joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push edi
push 0x30
call fcn.004031f6
add esp, 4
test eax, eax
je 0x40102d
mov ecx, eax
call fcn.00402f00
mov edi, eax
test edi, edi
je 0x40102d
mov ecx, edi
call fcn.00403090
test eax, eax
jne 0x401034
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, edi
push ebx
mov dword [0x41c7f0], eax
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.00402ff0
push 0
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x18]
push eax
push 0
push 0x30
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x28], xmm0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
movups xmm0, xmmword [ebp - 0x38]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
psrldq xmm0, 4
movd esi, xmm0
mov dword [ebp - 4], eax
test esi, esi
jne 0x4010c3
test ebx, ebx
jne 0x4010c3
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
mov ecx, edi
mov dword [ebp - 8], esi
call fcn.00403110
mov ebx, dword [ebp - 0x10]
mov ecx, edi
sub ebx, eax
call fcn.004030e0
cmp esi, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
je 0x4010be
sub esi, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
cdq
xor eax, edx
sub eax, edx
sub esi, eax
jmp 0x4010c3
sub esi, eax
sub esi, 0x28
mov ecx, edi
call fcn.004030e0
add eax, esi
cmp eax, dword [ebp - 4]
jle 0x4010dd
mov ecx, edi
call fcn.004030e0
mov esi, dword [ebp - 4]
sub esi, eax
push 0
push dword [ebp + 8]
mov ecx, edi
push 0
push 0
call fcn.004030e0
push eax
mov ecx, edi
call fcn.00403110
push eax
push esi
push ebx
push 0x14080000
push str.TDScrollWheel
push str.WheelWnd
push 0x8000088
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, edi
mov esi, eax
call fcn.00402f90
push 0x30
push edi
call fcn.00403229
add esp, 8
test esi, esi
jne 0x401133
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push 0
push esi
call fcn.004011f0
add esp, 8
push 2
push esi
call dword [sym.imp.USER32.dll_RegisterTouchWindow]
push dword [ebp + 0xc]
mov dword [0x41c988], esi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
lea esi, [edi + 0xc]
push esi
push eax
push 0
push str.LastWinPosition
push dword [edi + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x403033
movups xmm0, xmmword [esi]
sub esp, 0x10
mov ecx, edi
mov eax, esp
movups xmmword [eax], xmm0
call fcn.00403170
movups xmm0, xmmword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
movups xmmword [eax], xmm0
mov esp, ebp
pop ebp
ret 4

Function at 0x403170
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
movups xmm0, xmmword [ebp + 8]
push 0x10
lea eax, [ecx + 0xc]
push eax
push 3
push 0
push str.LastWinPosition
push dword [ecx + 0x2c]
movups xmmword [eax], xmm0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
pop ebp
ret 0x10
Function at 0x4033f5
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x40341b
cmp al, 0x22
je 0x40342b
inc esi
mov al, byte [esi]
test al, al
jne 0x40340a
cmp al, 0x22
jne 0x40342c
jmp 0x40342b
cmp al, 0x20
jle 0x40342c
inc esi
cmp byte [esi], 0x20
jg 0x40341f
jmp 0x40342c
cmp al, 0x20
jg 0x403432
inc esi
mov al, byte [esi]
test al, al
jne 0x403427
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004034a0
push 0x406004
push section..data
call fcn.00403486
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403462
movzx eax, word [ebp - 0x14]
jmp 0x403465
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004034b8
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40368a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406010]
jne 0x403694
repz ret
jmp fcn.00403868

Function at 0x101aec0b
Capabilities:
Encode data using xor

Disassembly:
bts cx, 1
add edi, eax
btr bx, 1
btr ecx, esi
mov ebx, dword [edx + 0x20]
pushal
and cl, dl
neg cx
add ebx, eax
rol cx, 5
mov dword [ebp - 8], 0
pop ecx
bts ecx, 0x1b
mov ecx, dword [edx + 0x18]
pushfd
cmp ecx, dword [ebp - 8]
call fcn.100fcc71
cmc
cli
mov ss, word [esp + 0x58040220]
cmp edx, ebp
xlatb
lds edx, cs:[ebx + 0x6d]
inc ebp
push esi
cmp eax, 0xf10f1c2d
aas
and eax, 0xd1fc9f68
out dx, eax
sti
bound esi, qword [edi - 0x3e69f2ae]
xor byte [edi + 0x2f], dl
add ecx, eax
dec eax
mov byte [esi + 0x33], dl
push cs
fcompi st(6)
jnp 0x101aec29
cli
in al, 0x23
add byte [ecx], bh
nop
jge 0x101aec90
adc al, 0x3f
int3
push 0x73
in eax, 0xae
sbb dword [edx + 0x1cd7bd7a], edx
and eax, 0x3d4d8d9a
daa
xchg esi, eax
daa
sub byte [ecx], cl
aaa
pop es
ret
Function at 0x117e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x117e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x117e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x117e06a
add dl, dl
jne 0x117e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x117e0dc
xor eax, eax
add dl, dl
jne 0x117e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x117e17d
add dl, dl
jne 0x117e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x117e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x117e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x117e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x117e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x117e075
mov eax, 1
add dl, dl
jne 0x117e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x117e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x117e0e1
sub eax, ebx
mov ebx, 1
jne 0x117e128
mov ecx, 1
add dl, dl
jne 0x117e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x117e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x117e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x117e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x117e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x117e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x117e136
cmp eax, 0x7d00
jae 0x117e16d
cmp eax, 0x500
jb 0x117e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x117e075
cmp eax, 0x7f
ja 0x117e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x117e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x117e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x117e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403b00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x72c
mov eax, dword [0x6a7420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x728], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x724], ebx
push esi
mov esi, ecx
test eax, eax
jne 0x403b41
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00575b90
mov esp, ebp
pop ebp
ret 0x10
test ebx, ebx
je 0x403b2d
push eax
push 1
lea eax, [ebp - 0x71d]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
push 0x200
lea eax, [ebp - 0x604]
push 0
push eax
call sub.MSVCR120.dll_memset
lea edx, [esi + 0x10]
add esp, 0x1c
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403b75
push edi
sub ecx, esi
lea eax, [ebp - 0x604]
push ecx
push edx
push eax
call sub.MSVCR120.dll_memcpy
push 0x100
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x71c]
push eax
call fcn.00405280
xor esi, esi
add esp, 0x18
mov dword [ebp - 0x72c], esi
cmp dword [ebp + 0x10], esi
jle 0x403ceb
mov edi, ebx
jmp 0x403bc0
push dword [ebp - 0x728]
lea eax, [ebp - 0x404]
push 0x10
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
cmp eax, 0x10
jne 0x403d30
lea eax, [ebp - 0x404]
push eax
push eax
lea eax, [ebp - 0x71c]
push 0
push eax
call fcn.00404590
lea ecx, [esi + 0xf]
add esp, 0x10
lea edx, [ebp - 0x3f5]
xor eax, eax
add ecx, ebx
cmp edi, edx
ja 0x403c17
lea edx, [ebp - 0x404]
cmp ecx, edx
jae 0x403c6e
movdqu xmm0, xmmword [ebp - 0x404]
mov eax, 0x10
xorps xmm1, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm2, xmmword [edi]
paddb xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
paddb xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
paddb xmm2, xmm0
movd ecx, xmm2
add byte [ebp + 0x14], cl
xor bl, bl
xor dl, dl
cmp eax, 0x10
jge 0x403cd0
mov ecx, 0x10
sub ecx, eax
cmp ecx, 2
jl 0x403ca4
mov cl, byte [ebp + eax - 0x404]
mov byte [edi + eax], cl
add bl, cl
mov cl, byte [ebp + eax - 0x403]
mov byte [edi + eax + 1], cl
add dl, cl
add eax, 2
cmp eax, 0xf
jl 0x403c83
cmp eax, 0x10
jge 0x403cc6
mov cl, byte [ebp + eax - 0x404]
add eax, dword [ebp - 0x724]
mov esi, dword [ebp - 0x72c]
mov byte [eax + esi], cl
mov eax, dword [ebp + 0x14]
add al, cl
jmp 0x403cc9
mov eax, dword [ebp + 0x14]
add dl, bl
add al, dl
mov dword [ebp + 0x14], eax
mov ebx, dword [ebp - 0x724]
add esi, 0x10
add edi, 0x10
mov dword [ebp - 0x72c], esi
cmp esi, dword [ebp + 0x10]
jl 0x403bc0
push dword [ebp - 0x728]
lea eax, [ebp - 0x71e]
push 1
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
mov al, byte [ebp - 0x71d]
add esp, 0x10
cmp al, byte [ebp - 0x71e]
jne 0x403d30
cmp al, byte [ebp + 0x14]
jne 0x403d30
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00575b90
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00575b90
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405020
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x6a7420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
lea ecx, [ecx]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, 0xff
cmp esi, 0x100
jl 0x405040
mov esi, 1
mov edx, 0x6aec70
lea esp, [esp]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, 0xff
cmp edx, 0x6aec98
jl 0x405080
mov eax, 1
mov byte [0x6aca70], 0x63
mov byte [0x6adbd3], 0
mov dword [ebp - 0x808], eax
mov edi, edi
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, 0xff
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, 0xff
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, 0xff
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebp - 0x808]
xor ecx, 0x63
and ecx, 0xff
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x6aca70], bl
mov byte [ebx + 0x6adb70], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x4050c0
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
lea esp, [esp]
movzx edx, byte [esi + 0x6aca70]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, 0xff
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x6adb70]
mov dword [esi*4 + 0x6acb70], eax
rol eax, 8
mov dword [esi*4 + 0x6acf70], eax
rol eax, 8
mov dword [esi*4 + 0x6ad370], eax
rol eax, 8
mov dword [esi*4 + 0x6ad770], eax
test ecx, ecx
je 0x405213
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x40521f
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x6adc70], eax
rol eax, 8
mov dword [esi*4 + 0x6ae070], eax
rol eax, 8
mov dword [esi*4 + 0x6ae470], eax
rol eax, 8
mov dword [esi*4 + 0x6ae870], eax
inc esi
cmp esi, 0x100
jl 0x405150
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00575b90
mov esp, ebp
pop ebp
ret
Function at 0x405280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6a7420]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, ecx
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub eax, 0x80
je 0x4052c4
sub eax, 0x40
je 0x4052bc
sub eax, 0x40
jne 0x405470
mov dword [edi], 0xe
jmp 0x4052ca
mov dword [edi], 0xc
jmp 0x4052ca
mov dword [edi], 0xa
push esi
push ecx
push edx
lea eax, [ebp - 0x11c]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.00405480
mov eax, dword [ebp - 0x11c]
add esp, 0xc
shl eax, 4
add eax, dword [ebp - 0x118]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0xc]
sub eax, 0x10
mov dword [esi + 0xc], ecx
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x405459
jmp 0x405320
movzx ecx, byte [eax + 3]
dec edi
movzx edx, byte [ecx + 0x6aca70]
movzx ecx, byte [eax + 2]
mov edx, dword [edx*4 + 0x6ae870]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae470]
movzx ecx, byte [eax + 1]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae070]
movzx ecx, byte [eax]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6adc70]
mov dword [esi], edx
movzx ecx, byte [eax + 4]
movzx edx, byte [ecx + 0x6aca70]
movzx ecx, byte [eax + 7]
mov edx, dword [edx*4 + 0x6adc70]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae870]
movzx ecx, byte [eax + 6]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae470]
movzx ecx, byte [eax + 5]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae070]
mov dword [esi + 4], edx
movzx ecx, byte [eax + 8]
movzx edx, byte [ecx + 0x6aca70]
movzx ecx, byte [eax + 0xb]
mov edx, dword [edx*4 + 0x6adc70]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae870]
movzx ecx, byte [eax + 0xa]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae470]
movzx ecx, byte [eax + 9]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae070]
mov dword [esi + 8], edx
movzx ecx, byte [eax + 0xc]
movzx edx, byte [ecx + 0x6aca70]
movzx ecx, byte [eax + 0xf]
mov edx, dword [edx*4 + 0x6adc70]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae870]
movzx ecx, byte [eax + 0xe]
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae470]
movzx ecx, byte [eax + 0xd]
sub eax, 0x10
movzx ecx, byte [ecx + 0x6aca70]
xor edx, dword [ecx*4 + 0x6ae070]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x405320
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00575b90
mov esp, ebp
pop ebp
ret
Function at 0x406690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576c78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6a7420]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x4067bd
cmp byte [edi + 0x45], 0
je 0x4067bd
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4066e4
xor al, al
jmp 0x4067bf
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x48]
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmp ebx, 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
push esi
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x406751
dec eax
je 0x406755
sub eax, 2
je 0x4067a6
xor bl, bl
jmp 0x4067a8
mov byte [edi + 0x45], 0
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp ebx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, ecx
sub esi, eax
je 0x406788
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x40674d
cmp byte [edi + 0x45], 0
je 0x4067a6
test esi, esi
lea esi, [edi + 0x48]
jne 0x406717
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00406870
jmp 0x406714
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x4067b9
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
jmp 0x4067bf
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00575b90
mov esp, ebp
pop ebp
ret
Function at 0x408be0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x69cb10
push esi
push edi
push ebx
call fcn.00421fc0
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x20
mov dword [0x6b0374], ebx
call edi
shl eax, 2
push 0x21
mov dword [ebp - 4], eax
call edi
mov ebx, eax
push 4
shl ebx, 2
call edi
movdqu xmm0, xmmword [0x6eaf50]
mov ecx, dword [0x6eaf60]
add ebx, eax
push 0
movdqu xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x18], ecx
call edi
movdqu xmm1, xmmword [ebp - 0x14]
mov edx, dword [ebp - 4]
xor esi, esi
push esi
push dword [ebp + 8]
movdqa xmm0, xmm1
psrldq xmm1, 8
psrldq xmm0, 4
movd ecx, xmm0
push esi
push esi
cmp eax, ecx
movd eax, xmm1
cmove edx, esi
add eax, ebx
push eax
lea eax, [ecx + edx]
push eax
push esi
push 0x80000000
push 0xca0000
push 0x6b0580
push 0x6b0780
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6b0378], esi
test esi, esi
jne 0x408c97
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x5b15c4
call fcn.0040a960
push 0
push 0
push 2
mov ecx, 0x5b15c4
call fcn.0040b050
mov eax, dword [0x6ec734]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push dword [0x69e8b8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x114]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408d00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6a7420]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x69cd90
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.00444000
mov ecx, 0x69cd90
mov dword [ebp - 0xc], eax
call fcn.00444010
cmp byte [ebp + 0x14], 0
mov dword [ebp - 8], eax
jne 0x408d6f
push 0x20000
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
push eax
push 0
push 0
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
jmp 0x408dab
push 0xca0000
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0xca0000
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push 0
push 0
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push dword [ebp + 0x10]
mov ecx, 0x6d1368
push dword [ebp + 0xc]
call fcn.0051e110
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [0x6ec734]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xf8]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.00575b90
mov esp, ebp
pop ebp
ret
Function at 0x4092a0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x6b0a40]
sub esp, 0x1c
mov dword [0x6b09d8], 0x398
mov byte [0x6b0992], 1
mov dword [0x6b09c0], 0
test al, 1
jne 0x4092e9
or eax, 1
mov ecx, 0x6b09f0
mov dword [0x6b0a40], eax
call fcn.00570a50
push 0x582970
call fcn.00575b7b
add esp, 4
mov ecx, 0x6b09f0
call fcn.00572780
call fcn.00408b10
push str.._Log_Debug.txt
mov dword [0x6b09b8], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x585bcc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x6d1368
call fcn.00518920
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x6eafee
push str._s__PID__d_
push 0x6b0580
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp dword [0x6b09b8], 0
je 0x40936d
mov ecx, 0x6b0580
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x409352
mov ax, word [0x585bdc]
mov word [ecx], ax
mov al, byte [0x585bde]
mov byte [ecx + 2], al
xor ecx, ecx
nop
mov al, byte [ecx + 0x6b0580]
lea ecx, [ecx + 1]
mov byte [ecx + 0x6b077f], al
test al, al
jne 0x409370
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00408e80
add esp, 4
mov ecx, 0x6ce7a8
push str.._Resource_QuestScript_QuestString.bin
call fcn.004ef5e0
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6ce7a8
call fcn.004ef4a0
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6ce7a8
call fcn.004ef2b0
mov ecx, 0x6c1cf8
call fcn.00439440
push dword [ebp + 0x14]
push esi
call fcn.00408be0
add esp, 8
test eax, eax
jne 0x4093fa
mov eax, dword [0x6b0370]
test eax, eax
je 0x4093f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6b0370], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, edi
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call esi
test eax, eax
je 0x409430
lea eax, [ebp - 0x1c]
push eax
call edi
lea eax, [ebp - 0x1c]
push eax
call ebx
jmp 0x409410
mov eax, dword [0x6b1650]
test al, 1
jne 0x409458
or eax, 1
mov ecx, 0x6b0a48
mov dword [0x6b1650], eax
call fcn.004c2600
push 0x582980
call fcn.00575b7b
add esp, 4
mov ecx, 0x6b0a48
call fcn.004c2690
fld1
mov ecx, 0x5b15c4
fsubp st(1)
fstp qword [0x6b09e0]
call fcn.0040abe0
cmp eax, 0xffffffff
jne 0x409410
mov eax, dword [0x6b0370]
pop edi
pop ebx
test eax, eax
je 0x409497
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6b0370], 0
mov eax, dword [ebp - 0x14]
pop esi
mov esp, ebp
pop ebp
ret 0x10