joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fae0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4c848c
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x450], eax
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x460]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x25e]
push ecx
mov esi, edx
mov word [esp + 0x260], ax
call fcn.004a7380
add esp, 0xc
call fcn.0042e800
push 0
lea edx, [esp + 0x258]
test al, al
je 0x42fbe5
push 0x35
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x42fb84
mov ecx, edi
call fcn.0042c990
push 0x4f2b24
push 0x4f0ffc
mov edx, eax
call fcn.00430eb0
add esp, 8
xor al, al
jmp 0x42fcc1
lea ecx, [esp + 0x130]
call fcn.00430920
lea eax, [esp + 0x254]
lea edx, [esp + 0x130]
call fcn.00430b00
push esi
lea ecx, [esp + 0x134]
mov dword [esp + 0x46c], 1
call fcn.0042b500
cmp byte [esp + 0x24c], 0
mov edi, vtable.t_str.0
mov dword [esp + 0x130], edi
jne 0x42fc55
mov eax, dword [esp + 0x138]
lea ecx, [esp + 0x13c]
jmp 0x42fc48
push 0x23
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42fb62
lea ecx, [esp + 0xc]
call fcn.00430920
lea eax, [esp + 0x254]
lea edx, [esp + 0xc]
call fcn.00430b00
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x42fc23
mov eax, dword [esp + 0x14]
add eax, 4
mov edx, esi
call fcn.00430b00
cmp byte [esp + 0x128], 0
mov edi, vtable.t_str.0
mov dword [esp + 0xc], edi
jne 0x42fc55
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x42fc55
push eax
call fcn.004a4a7f
add esp, 4
lea ecx, [esp + 0xc]
call fcn.00430920
mov eax, str.SogouInputUSBDTUSBDT.dll
lea edx, [esp + 0xc]
call fcn.00430b00
cmp byte [esp + 0x128], 0
lea eax, [esp + 0x18]
jne 0x42fc7e
mov eax, dword [esp + 0x14]
cmp word [eax + 4], 0x2e
jne 0x42fc90
lea ecx, [esp + 0xc]
call fcn.0042ac20
jmp 0x42fc9c
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.00429f70
cmp byte [esp + 0x128], 0
mov dword [esp + 0xc], edi
jne 0x42fcbf
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x42fcbf
push eax
call fcn.004a4a7f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x460]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.004a4a25
add esp, 0x460
ret
Function at 0x4307d0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x430806
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.004a4b5c
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x430864
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x4f0024
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x430864
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
movzx edx, word [eax + 8]
mov word [edi], cx
movzx ecx, word [eax + 0xe]
mov word [edi + 2], dx
movzx edx, word [eax + 0xc]
mov word [edi + 4], cx
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x430871
push esi
call fcn.004a4a7f
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x431db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x431edb
test ebx, ebx
je 0x431e87
cmp word [ebx], 0
je 0x431e87
cmp byte [esi + 0x128], 0
je 0x431e19
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x431e20
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.0042c990
mov esi, eax
call fcn.0042cad0
mov ecx, ebp
call fcn.0042c990
mov esi, eax
push 0x4f2cfc
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
push 0x4f0024
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
push ebx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x431e96
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.0042c990
mov esi, eax
call fcn.0042cad0
mov ecx, ebp
call fcn.0042c990
mov esi, eax
push 0x4f2cfc
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add ebx, 4
push ebx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x431fbc
test ebx, ebx
je 0x431f74
cmp word [ebx], 0
je 0x431f74
cmp byte [esi + 0x128], 0
je 0x431f09
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x431f10
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov ecx, ebp
call fcn.0042c990
xor edi, edi
mov esi, eax
call fcn.0042cad0
mov ecx, ebp
call fcn.0042c990
mov esi, eax
push 0x4f2d0c
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
mov ecx, dword [esp + 0x28]
add ecx, 4
add esp, 8
push ecx
mov ecx, esi
call fcn.0042cc20
mov esi, eax
push 0x4f0024
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add esp, 8
push ebx
mov ecx, esi
call fcn.0042cc20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
je 0x431f82
add esi, 0x18
jmp 0x431f85
mov esi, dword [esi + 0x14]
mov ecx, ebp
call fcn.0042c990
mov edi, eax
push 0x4f2d0c
push 0x4f0ffc
mov edx, edi
call fcn.00430eb0
add esi, 4
push esi
push 0x4f0ffc
mov edx, edi
call fcn.00430eb0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov al, 1
pop ebx
pop ecx
ret 0x10
Function at 0x431fd0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x4320ef
test ebx, ebx
je 0x43209c
cmp word [ebx], 0
je 0x43209c
cmp byte [esi + 0x128], 0
je 0x43201e
add esi, 0x18
mov dword [esp + 0x1c], esi
jmp 0x432025
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, ebp
call fcn.0042c990
mov esi, eax
call fcn.0042cad0
mov ecx, ebp
call fcn.0042c990
mov esi, eax
push 0x4f2d24
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
mov edx, dword [esp + 0x24]
add edx, 4
push edx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
push 0x4f2d3c
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
push ebx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
push 0x4f2d44
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add esp, 0x28
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x4320ab
mov ebx, dword [esi + 0x14]
mov ecx, ebp
call fcn.0042c990
mov esi, eax
call fcn.0042cad0
mov ecx, ebp
call fcn.0042c990
mov esi, eax
push 0x4f2d24
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add ebx, 4
push ebx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc

Function at 0x432280
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
mov ebx, ecx
mov ecx, 0x401
lea esi, [edi + 8]
mov dword [edi + 0x120], ecx
call fcn.00431260
cmp byte [esi + 0x114], 0
je 0x4322ad
add esi, 4
jmp 0x4322af
mov esi, dword [esi]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 4]
push 0x3ff
add esi, 4
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
call fcn.00430d10
test esi, esi
je 0x432330
mov ecx, edi
call fcn.00429940
cmp byte [ebx + 0x128], 0
je 0x4322e7
add ebx, 0x18
jmp 0x4322ea
mov ebx, dword [ebx + 0x14]
mov ecx, ebp
call fcn.0042c990
mov edi, esi
mov esi, eax
call fcn.0042cad0
mov ecx, ebp
call fcn.0042c990
mov esi, eax
push 0x4f2d7c
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add ebx, 4
push ebx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x432340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
mov ebx, ecx
mov ecx, 0x401
lea esi, [edi + 8]
mov dword [edi + 0x120], ecx
call fcn.00431260
cmp byte [esi + 0x114], 0
je 0x43236d
add esi, 4
jmp 0x43236f
mov esi, dword [esi]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push 0
push 0
push eax
mov eax, dword [ebx + 4]
push 0
lea ecx, [esp + 0x24]
push ecx
add esi, 4
push esi
push edx
push eax
mov dword [esp + 0x34], 0x3ff
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
call fcn.00430d10
test esi, esi
je 0x432403
mov ecx, edi
call fcn.00429940
cmp byte [ebx + 0x128], 0
je 0x4323ba
add ebx, 0x18
jmp 0x4323bd
mov ebx, dword [ebx + 0x14]
mov ecx, ebp
call fcn.0042c990
mov edi, esi
mov esi, eax
call fcn.0042cad0
mov ecx, ebp
call fcn.0042c990
mov esi, eax
push 0x4f2d94
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add ebx, 4
push ebx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc

Function at 0x433800
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c9393
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fld dword [0x4fdd78]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0x11
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
fstp dword [esi + 0xc]
fld dword [0x4fdd7c]
mov ecx, esi
fstp dword [esi + 0x10]
fld dword [0x4fdd80]
fstp dword [esi + 0x14]
call fcn.00434e50
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x434470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cb210
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
xor eax, eax
mov byte [esp + 0xc], al
mov dword [esp + 8], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], fcn.004a4b5c
mov dword [esp + 0x24], fcn.004a50d2
mov dword [esp + 0x28], fcn.004a4a7f
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0x1fff8
mov dword [esp + 0x1c], vtable.t_heap.0
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0xc]
push ecx
lea ebx, [esp + 0x18]
mov byte [esp + 0x48], 1
call fcn.0043bc80
test al, al
jne 0x43454c
xor ebx, ebx
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x43451d
push eax
call fcn.004a4a7f
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.allocator_unsigned_char__class_TAllocDefault_.0
call fcn.00404a60
lea ecx, [esp + 8]
call fcn.0042c930
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x3c
ret 8
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.004349e0
xor ebx, ebx
mov byte [esp + 0x40], bl
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x43457e
push eax
call fcn.004a4a7f
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.allocator_unsigned_char__class_TAllocDefault_.0
call fcn.00404a60
lea ecx, [esp + 8]
call fcn.0042c930
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x3c
ret 8

Function at 0x435530
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.0043d740
Function at 0x4371d0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov esi, eax
mov eax, dword [edi + 0x130]
mov edx, dword [eax + 0x18]
lea ebx, [edi + 0x130]
push esi
push ebp
mov ecx, ebx
call edx
test al, al
jne 0x43721f
mov ecx, ebp
call fcn.0042c990
push 0x4f1274
push 0x4f0ffc
mov edx, eax
call fcn.00430eb0
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
push ebp
push ebx
call fcn.00435ff0
test al, al
je 0x4371f8
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
mov dword [edi + 0x34c], ebx
mov ebx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ebp
mov dword [edi + 8], ebx
call fcn.00436fd0
add esp, 0xc
test al, al
jne 0x4372ab
cmp byte [esi + 0x11c], al
je 0x43726f
add esi, 0xc
jmp 0x437272
mov esi, dword [esi + 8]
mov ecx, ebp
call fcn.0042c990
mov edi, eax
push 0x4f325c
push 0x4f0ffc
mov edx, edi
call fcn.00430eb0
add esi, 4
push esi
push 0x4f0ffc
mov edx, edi
call fcn.00430eb0
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0x80
push ebp
push 0
push eax
push ecx
mov ecx, esi
call fcn.00430e40
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 4], eax
mov ebx, 1
cmp eax, 0xffffffff
jne 0x437357
mov edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
cmp eax, 0x20
jne 0x43730b
cmp ebx, 3
jge 0x4373a5
cmp byte [edi + 0x350], 0
je 0x43732c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43732c
cmp eax, 5
jne 0x43736c
cmp ebx, 3
jge 0x4373a5
push 0x80
mov ecx, esi
call fcn.00430e40
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0x80
push ebp
push 0
push edx
push eax
mov ecx, esi
call fcn.00430e40
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
inc ebx
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x4372e0
push esi
lea ecx, [edi + 0xc]
call fcn.00429fd0
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
test eax, eax
jne 0x4373a5
cmp byte [esi + 0x11c], al
je 0x43737d
add esi, 0xc
jmp 0x437380
mov esi, dword [esi + 8]
mov ecx, dword [esp + 0x20]
add esi, 4
push esi
push 0x4f326c
call fcn.00401000
mov ecx, eax
call fcn.0042cc20
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp byte [esi + 0x11c], 0
lea ebx, [esi + 0xc]
jne 0x4373b4
mov ebx, dword [esi + 8]
mov ebp, dword [esp + 0x20]
mov ecx, ebp
call fcn.0042c990
mov edi, dword [esp + 0x24]
mov esi, eax
call fcn.0042cad0
mov ecx, ebp
call fcn.0042c990
add ebx, 4
push ebx
push 0x4f325c
mov ecx, eax
call fcn.0042cc20
mov ecx, eax
call fcn.0042cc20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
Function at 0x4374d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov ebx, eax
mov edi, ecx
mov esi, edx
call ebp
test edi, edi
jne 0x4374f9
test ebx, ebx
je 0x4374ef
mov dword [ebx], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43757f
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x43752a
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.0042c990
mov esi, eax
call fcn.0042cad0
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.0042c990
mov esi, eax
push 0x4f328c
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add ebx, 4
push ebx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x437589
mov dword [ebx], eax
test eax, eax
jne 0x4374ef
cmp byte [esi + 0x128], al
je 0x43759e
add esi, 0x18
jmp 0x4375a1
mov esi, dword [esi + 0x14]
mov ecx, dword [esp + 0x18]
call fcn.0042c990
mov edi, eax
push 0x4f329c
push 0x4f0ffc
mov edx, edi
call fcn.00430eb0
add esi, 4
push esi
push 0x4f0ffc
mov edx, edi
call fcn.00430eb0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x4375e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov edi, eax
mov esi, ecx
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43767d
push ebx
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x437628
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.0042c990
mov esi, eax
call fcn.0042cad0
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.0042c990
mov esi, eax
push 0x4f32bc
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add ebx, 4
push ebx
push 0x4f0ffc
mov edx, esi
call fcn.00430eb0
add esp, 0x10
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x437687
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 0xc
Function at 0x4381e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c6a98
mov eax, dword fs:[0]
push eax
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.item
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004a4b5c
mov dword [eax + 0x24], fcn.004a50d2
mov dword [eax + 0x28], fcn.004a4a7f
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configRuntimeFile::t_item_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x4382e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c6a98
mov eax, dword fs:[0]
push eax
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.item
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.004a4b5c
mov dword [eax + 0x24], fcn.004a50d2
mov dword [eax + 0x28], fcn.004a4a7f
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configGameFile::t_item_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8
Function at 0x439330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c9166
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x150]
mov dword fs:[0], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], vtable.t_reg.0
call fcn.00430920
xor ebx, ebx
mov eax, str.MACHINE
lea edx, [esp + 0x28]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00430b00
mov dword [esp + 0x158], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0xc], ebx
push 1
push ebx
push ebx
push 0x4eef0c
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x16c], 1
call fcn.00431bf0
lea ecx, [esp + 0xc]
test al, al
jne 0x439415
call fcn.0042c930
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], vtable.t_reg.0
cmp eax, ebx
je 0x4393e7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], vtable.t_str.0
cmp byte [esp + 0x144], bl
jne 0x439411
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x439411
push eax
call fcn.004a4a7f
add esp, 4
mov al, 1
jmp 0x43946d
push 4
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
mov eax, str.NoCheckSignature
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 4
call fcn.00431db0
lea ecx, [esp + 0xc]
test al, al
jne 0x439456
call fcn.0042c930
lea ecx, [esp + 0x1c]
call fcn.00431ba0
mov al, 1
jmp 0x43946d
cmp dword [esp + 0x14], ebx
sete bl
call fcn.0042c930
lea ecx, [esp + 0x1c]
call fcn.00431ba0
mov al, bl
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.004a4a25
add esp, 0x154
ret

Function at 0x43b510
Capabilities:
Set file attributes

Disassembly:
push ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x43b520
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push 1
push eax
mov eax, esi
call fcn.004371d0
test al, al
setne al
pop ecx
ret 8
Function at 0x43b6c0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4cb12b
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x35c], eax
push ebp
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x374]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x384]
lea esi, [esp + 0x14]
mov edi, ecx
call fcn.00437080
mov dword [esp + 0x14], vtable.t_fileWrite.0
mov dword [esp + method.t_fileWrite.1.virtual_0], vtable.t_fileWrite.1.0
xor esi, esi
mov dword [esp + 0x37c], esi
cmp byte [edi + 0x11c], 0
lea eax, [edi + 0xc]
jne 0x43b737
mov eax, dword [edi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push ebx
mov eax, edi
lea ecx, [esp + 0x1c]
call fcn.004371d0
test al, al
jne 0x43b783
mov dword [esp + 0x37c], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], vtable.t_fileWrite.0
mov dword [esp + method.t_byteStreamWrite.virtual_0], vtable.t_byteStreamWrite.0
call fcn.00437100
xor al, al
jmp 0x43b7f9
push 2
push 0x4f2df8
push ebx
lea ecx, [esp + 0x374]
call fcn.0043b550
test al, al
je 0x43b758
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 4]
push eax
push ecx
push ebx
lea ecx, [esp + 0x374]
call fcn.0043b550
test al, al
je 0x43b758
lea edi, [esp + 0x14]
call fcn.00437400
mov edx, dword [ebp + 4]
push edx
call fcn.004a4a7f
mov dword [esp + 0x380], 0xffffffff
add esp, 4
mov ecx, edi
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [esp + 0x14], vtable.t_fileWrite.0
mov dword [esp + method.t_byteStreamWrite.virtual_0], vtable.t_byteStreamWrite.0
call fcn.00437100
mov al, 1
mov ecx, dword [esp + 0x374]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x35c]
xor ecx, esp
call fcn.004a4a25
add esp, 0x370
ret 4