joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431550
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
push esi
lea ecx, [esp + 8]
push eax
push ecx
call fcn.00430040
mov edx, dword [0x47106c]
mov eax, dword [eax]
add esp, 8
push edx
push 0
push eax
push str.Tips
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42u.DLL_CString::CString
mov eax, esi
pop esi
ret

Function at 0x431590
Capabilities:
Enumerate process modules

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x453e43
push eax
mov eax, 0x2210
mov dword fs:[0], esp
call fcn.0044d980
push ebp
push esi
push edi
xor esi, esi
lea ecx, [esp + 0x222c]
mov dword [esp + 0x2224], esi
xor ebp, ebp
call sub.MFC42u.DLL_CString::MakeLower
mov eax, dword [0x4710ac]
cmp eax, esi
je 0x431690
lea ecx, [esp + 0x10]
lea edx, [esp + 0x21c]
push ecx
push 0x2000
push edx
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x431690
cmp dword [esp + 0x10], esi
jbe 0x431690
lea edi, [esp + 0x21c]
mov ecx, dword [edi]
mov edx, dword [0x4710ac]
lea eax, [esp + 0x14]
push 0x104
push eax
push ecx
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x43166a
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 0xc]
mov byte [esp + 0x2224], 1
call sub.MFC42u.DLL_CString::MakeLower
mov ecx, dword [esp + 0x222c]
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
jg 0x431678
lea ecx, [esp + 0xc]
mov byte [esp + 0x2224], 0
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x10]
inc esi
add edi, 4
cmp esi, eax
jb 0x431607
jmp 0x431690
mov ebp, dword [esp + esi*4 + 0x21c]
lea ecx, [esp + 0xc]
mov byte [esp + 0x2224], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x222c]
mov dword [esp + 0x2224], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x221c]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x221c
ret

Function at 0x4317c0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x47053c
mov eax, edx
mov esi, 8
test al, 1
je 0x4317dc
shr eax, 1
xor eax, 0xedb88320
jmp 0x4317de
shr eax, 1
dec esi
jne 0x4317cf
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x47093c
jl 0x4317c8
pop esi
ret

Function at 0x431800
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x431837
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x47053c]
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x431815
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x4318a0
Capabilities:
Allocate or change rwx memory
Create thread
Inject pe
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push str.mb.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
mov dword [esp + 0x20], esi
jne 0x4318c4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push str.DoMana
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x4318e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
lea eax, [esp + 0x24]
push 0xc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleInformation
mov ecx, dword [esp + 0x28]
push 4
push 0x1000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ebx, eax
mov edx, ecx
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00431840
mov ecx, dword [0x4710ac]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x28]
push 0x40
push 0x1000
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [esp + 0x14], eax
mov edi, eax
mov eax, dword [esp + 0x24]
mov ecx, esi
sub edi, eax
mov ebp, dword [ecx]
mov eax, dword [ecx + 4]
mov esi, 8
mov dword [esp + 0x10], eax
add ecx, esi
cmp eax, esi
jbe 0x43199d
mov ax, word [ecx]
add ecx, 2
and eax, 0xffff
add esi, 2
mov edx, eax
and edx, 0xfffff000
je 0x431995
cmp edx, 0x3000
jne 0x4319a3
and eax, 0xfff
add eax, ebp
add eax, ebx
add dword [eax], edi
mov eax, dword [esp + 0x10]
cmp esi, eax
jb 0x43196a
test eax, eax
je 0x4319b0
jmp 0x431956
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
mov edx, dword [0x4710ac]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
mov ecx, dword [0x4710ac]
push eax
mov eax, dword [esp + 0x18]
sub eax, esi
push 0x4000000
add eax, edx
push 0
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x431c20
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x47107c]
sub esp, 0x50
test eax, eax
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcsstr]
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextW]
je 0x431c90
lea ecx, [esp + 0x10]
push 0x13
push ecx
push eax
call edi
mov eax, dword [0x47107c]
lea edx, [esp + 0x38]
push 0x13
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
lea ecx, [esp + 0x38]
push str.Warcraft_III
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x431c90
lea edx, [esp + 0x10]
push str.WorldEdit
push edx
call ebx
add esp, 8
test eax, eax
jne 0x431c90
mov eax, dword [0x47107c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
push 0
push str.Warcraft_III
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x431cd8
mov ebp, dword [sym.imp.USER32.dll_FindWindowExW]
lea eax, [esp + 0x10]
push 0x13
push eax
push esi
call edi
lea ecx, [esp + 0x10]
push str.WorldEdit
push ecx
call ebx
add esp, 8
test eax, eax
je 0x431ce2
push 0
push str.Warcraft_III
push esi
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x431ca9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x4340d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4340db
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4341de
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x45b1b4]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x45b1b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x45b1b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x45b1b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x45b1b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x45b1b4]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x45b1b4]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x45b1b4]
xor eax, edx
inc ecx
dec edi
jne 0x4340f6
pop edi
test esi, esi
je 0x434200
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x45b1b4]
xor eax, edx
inc ecx
dec esi
jne 0x4341e2
pop esi
pop ebx
not eax
ret

Function at 0x434210
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov edx, dword [ecx]
and esi, 0xff
mov eax, edx
and eax, 0xff
xor eax, esi
shr edx, 8
mov eax, dword [eax*4 + 0x45b1b4]
xor eax, edx
mov edx, dword [ecx + 4]
mov dword [ecx], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 8]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 4], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x45b1b4]
xor eax, edx
mov dword [ecx + 8], eax
ret
Function at 0x434c30
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x434c71
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x434c66
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x434c84
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x14]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1c]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x1c], ecx
pop ebp
pop ebx
ret
Function at 0x4357a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp edi, ebx
jne 0x4357be
pop edi
pop esi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x18], ebx
jne 0x4357d0
pop edi
pop esi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 8
ret
cmp dword [edi + 0x7c], ebx
je 0x4357de
push edi
call fcn.00435c10
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push edi
call fcn.004355a0
add esp, 0x10
test eax, eax
je 0x435807
pop edi
pop esi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 8
ret
mov ebp, dword [sym.imp.MSVCRT.dll_malloc]
push 0x84
call ebp
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x43582a
pop edi
pop esi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 8
ret
push 0x4000
call ebp
mov dword [esi], eax
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x44], ecx
mov edx, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0x435862
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, 0xffffff98
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp edx, ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
sete al
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
cmp eax, ebx
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
jne 0x4358b0
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
push eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.004344c0
add esp, 4
test eax, eax
jne 0x4358b0
mov dword [esi + 0x40], 1
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x44]
mov dword [esi + 0x5c], edx
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov ecx, dword [edi + 0x30]
shr ecx, 3
test cl, 1
je 0x4358dd
mov edx, dword [edi + 0x38]
shr edx, 8
mov byte [esi + 0x80], dl
jmp 0x4358e9
mov eax, dword [edi + 0x3c]
shr eax, 0x18
mov byte [esi + 0x80], al
mov cl, byte [esi + 0x6c]
mov ebp, dword [esp + 0x20]
neg cl
sbb ecx, ecx
lea ebx, [esi + 0x70]
and ecx, 0xc
mov dword [esi + 0x74], 0x23456789
test ebp, ebp
mov dword [esi + 0x7c], ecx
mov dword [ebx], 0x12345678
mov dword [esi + 0x78], 0x34567890
je 0x435929
mov al, byte [ebp]
test al, al
je 0x435929
push eax
push ebx
call fcn.00434210
add esp, 8
inc ebp
jne 0x435915
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x14]
mov dword [esi + 8], 0
lea ecx, [edx + eax + 0x1e]
xor eax, eax
mov dword [esi + 0x3c], ecx
mov dword [edi + 0x7c], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x435d60
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x435e26
cmp dword [edi + 4], 0xffffffff
jne 0x435e26
lea esi, [edi + 0x244]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ax, word [edi + eax*2 + 0x242]
add esp, 4
cmp ax, 0x5c
je 0x435db8
cmp ax, 0x2f
je 0x435db8
push 0x4655f4
push esi
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
cmp ebx, 1
jne 0x435de3
push 1
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x435de3
pop edi
pop esi
mov eax, 0x2000000
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push ebx
push ecx
push esi
call fcn.004349e0
add esp, 0x10
test eax, eax
jne 0x435e06
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
push eax
call fcn.00434f00
add esp, 4
mov dword [edi], eax
neg eax
sbb eax, eax
pop edi
and eax, 0xfffffe00
pop esi
add eax, 0x200
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebx
pop ecx
ret 0xc

Function at 0x4363f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x410
push ebx
push ebp
mov ebp, dword [esp + 0x41c]
test ebp, ebp
je 0x436418
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x436418
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [esp + 0x420]
mov ax, word [ebx]
test ax, ax
je 0x4364d1
mov ecx, ebx
mov edx, ebx
cmp ax, 0x2f
je 0x43643b
cmp ax, 0x5c
jne 0x43643d
mov ecx, edx
mov ax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x43642f
cmp ecx, ebx
je 0x43648b
sub ecx, ebx
push esi
sar ecx, 1
shl ecx, 1
mov eax, ecx
mov edx, ecx
push edi
mov esi, ebx
lea edi, [esp + 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [esp + eax + 0x218], 0
lea eax, [esp + 0x218]
push eax
push ebp
call fcn.004363f0
add esp, 8
pop edi
pop esi
test ebp, ebp
mov word [esp + 8], 0
je 0x4364a5
lea ecx, [esp + 8]
push ebp
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
lea edx, [esp + 8]
push ebx
push edx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 8
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4364d1
lea ecx, [esp + 8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop ebp
pop ebx
add esp, 0x410
ret
Function at 0x437610
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x453fc8
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov eax, dword [ecx + 0x2b4c]
test eax, eax
jne 0x437659
lea ecx, [esp + 0x5c]
mov dword [esp + 0x54], 0xffffffff
call sub.MFC42u.DLL_CString::CString
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 4
mov eax, dword [esp + 0x5c]
push 0
push 0x81
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43769e
lea ecx, [esp + 0x5c]
mov dword [esp + 0x54], eax
call sub.MFC42u.DLL_CString::CString
or eax, esi
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 8]
push 0
push ecx
lea edx, [esp + 0x28]
push 0x30
push edx
push esi
call edi
mov eax, dword [esp + 0x44]
push 0
test eax, eax
jne 0x4376d5
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 0x10
push ecx
push esi
call edi
mov edi, dword [esp + 0x14]
jmp 0x4376e8
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push 0x14
push eax
push esi
call edi
mov edi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x60]
mov dword [esp + 0x58], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x50]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret 4
Function at 0x439c10
Capabilities:
Enumerate process modules

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45480b
push eax
mov eax, 0x2210
mov dword fs:[0], esp
call fcn.0044d980
mov eax, dword [0x4710b0]
push esi
test eax, eax
push edi
jne 0x439d1b
mov ecx, dword [0x4710ac]
test ecx, ecx
je 0x439d1b
lea eax, [esp + 0xc]
lea edx, [esp + 0x218]
push eax
push 0x2000
push edx
push ecx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x439d16
mov eax, dword [esp + 0xc]
xor esi, esi
test eax, eax
jbe 0x439d16
lea edi, [esp + 0x218]
mov ecx, dword [edi]
mov edx, dword [0x4710ac]
lea eax, [esp + 0x10]
push 0x104
push eax
push ecx
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x439ce7
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 8]
mov dword [esp + 0x2220], 0
call sub.MFC42u.DLL_CString::MakeLower
push str.game.dll
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
jg 0x439cf5
lea ecx, [esp + 8]
mov dword [esp + 0x2220], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0xc]
inc esi
add edi, 4
cmp esi, eax
jb 0x439c81
jmp 0x439d16
mov ecx, dword [esp + esi*4 + 0x218]
mov dword [esp + 0x2220], 0xffffffff
mov dword [0x4710b0], ecx
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [0x4710b0]
mov ecx, dword [esp + 0x2218]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x221c
ret

Function at 0x439f80
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x471300]
sub esp, 8
test eax, eax
je 0x439f94
fld qword [0x4712f8]
jmp 0x439f9a
fld qword [0x45b8b8]
mov eax, dword [esp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], eax
push ebx
fild qword [esp + 4]
push ebp
push esi
push edi
fmul st(1)
call sub.MSVCRT.dll__ftol
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
fstp st(0)
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
mov ebx, eax
call ebp
mov eax, dword [0x47132c]
test eax, eax
jne 0x439fef
call edi
sub eax, ebx
cmp eax, esi
jae 0x43a003
push 1
call ebp
mov eax, dword [0x47132c]
test eax, eax
je 0x439fda
pop edi
pop esi
pop ebp
mov dword [0x47132c], 0
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x441e10
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, dword [0x471114]
push edi
lea eax, [esi + esi*8]
xor edi, edi
shl eax, 8
xor edx, edx
add eax, esi
lea ecx, [ecx + eax*8 + 2]
mov ax, word [ecx]
cmp ax, 0x80e
jb 0x441e3b
cmp ax, 0x8d1
jbe 0x441e87
cmp ax, 0x8d6
je 0x441e87
cmp ax, 0x8d9
jb 0x441e4d
cmp ax, 0x8dc
jbe 0x441e87
cmp ax, 0x8ea
jb 0x441e59
cmp ax, 0xbb8
jbe 0x441e87
inc edx
add ecx, 2
cmp edx, 0x400
jl 0x441e2c
push esi
call fcn.0043afa0
add esp, 4
cmp esi, 0x100
jne 0x441e82
mov eax, dword [0x471114]
mov word [eax + 0x480802], di
mov eax, edi
pop edi
pop esi
ret
push 0x471118
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x471130], edi
jne 0x441eb8
mov edx, dword [0x471134]
mov edi, 1
push edx
mov dword [0x471130], edi
mov dword [0x471138], esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x471118
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
ret

Function at 0x4446b0
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x2218
call fcn.0044d980
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
lea ecx, [esp + 0x22c]
push 0x1000
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x4447c1
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], 0
shr edx, 2
test edx, edx
jle 0x4447c1
mov ebp, dword [sym.imp.MSVCRT.dll_tolower]
lea eax, [esp + 0x228]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x44479e
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x1228]
push eax
push 0x1000
push ecx
push ebx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x444797
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1228]
push 0x208
push edx
push eax
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExW
lea esi, [esp + 0x20]
mov edi, 0x104
xor ecx, ecx
mov cx, word [esi]
push ecx
call ebp
mov word [esi], ax
add esp, 4
add esi, 2
dec edi
jne 0x444769
mov edx, dword [esp + 0x222c]
lea eax, [esp + 0x20]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
jne 0x4447ce
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
inc eax
shr ecx, 2
add edi, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
jl 0x444705
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2218
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov eax, dword [esp + edx*4 + 0x21c]
pop ebx
add esp, 0x2218
ret
Function at 0x446f60
Capabilities:
Enumerate process modules

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x454fb0
push eax
mov eax, 0x2218
mov dword fs:[0], esp
call fcn.0044d980
push esi
xor esi, esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], esi
call sub.MFC42u.DLL_CString::CString_5
mov eax, dword [0x4710ac]
mov dword [esp + 0x2228], 1
cmp eax, esi
je 0x447066
lea ecx, [esp + 0x10]
lea edx, [esp + 0x220]
push ecx
push 0x2000
push edx
push eax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x447066
cmp dword [esp + 0x10], esi
jbe 0x447066
lea edi, [esp + 0x220]
mov ecx, dword [edi]
mov edx, dword [0x4710ac]
lea eax, [esp + 0x18]
push 0x104
push eax
push ecx
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x447039
lea eax, [esp + 0x18]
lea ecx, [esp + 8]
push eax
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 8]
mov byte [esp + 0x2228], 2
call sub.MFC42u.DLL_CString::MakeLower
push str.game.dll
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
jg 0x447047
lea ecx, [esp + 8]
mov byte [esp + 0x2228], 1
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x10]
inc esi
add edi, 4
cmp esi, eax
jb 0x446fd9
jmp 0x447066
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call fcn.0044d320
lea ecx, [esp + 8]
mov byte [esp + 0x2228], 1
call sub.MFC42u.DLL_CString::CString
mov esi, dword [esp + 0x2230]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x2228], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x2220]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2224
ret