joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4176f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
call fcn.004230e0
test al, al
je 0x417714
cmp dword [0x475d88], 0
jne 0x417719
cmp dword [0x475d6c], 0
jne 0x417719
call fcn.00422b40
call fcn.00412930
test eax, eax
jne 0x417743
push eax
push 0x447c58
push str.penc
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x475d70]
test ecx, ecx
je 0x417762
mov eax, dword [ecx]
push 0
push dword [0x475d84]
push edi
call dword [eax + 8]
mov dword [0x475d68], eax
jmp 0x417767
mov eax, dword [0x475d68]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x417780
push 0
push dword [0x475d68]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0041a5f0
call fcn.0041b6b0
call fcn.00414f40
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0x4176b0
push 0x1d4c0
push 0x596
push edi
call esi
push 0x4176b0
push 0xea60
push 0x592
push edi
call esi
cmp dword [0x476070], 0
mov eax, dword [0x476074]
mov ecx, dword [0x47607c]
mov ebx, dword [0x476080]
mov esi, dword [sym.imp.USER32.dll_RegisterHotKey]
mov dword [ebp - 4], ecx
push eax
jne 0x4177e1
push 2
jmp 0x4177e3
push 3
push 0x3e8
push edi
call esi
cmp dword [ebp - 4], 0
push ebx
jne 0x4177f6
push 2
jmp 0x4177f8
push 3
push 0x3e9
push edi
call esi
push str.layout_tab_button
push dword [0x475d7c]
call dword [sym.imp.gbui.dll_GetPluginByName]
push eax
call fcn.00416230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418900
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x48], eax
cmp dword [0x475da4], 0x40
jae 0x418a12
push esi
lea esi, [edx + ecx]
cmp esi, 0x80000000
jae 0x41893a
lea esi, [edi + 1]
jmp 0x418940
sub esi, 0x7fff0000
push ebx
mov ebx, dword [ebp + 0x10]
add ebx, ecx
cmp ebx, 0x80000000
jae 0x418956
add ebx, 0x7ff80000
jmp 0x41895b
mov ebx, 0xfff80000
xorps xmm0, xmm0
mov dword [ebp - 0x44], edi
lea eax, [ebp - 0x44]
push eax
movdqu xmmword [ebp - 0x40], xmm0
movdqu xmmword [ebp - 0x30], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, ebx
jae 0x418a10
lea ecx, [ecx]
push 0x1c
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4189d7
cmp dword [ebp - 0x10], 0x10000
jne 0x4189cb
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x4189ce
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x4189ce
lea eax, [ecx - 1]
xor edx, edx
add eax, esi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x4189db
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add esi, eax
cmp esi, ebx
jb 0x418980
test edi, edi
je 0x418a10
xor eax, eax
lea ecx, [ecx]
cmp dword [eax*4 + 0x47a8c0], 0
je 0x418a03
inc eax
cmp eax, 0x40
jb 0x4189e0
pop ebx
pop esi
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
inc dword [0x475da4]
mov dword [eax*4 + 0x47a8c0], edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x418a30
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push ecx
push 0
push 0x1fffff
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x418adb
test esi, esi
je 0x418adb
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x418b05
push edi
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], 0x10001
push eax
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x418ad8
mov edx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x218]
cmp ecx, ebx
jb 0x418ad8
mov eax, dword [ebp + 8]
add eax, ebx
cmp ecx, eax
jae 0x418ad8
push esi
call edx
cmp edi, 3
jge 0x418aeb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2d0]
inc edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x418a95
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret

Function at 0x418b20
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x475db0], esi
jbe 0x418b76
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x475dac]
push dword [eax + esi*4]
call ebx
mov eax, dword [0x475dac]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x475db0]
jb 0x418b54
pop ebx
push dword [0x475dac]
call fcn.0042a1e1
add esp, 4
mov dword [0x475dac], 0
mov dword [0x475db0], 0
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [0x475da8], ebx
jne 0x4191b6
push 0x47a9c0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x100
push ebx
push 0x47a8c0
call fcn.0042e710
add esp, 0xc
mov dword [0x475da8], 1
push 0x47a9c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
mov eax, dword [ecx*4 + 0x47a8c0]
test eax, eax
je 0x4191d5
add eax, 0x2c
cmp eax, dword [edi]
je 0x4191e0
inc ecx
cmp ecx, 0x40
jb 0x4191c3
jmp 0x419288
push esi
mov esi, dword [ecx*4 + 0x47a8c0]
test esi, esi
je 0x419287
mov edx, dword [esi + 4]
mov ecx, dword [esi]
call fcn.00418bb0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push dword [esi + 4]
mov dword [ebp - 8], ebx
push dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x419282
mov edx, dword [esi]
xor ecx, ecx
cmp dword [esi + 4], ecx
jbe 0x419232
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi + 4]
jb 0x419225
push dword [esi + 4]
mov ebx, dword [ebp - 0xc]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esi]
mov ebx, 1
mov dword [edi], eax
xor eax, eax
nop
cmp dword [eax*4 + 0x47a8c0], esi
je 0x419271
inc eax
cmp eax, 0x40
jb 0x419260
jmp 0x419282
dec dword [0x475da4]
mov dword [eax*4 + 0x47a8c0], 0
call fcn.00418b20
pop esi
push 0x47a9c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret

Function at 0x419880
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x208
mov dword [0x476004], 1
mov dword [0x476000], 0
mov dword [0x475ff8], 0
call fcn.0042a219
add esp, 4
mov dword [0x475ffc], eax
test eax, eax
je 0x41991f
push 0x208
push 0
push eax
call fcn.0042e710
add esp, 0xc
push 1
push 0x23
push dword [0x475ffc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x448960
push 0x104
push dword [0x475ffc]
call fcn.0042a175
add esp, 0xc
push 0
push dword [0x475ffc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.fav.dat
push 0x104
push dword [0x475ffc]
call fcn.0042a175
add esp, 0xc
call fcn.004199a0
mov eax, 0x475ff8
ret
push 0
push 0x447c58
push 0x44a538
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0x10
push dword [0x475d7c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 0x475ff8
ret
Function at 0x41a970
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x208
mov dword [0x476064], 0
mov dword [0x476060], 0
mov dword [0x476058], 0
call fcn.0042a219
add esp, 4
mov dword [0x47605c], eax
test eax, eax
je 0x41aa0f
push 0x208
push 0
push eax
call fcn.0042e710
add esp, 0xc
push 1
push 0x23
push dword [0x47605c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x448960
push 0x104
push dword [0x47605c]
call fcn.0042a175
add esp, 0xc
push 0
push dword [0x47605c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.his.dat
push 0x104
push dword [0x47605c]
call fcn.0042a175
add esp, 0xc
call fcn.0041aa90
mov eax, 0x476058
ret
push 0
push 0x447c58
push 0x44a538
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0x10
push dword [0x475d7c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 0x476058
ret
Function at 0x41be10
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x41be88
cmp dword [edi + 8], 0
je 0x41be88
push esi
push str.btn_close_1
push dword [edi]
call dword [sym.imp.gbui.dll_GetPluginByName]
mov esi, eax
push 0
push esi
mov ecx, dword [esi]
call dword [ecx + 0xb8]
mov ecx, dword [esi]
push 1
push esi
call dword [ecx + 0x88]
push eax
call dword [sym.imp.gbui.dll_Plugin_Redraw]
mov eax, dword [edi + 0x18]
pop esi
test eax, eax
je 0x41be5b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.4177GB_EVENT_DOWNLOAD
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push edi
push 0x41bbb0
push 0
push 0
mov dword [edi + 0x18], eax
call fcn.0042a2ab
add esp, 0x18
mov dword [edi + 0x1c], eax
xor eax, eax
pop edi
ret 0xc

Function at 0x41c170
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push str.GAMEBOX_ONLINEUPDATE_WND_CLASS
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41c1c5
push 0
push str.GAMEBOX_ONLINEUPDATE_WND_CLASS
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x41c1c5
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor al, al
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [esi]
test eax, eax
je 0x41c1dc
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x41c1f2
mov ecx, esi
call fcn.0041bf60
test al, al
je 0x41c1bd
push esi
push 0xffffffffffffffeb
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esi]
call fcn.00422cd0
pop edi
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x41c210
Capabilities:
Create directory
Create process on windows
Delete file
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x443cc8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0042a175
push str.4177GameBox_Data
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0042a175
push str.update
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0042a175
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.online_update.exe
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push esi
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x41c31a
push 1
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc
push 0x10
push 0x448e10
push 0x448e1c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41c630
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push str.SOFTWARE4177SBox
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c6d2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 4
push eax
push 0x20219
push 0
push str.SOFTWARE4177SBox
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c6ba
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.Install_Plan
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
push 0
push 0x475b40
call fcn.0042c8ae
add esp, 8
cmp eax, 0xffffffff
je 0x41c6ba
push 0x475b40
push 0
push str.Install_Plan
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
jmp 0x41c6bd
Function at 0x41ccb0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x127c
call fcn.00438220
mov eax, dword [0x44e310]
xor eax, esp
mov dword [esp + 0x1278], eax
push ebx
push esi
push edi
xor eax, eax
push 0x1262
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.__opengame
lea eax, [esp + 0x1c]
push 0x932
push eax
call fcn.0042a175
add esp, 0xc
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push ecx
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00423320
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x41cd4c
mov eax, ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1278]
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x41cdb6
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
xor esi, esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push 0x41cbf0
mov dword [esp + 0x18], esi
call edi
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x41cdb8
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
cmp esi, 0xc8
jge 0x41cdb8
lea eax, [esp + 0x10]
push eax
push 0x41cbf0
call edi
push 0xa
inc esi
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41cd80
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1278]
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [esp + 0x1284]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x41d0d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x475d7c]
push ebx
mov ebx, ecx
cmp dword [ebx + 0x10], 0
jne 0x41d1af
test eax, eax
je 0x41d1a2
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41d1a2
push esi
push edi
push 0xfffffffffffffff0
push dword [0x475d7c]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
and esi, 0x29ffffff
or esi, 0x96000000
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push dword [0x475d7c]
call dword [sym.imp.USER32.dll_SetParent]
push esi
push 0xfffffffffffffff0
push dword [0x475d7c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
push 0x40
push eax
push edi
push 0
push 0
push 0
push dword [0x475d7c]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
call fcn.0041d220
push dword [0x475d7c]
call fcn.00422cd0
push 0
push dword [0x475d74]
call dword [sym.imp.USER32.dll_ShowWindow]
push str.game_flash
push dword [0x475d7c]
call dword [sym.imp.gbui.dll_GetPluginByName]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x19c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov dword [ebx + 0x10], 1
xor eax, eax
pop ebx
ret 0xc
test eax, eax
je 0x41d20d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41d20d
push 0xfffffffffffffff0
push dword [0x475d7c]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
push dword [0x475d7c]
push 0x465
push dword [0x475d74]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
call fcn.0041d220
push str.game_flash
push dword [0x475d7c]
call dword [sym.imp.gbui.dll_GetPluginByName]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x19c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebx + 0x10], 0
xor eax, eax
pop ebx
ret 0xc

Function at 0x41d6a0
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0
push dword [0x475d84]
push 0
push 0
push 0
push 0
push 0
push 0
push 0xcf0000
push 0x443ebc
push str.PLAY_GAME_WINDOW_CLASS
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x41d6d9
pop esi
ret 8
push 0x47600c
push 0xffffffffffffffeb
push esi
mov dword [0x47600c], esi
mov dword [0x475d7c], esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
ret 8
Function at 0x41e000
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
xor edi, edi
push edi
mov word [ebp - 0xc], ax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp - 0x254]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41e14f
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x25c], eax
test eax, eax
jle 0x41e14f
push esi
push eax
call fcn.00429b46
add esp, 4
mov esi, eax
lea eax, [ebp - 0x254]
push esi
push dword [ebp - 0x25c]
push dword [ebp - 0x258]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41e0da
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x260]
push eax
push 0x443cc8
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41e0da
mov ecx, dword [ebp - 0x260]
mov edi, 1
movzx eax, word [ecx + 0xa]
mov word [ebp - 0xc], ax
movzx eax, word [ecx + 8]
mov word [ebp - 0xa], ax
movzx eax, word [ecx + 0xe]
mov word [ebp - 8], ax
movzx eax, word [ecx + 0xc]
mov word [ebp - 6], ax
push esi
call fcn.0042a534
add esp, 4
test edi, edi
je 0x41e13d
xor esi, esi
lea esp, [esp]
push 0xa
push 0x20
lea eax, [ebp - 0x4c]
push eax
movzx eax, word [ebp + esi*2 - 0xc]
push eax
call fcn.0042ce93
lea eax, [ebp - 0x4c]
push eax
push 0x104
push dword [0x4764f0]
call fcn.0042a175
add esp, 0x1c
cmp esi, 3
je 0x41e137
push 0x44988c
push 0x104
push dword [0x4764f0]
call fcn.0042a175
add esp, 0xc
inc esi
cmp esi, 4
jb 0x41e0f0
pop esi
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x41f020
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
mov edi, ebx
lea ecx, [edi + 1]
lea ebx, [ebx]
mov al, byte [edi]
inc edi
test al, al
jne 0x41f030
sub edi, ecx
inc edi
push edi
call fcn.0042a219
push edi
mov esi, eax
push 0
push esi
call fcn.0042e710
push ebx
push edi
push esi
call fcn.0042c854
xor eax, eax
add esp, 0x1c
cmp byte [esi], al
je 0x41f06a
lea esp, [esp]
xor byte [esi], 0x21
inc eax
inc esi
cmp byte [esi], 0
jne 0x41f060
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x41fa70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb40
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.0042e710
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xb30], ax
lea eax, [ebp - 0xb2e]
push eax
call fcn.0042e710
add esp, 0x18
lea eax, [ebp - 0xb40]
push eax
push 0x20019
push 0
push str.SOFTWARE4177SBox
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fb0a
push dword [ebp - 0xb40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x720]
push eax
sub esp, 0xc
call fcn.00422660
test al, al
je 0x41fc51
lea eax, [ebp - 0x720]
jmp 0x41fb4a
push 0
push 0x475b40
call fcn.0042c8ae
add esp, 8
cmp eax, 0xffffffff
je 0x41fb44
push 0x475b40
push 0x104
lea eax, [ebp - 0xb30]
push eax
push 0x443ebc
push str.InstallName
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xb30]
push eax
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.00429ebe
add esp, 0xc
xor eax, eax
mov word [ebp - 0x414], ax
push 0x206
push eax
lea eax, [ebp - 0x412]
push eax
call fcn.0042e710
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x928], ax
lea eax, [ebp - 0x926]
push eax
call fcn.0042e710
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0042e710
lea eax, [ebp - 0xb3c]
mov dword [ebp - 0xb38], 0x5f
push eax
lea eax, [ebp - 0xb38]
mov dword [ebp - 0xb34], 0x2e
push eax
lea eax, [ebp - 0x61c]
mov dword [ebp - 0xb3c], 0
push eax
call fcn.0042d236
add esp, 0x30
xor esi, esi
test eax, eax
je 0x41fc36
cmp esi, 1
jne 0x41fbff
push eax
lea eax, [ebp - 0x414]
jmp 0x41fc0b
cmp esi, 2
jne 0x41fc19
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00429ebe
add esp, 0xc
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0xb38]
push eax
push 0
call fcn.0042d236
add esp, 0xc
inc esi
test eax, eax
jne 0x41fbf1
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fc40
sub ecx, edx
sar ecx, 1
jne 0x41fc62
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xb34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042c25a
add esp, 8
test eax, eax
je 0x41fcad
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0xb34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0042d236
push eax
lea eax, [ebp - 0x928]
push 0x104
push eax
call fcn.00429ebe
add esp, 0x18
jmp 0x41fcc8
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x928]
push 0x104
push eax
call fcn.00429ebe
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call fcn.0042c0fd
add esp, 4
mov esi, eax
push esi
call fcn.0041f970
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret