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
jne 0x4045b2
jmp 0x4045de
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x340]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 0x32c]
test eax, eax
je 0x4046e6
cmp eax, 0xffffffff
je 0x4046e6
cmp byte [esi + 0x326], 0
je 0x4046e6
mov cl, byte [esi + 0x328]
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov byte [esi + 0x327], 1
test cl, cl
je 0x404652
mov eax, dword [esi + 0x32c]
test eax, eax
je 0x404647
cmp eax, 0xffffffff
je 0x404647
push eax
call edi
test eax, eax
js 0x404647
cmp eax, 1
jne 0x404647
mov byte [esi + 0x328], 0
cmp byte [esi + 0x328], 0
jne 0x404625
xor cl, cl
mov eax, dword [esi + 0x32c]
test eax, eax
je 0x4046c9
cmp eax, 0xffffffff
je 0x4046c9
cmp byte [esi + 0x326], 0
je 0x4046c9
test cl, cl
je 0x4046a8
nop
mov eax, dword [esi + 0x32c]
test eax, eax
je 0x404692
cmp eax, 0xffffffff
je 0x404692
push eax
call edi
test eax, eax
js 0x404692
cmp eax, 1
jne 0x404692
mov byte [esi + 0x328], 0
cmp byte [esi + 0x328], 0
jne 0x404670
push 0x3e8
push dword [esi + 0x32c]
jmp 0x4046ae
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4046c9
push 0
push dword [esi + 0x32c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x32c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x32c], 0
mov byte [esi + 0x326], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x10
Function at 0x404c30
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, 0x113
jne 0x404d08
cmp eax, 0x401
jne 0x404d41
push 0x49a080
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
test eax, eax
je 0x404c77
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404c9e
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 5
je 0x404c9e
push str.GameHallUpdateMutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x404c6e
call edi
cmp eax, 5
jne 0x404cd2
mov ecx, dword [esi + 0x2fc]
push 0x49a0bc
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov dword [esi + 0x310], 1
xor dl, dl
mov ecx, dword [esi + 0x2c4]
push edx
mov eax, dword [ecx]
call dword [eax + 0xd8]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov ecx, dword [esi + 0x2fc]
push 0x499b14
mov eax, dword [ecx]
call dword [eax + 0x2c]
cmp dword [esi + 0x314], 0
mov dword [esi + 0x310], 0
je 0x404cb8
mov ecx, dword [esi + 0x2e4]
call fcn.004235e0
test al, al
je 0x404cb8
mov dl, 1
jmp 0x404cba
cmp edi, 0x2b12
jne 0x404d29
call fcn.00405160
mov eax, dword [ebp + 0xc]
mov ecx, esi
push ebx
push eax
push edi
call fcn.00403790
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp edi, 0x2b11
jne 0x404d41
mov dword [esi + 0x308], 1
mov dword [esi + 0x30c], ebx
push ebx
push eax
push edi
mov ecx, esi
call fcn.00403790
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4074d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4894d6
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4b0070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0xac]
call fcn.004596f0
push str.Config_
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.0040ad50
add esp, 4
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov edx, dword [ebp - 0xac]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x407549
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0xa8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407560
xor esi, esi
jmp 0x4076cb
push 0xa
push str.Config.xml
lea ecx, [ebp - 0xa8]
call fcn.0040c610
lea ecx, [ebp - 0xa4]
call fcn.0040ede0
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xa8]
mov dword [ecx], eax
lea ecx, [ebp - 0xa4]
call fcn.00460770
test al, al
je 0x4076be
push ecx
mov eax, esp
lea ecx, [ebp - 0xa4]
mov dword [eax], str.GameHallSetting
call fcn.00460d10
test al, al
je 0x4076be
push ecx
mov eax, esp
lea ecx, [ebp - 0xa4]
mov dword [eax], str.OpenLastGame
call fcn.00460de0
test al, al
jne 0x4075ea
push 0x4000
push 0
push str.OpenLastGame
lea ecx, [ebp - 0xa4]
call fcn.00463af0
mov esi, dword [ebp - 0x70]
test esi, esi
je 0x407621
cmp dword [ebp - 0x60], 1
jne 0x407621
mov ecx, dword [ebp - 0x6c]
xor eax, eax
test ecx, ecx
mov dword [ebp - 0x74], esi
mov esi, ecx
mov dword [ebp - 0x6c], 0
setne al
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x60], eax
push 0
lea eax, [ebp - 0x44]
push 0x49a840
push eax
call fcn.00459e00
add esp, 0xc
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0xa4]
push 0
push eax
push str.enable
push esi
call fcn.00462890
mov edi, dword [ebp - 0x74]
test edi, edi
je 0x40768d
mov eax, dword [ebp - 0x48]
mov edx, edi
mov esi, dword [ebp - 0x70]
sar edx, 0x10
movzx ecx, di
mov eax, dword [eax]
shl ecx, 5
mov eax, dword [eax + edx*4]
mov eax, dword [eax + ecx + 0x10]
mov dword [ebp - 0x74], eax
xor eax, eax
test edi, edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], esi
setne al
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x60], eax
test byte [ebp - 0x54], 0x30
je 0x40769a
xor al, al
movzx esi, al
jmp 0x4076c0
push ecx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xa8]
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0xa4]
call fcn.00460a80
add esp, 0xc
movzx esi, al
jmp 0x4076c0
xor esi, esi
lea ecx, [ebp - 0xa4]
call fcn.00460530
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xa8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4076ed
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
Function at 0x40bb50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489a10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4b0070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00467c71
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00466be6
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea edi, [eax + 0x14]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x20], ecx
mov dword [ebx], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3e], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x4b38e4]
mov dword [eax], 0
mov eax, dword [0x4b38e0]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f1f0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4b0070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.00469580
xor edi, edi
add esp, 0xc
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], edi
lea eax, [ebp - 0x220]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push str.SOFTWARE43994399GameHall
push SysReAllocString
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f2e5
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x230], edi
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], 0x208
push eax
push 0
push str.AppPath
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f2e5
mov eax, dword [ebp - 0x224]
cmp eax, 1
je 0x40f2c7
cmp eax, 2
jne 0x40f2e5
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x40f300
test cl, 1
jne 0x40f2e5
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x21e], 0
je 0x40f309
push 0
push 0x1c
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40f336
xor esi, esi
jmp 0x40f371
xor eax, eax
mov word [ebp - 0x21c], ax
shr ecx, 1
je 0x40f2e5
lea edx, [ebp - 0x21c]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40f316
sub edx, esi
lea eax, [ebp - 0x21c]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00402220
jmp 0x40f36c
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f340
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00402220
push 0x13
push str.43994399GameHall_
mov ecx, ebx
call fcn.0040c610
mov esi, 1
test edi, edi
je 0x40f37c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
Function at 0x40f3a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4b0070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40f3e0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x40f400
mov ebx, 1
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x40f41b
mov ebx, 2
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x40f505
mov eax, dword [ebp - 0x11c]
cmp eax, 4
ja 0x40f445
mov ebx, 3
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x40f4a5
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x40f48f
sub eax, 1
je 0x40f479
sub eax, 1
jne 0x40f505
mov ebx, 6
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
mov ebx, 5
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
mov ebx, 4
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x40f505
mov eax, dword [ebp - 0x118]
sub eax, 0
je 0x40f4f9
sub eax, 1
je 0x40f4dc
sub eax, 1
jne 0x40f505
xor ebx, ebx
cmp byte [ebp - 6], 1
sete bl
add ebx, 0xa
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp byte [ebp - 6], 1
sete bl
add ebx, 8
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046780a
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp byte [ebp - 6], 1
setne bl
add ebx, 7
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0046780a
mov esp, ebp
pop ebp
ret
Function at 0x40fb00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x489e30
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4b0070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x32c]
mov dword [esi], vtable.CInstallLogic.0
test eax, eax
je 0x40fb50
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x32c], 0
push str.4399ExtraceTool.exe
lea edx, [esi + 0x328]
lea ecx, [ebp - 0x10]
call fcn.0040ad50
add esp, 4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x10]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fb8b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.4399InstallPacket.7z
lea edx, [esi + 0x328]
lea ecx, [ebp - 0x10]
call fcn.0040ad50
add esp, 4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40fbc3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esi + 0x328]
sub edx, 0x10
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x40fbde
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test byte [ebp + 8], 1
je 0x40fbf2
push 0x340
push esi
call fcn.00467ca1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4178a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a710
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4b0070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00467c71
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00466be6
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret