joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019ee75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x101a5718], 0x1dce
mov dword [ebp - 0x10], eax
call fcn.1019fd9e
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1019eebb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101a5714], 0x18ed
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1019efe1
jmp 0x1019ef1c
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x101a5718], 0x1dce
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
jmp 0x1019ef30
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], eax
jmp 0x1019eef6
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x1019ef81
mov eax, dword [ebp - 0x4c]
add eax, 1
mov cl, byte [ebp - 0x4d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4e]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x48], eax
jne 0x1019ef30
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x1019efb4
jmp 0x1019ef8a
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x2c]
cmp edx, esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], eax
jb 0x1019eef6
jmp 0x1019efe1
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov dword [0x101a5714], 0x1941
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101a5718], 0x92b
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019f2fc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1019f347
mov dword [0x101a5714], 0x636
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1019f3a8
jmp 0x1019f400
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x1019f38a
jmp 0x1019f373
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1019f3d2
jmp 0x1019f400
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jl 0x1019f347
mov eax, dword [ebp - 0x20]
mov dword [0x101a5718], 0x258e
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x1019f329
jmp 0x1019f400
mov dword [0x101a5714], 0x3d46
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1019f400
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1019f35f
jmp 0x1019f400
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1019f400
mov eax, 0x18d0
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
je 0x1019f40f
mov eax, 0x1088
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1019f40f
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x101a5714], ecx
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x1019f5d7
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101a5720], 0
mov byte [0x101a5724], 0
mov edi, dword [0x101a5714]
add edi, 0xfffff8e9
mov dword [0x101a5718], edi
mov dword [0x101a571c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1019f637
xor eax, eax
mov dword [0x101a571c], 0
mov dword [ebp - 0x20], eax
jmp 0x1019f673
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov dword [0x101a5714], 0x7c1
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101a5718], 0x17ea
mov eax, dword [0x101a571c]
add eax, 1
mov dword [0x101a571c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1019f637
jmp 0x1019f626
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101a5728], 0
mov edi, dword [0x101a5720]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101a5728], esi
mov dword [0x101a5714], 0xa1b
mov eax, esi
cdq
idiv ecx
mov dword [0x101a5720], edx
mov dword [0x101a5718], 0xd32
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101a5724], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101a5724]
mov esi, dword [0x101a5720]
mov byte [ebx + esi], cl
mov esi, dword [0x101a571c]
add esi, 1
mov dword [0x101a571c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1019f673
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019fad2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101a5718], 0x1e49
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1019fb3c
lea eax, [ebp - 0x24]
mov dword [0x101a5718], 0x1a22
mov ecx, dword [0x101a5714]
add ecx, 0xffffefe3
mov dword [0x101a5714], ecx
mov dword [ebp - 0x34], eax
call fcn.1019efec
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1019ec02
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1019fc10
jmp 0x1019fb68
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101a12cc]
mov dh, byte [eax + 0x101a129d]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
je 0x1019faf6
jmp 0x1019fb3c
mov eax, dword [ebp - 0x38]
mov dword [0x101a5714], 0x2091
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1019f42c
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101a5714], 0x1f7a
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x50], ecx
mov dword [0x101a5718], 0x8aa
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x2c], ecx
add ecx, 0x1388
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1019fc07
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret

Function at 0x1019ff1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x1e25
xor ebx, ebx
mov dword [0x101a571c], 0
mov dword [0x101a5720], 0
mov dword [0x101a572c], 0
mov dword [0x101a5714], 0xfa3
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x101a00ad
jmp 0x1019ffa0
Function at 0x101a00bd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov edx, dword [0x101a5714]
mov esi, edx
add esi, 0xffffdde0
mov dword [0x101a5718], esi
add edx, 0xffffe928
mov dword [0x101a5714], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1019f7e6
lea ecx, [0x1019f570]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x8c], 0x16ea00
mov edx, dword [0x101a5700]
mov dword [esp + 0x34], edx
mov edx, dword [0x101a5704]
mov dword [esp + 0x70], edx
mov edx, dword [0x101a5708]
mov dword [esp + 0x40], edx
mov edx, dword [0x101a570c]
mov dword [esp + 0x84], edx
mov dword [0x101a5714], 0x5bd
mov edx, dword [0x101a5710]
mov dword [esp + 0x60], edx
mov dword [0x101a5718], 0xfffff4b2
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x101a01be
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x101a01cf
jmp 0x101a01ac
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1019fad2
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
jmp 0x101a01ff
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x101a016a
jmp 0x101a01ac
mov eax, dword [esp + 0x10]
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x58], edx
mov dword [0x101a5714], 0xe1c
call fcn.1019f2fc
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x101a0180
mov eax, dword [esp + 8]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x40fe70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x4921d0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x62c], ecx
mov eax, dword [ebp - 0x62c]
cmp dword [eax + 0xc8], 0xffffffff
je 0x40fe9e
xor al, al
jmp 0x40ffe9
mov cx, word [0x4779a8]
mov word [ebp - 0x210], cx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov ax, word [0x4779ac]
mov word [ebp - 0x418], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x210]
push ecx
push str._sDownLoad
push 0x104
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jbe 0x40ff4d
mov ecx, dword [ebp - 0x420]
mov edx, dword [ebp + 8]
movzx eax, word [edx + ecx*2]
cmp eax, 0x2f
je 0x40ff4d
mov ecx, dword [ebp - 0x420]
sub ecx, 1
mov dword [ebp - 0x420], ecx
jmp 0x40ff21
mov dx, word [0x4779c8]
mov word [ebp - 0x628], dx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x626]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x418]
push ecx
push str._s_s.WHD
push 0x104
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x14
push 0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push 0x1001
lea ecx, [ebp - 0x628]
push ecx
mov ecx, dword [ebp - 0x62c]
add ecx, 0xc4
mov edx, dword [ebp - 0x62c]
mov eax, dword [edx + 0xc4]
call dword [eax + 0x28]
test eax, eax
jne 0x40ffe7
xor al, al
jmp 0x40ffe9
mov al, 1
mov ecx, dword [ebp - 4]
call fcn.0046c78d
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x433e40
Capabilities:
Enumerate processes
Get file system object information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
mov eax, dword [0x4921d0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x514], ecx
push str.Game5378.exe
lea ecx, [ebp - 0x4f8]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
mov dword [ebp - 0x4fc], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0
jne 0x433eab
mov dword [ebp - 0x50c], 0
lea ecx, [ebp - 0x4f8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov eax, dword [ebp - 0x50c]
jmp 0x433fb1
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x504]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0
je 0x433f88
push 0x2b4
push 0
lea edx, [ebp - 0x4f0]
push edx
call sub.MSVCR71.dll_memset
add esp, 0xc
push 0x101
push 0x2b4
lea eax, [ebp - 0x4f0]
push eax
push 0
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp - 0x4f8]
call dword [sym.imp.MFC71U.DLL_CWinThread::CommonConstruct]
test eax, eax
jne 0x433f6a
mov eax, dword [ebp - 0x230]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x500], eax
lea ecx, [ebp - 0x4f4]
push ecx
mov edx, dword [ebp - 0x500]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x4f4]
push eax
mov ecx, dword [ebp - 0x500]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x504]
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x508], eax
jmp 0x433ece
mov ecx, dword [ebp - 0x504]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x510], 1
lea ecx, [ebp - 0x4f8]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov eax, dword [ebp - 0x510]
mov ecx, dword [ebp - 4]
call fcn.0046c78d
mov esp, ebp
pop ebp
ret
Function at 0x434ab0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4921d0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x41c], ecx
mov ax, word [0x47e628]
mov word [ebp - 0x418], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.ServiceCore.dll_public:_static_bool___cdecl_CWHService::GetWorkDirectory_wchar_t__const__unsigned_short_int_]
add esp, 8
mov dx, word [0x47e62c]
mov word [ebp - 0x210], dx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x418]
push eax
push str._sLobbyUrl.ini
push 0x208
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
push 0x208
mov eax, dword [ebp - 0x41c]
add eax, 0xc
push eax
push 0x47e650
push str.Home
push 0x47e660
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
push 0x208
mov edx, dword [ebp - 0x41c]
add edx, 0x214
push edx
push 0x47e668
push str.Logon
push 0x47e678
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
push 0x208
mov ecx, dword [ebp - 0x41c]
add ecx, 0x41c
push ecx
push 0x47e680
push str.FindPassword
push 0x47e6a0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x210]
push edx
push 0x208
mov eax, dword [ebp - 0x41c]
add eax, 0x624
push eax
push 0x47e6a8
push 0x47e6ac
push 0x47e6b4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
push 0x208
mov edx, dword [ebp - 0x41c]
add edx, 0x82c
push edx
push 0x47e6bc
push str.TranRecord
push 0x47e6d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
push 0x208
mov ecx, dword [ebp - 0x41c]
add ecx, 0xa34
push ecx
push 0x47e6e0
push str.Activity
push 0x47e6f8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x210]
push edx
push 0x208
mov eax, dword [ebp - 0x41c]
add eax, 0xc3c
push eax
push 0x47e700
push str.Help
push 0x47e710
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
push 0x208
mov edx, dword [ebp - 0x41c]
add edx, 0xe44
push edx
push 0x47e718
push str.Plaza
push 0x47e728
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x210]
push eax
push 0x208
mov ecx, dword [ebp - 0x41c]
add ecx, 0x104c
push ecx
push 0x47e730
push str.Announcement
push 0x47e750
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 4]
call fcn.0046c78d
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4362a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4362c8
xor al, al
jmp 0x436315
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4362e3
xor al, al
jmp 0x436315
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x436305
xor al, al
jmp 0x436315
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00436320
mov esp, ebp
pop ebp
ret 0xc
Function at 0x441400
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4921d0]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
call fcn.00436950
test eax, eax
jne 0x441424
xor eax, eax
jmp 0x4414d3
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x44143b
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x4414d3
call dword [sym.imp.PlatformData.dll_public:_static_class_CGlobalUserInfo____cdecl_CGlobalUserInfo::GetInstance_void_]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.PlatformData.dll_public:_struct_tagGlobalUserData____thiscall_CGlobalUserInfo::GetGlobalUserData_void_]
mov dword [ebp - 4], eax
push 0x20
push 0
lea eax, [ebp - 0x30]
push eax
call sub.MSVCR71.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
push 0x47f57c
push 0x20
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.MSVCR71.dll__snprintf]
add esp, 0x10
push 0x20
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x441498
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
jmp 0x4414d3
push 0x20
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call dword [sym.imp.MSVCR71.dll_strncpy]
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
mov ecx, dword [ebp - 0x10]
call fcn.0046c78d
mov esp, ebp
pop ebp
ret
Function at 0x442580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4921d0]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x6c], ecx
mov word [ebp - 0x48], 0
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x46]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4425b7
mov dword [ebp - 0x70], str.BUGLE_EX
jmp 0x4425be
mov dword [ebp - 0x70], str.BUGLE
mov ecx, dword [ebp - 0x70]
push ecx
push 0x47f6fc
push 0x20
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x10
call dword [sym.imp.PlatformData.dll_public:_static_class_CParameterGlobal____cdecl_CParameterGlobal::GetInstance_void_]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax + 0x1a]
test ecx, ecx
je 0x442692
call fcn.00401160
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x4d], 0
call dword [sym.imp.GameEngine.dll_public:_static_class_CD3DSound____cdecl_CD3DSound::GetInstance_void_]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x442624
push 0
push 0x47f704
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x58]
call dword [sym.imp.GameEngine.dll_public:_bool___thiscall_CD3DSound::PlaySoundW_struct_HINSTANCE_____wchar_t_const___wchar_t_const___bool_]
mov byte [ebp - 0x4d], al
movzx ecx, byte [ebp - 0x4d]
test ecx, ecx
jne 0x442692
push 0x47f710
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x442692
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
je 0x442688
mov eax, dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x68], eax
push 7
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x68]
push edx
call dword [sym.imp.WINMM.dll_PlaySoundW]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
push eax
call fcn.00435030
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 4]
call fcn.0046c78d
pop edi
mov esp, ebp
pop ebp
ret 4