joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e5a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd748
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 2
push eax
push 0xf003f
push 0
push dword [ebp + 8]
mov dword [ebp - 0x18], 0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40e621
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40e621
xor bl, bl
jmp 0x40e684
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov edx, 2
mov eax, dword [eax - 0xc]
lea esi, [eax*2 + 1]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045dc27
push esi
mov edi, eax
push 0
push edi
call fcn.005a7a20
push esi
push dword [ebp + 0x10]
push edi
call fcn.005a74a0
add esp, 0x1c
push esi
push edi
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0045dc22
add esp, 4
mov bl, 1
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e6a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40e6c3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x40e6e2
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
Function at 0x40e700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov esi, edx
mov dword [ebp - 0xc], 0
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40e770
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x40e770
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.005a3521
mov esp, ebp
pop ebp
ret

Function at 0x40e7a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cd79d
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x21c], ebx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
push 0x61b534
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x224], eax
mov dword [ebx], 0
call fcn.00406cf0
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push esi
push edi
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x220], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e8f3
mov edi, dword [ebp - 0x224]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0
push edi
push dword [ebp - 0x220]
call esi
test eax, eax
jne 0x40e8e7
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.005a7a20
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push edi
push dword [ebp - 0x220]
call esi
test eax, eax
jne 0x40e8e7
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x224]
call fcn.00406cf0
push eax
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.00403f70
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov esi, dword [ebp - 0x224]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40e8e7
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
Function at 0x40e920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x61c7d0
push SysReAllocStringLen
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e987
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.005a3521
mov esp, ebp
pop ebp
ret
Function at 0x414460
Capabilities:
Create process on windows

Disassembly:
push esi
push str.CKakaoGameDlg::_onTrayHomeOpen
push str.__s__:_click
mov esi, ecx
call fcn.00404190
push eax
call fcn.00425940
mov eax, dword [esi + 0x244]
add esp, 0xc
pop esi
cmp eax, 3
ja case.0x414487.0
jmp dword [eax*4 + 0x41450c]
push 1
push 0x61b534
push 0x61b534
push str.http:__beta.starplay.game_
push 0x61c194
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push 1
push 0x61b534
push 0x61b534
push str.http:__sandbox.starplay.game_
push 0x61c194
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push 1
push 0x61b534
push 0x61b534
push str.http:__alpha.starplay.game_
push 0x61c194
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push 1
push 0x61b534
push 0x61b534
push str.https:__starplay.game_
push 0x61c194
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x415a50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce798
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
lea eax, [ecx + 0x16c]
push 0x61b530
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x18], 0
call fcn.0040d830
add esp, 0xc
push str.GoogleChromeUser_DataLocal_State
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
call fcn.0040d830
add esp, 0xc
mov byte [ebp - 4], 3
or esi, 0xffffffff
mov edx, dword [ebp - 0x34]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x415ade
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415b8f
xorps xmm0, xmm0
lea ecx, [ebp - 0x30]
movups xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
call fcn.00470cbb
push 0
push 0x4040
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x30]
push dword [ebp - 0x18]
call fcn.004710be
lea ecx, [ebp - 0x30]
test eax, eax
je 0x415b8a
push edi
call fcn.0047124b
lea ecx, [ebp - 0x30]
call fcn.00470ee2
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jl 0x415b87
push str._starappplayer_:true
push eax
call fcn.005a6f75
add esp, 8
test eax, eax
je 0x415b87
sub eax, dword [edi]
sar eax, 1
js 0x415b87
push str._starappplayer_:false
push str._starappplayer_:true
mov ecx, edi
call fcn.0041ae60
lea ecx, [ebp - 0x30]
call fcn.00470cf0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x415b83
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
jmp 0x415bad
lea ecx, [ebp - 0x30]
call fcn.00470cf0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x415bab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 4
Function at 0x425520
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x34], 0
jne 0x425542
lea eax, [esi + 0x3c]
push eax
push 0
push esi
push 0x423e40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x34], eax
pop esi
ret

Function at 0x4256c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cfe1c
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
cmp byte [edi + 4], 0
je 0x4258b8
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push 0
push 0
call fcn.00402790
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.005ad0ef
mov esi, eax
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
inc esi
push esi
call fcn.005ad210
mov ebx, eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push esi
push ebx
call fcn.0042e110
push 0x98
lea eax, [ebp - 0xac]
push 0
push eax
call fcn.005a7a20
add esp, 0x38
lea ecx, [ebp - 0xac]
call fcn.00426cd0
mov edx, str._KakaoGame_
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac]
call fcn.0042b320
push dword [ebp - 0xb8]
mov ecx, eax
call fcn.00427350
mov edx, 0x61fc28
mov ecx, eax
call fcn.0042b320
push dword [ebp - 0xb6]
mov ecx, eax
call fcn.00427350
mov edx, 0x61fc28
mov ecx, eax
call fcn.0042b320
push dword [ebp - 0xb4]
mov ecx, eax
call fcn.00427350
mov edx, 0x61fc24
mov ecx, eax
call fcn.0042b320
push dword [ebp - 0xb2]
mov ecx, eax
call fcn.00427350
mov edx, 0x61fc20
mov ecx, eax
call fcn.0042b320
mov edx, ebx
mov ecx, eax
call fcn.0042b320
mov edx, 0x61fc1c
mov ecx, eax
call fcn.0042b320
push ebx
call fcn.005ad20b
add esp, 4
lea eax, [ebp - 0xd8]
lea ecx, [ebp - 0xac]
push eax
call fcn.00426bf0
cmp dword [eax + 0x14], 0x10
jb 0x425826
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0xc4]
cmp eax, 0x10
jb 0x42584b
inc eax
lea ecx, [ebp - 0xd8]
push eax
push dword [ebp - 0xd8]
call fcn.00408ff0
cmp dword [edi + 0x64], 0
je 0x425899
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0xac]
call fcn.00426bf0
mov edx, eax
mov byte [ebp - 4], 2
cmp dword [edx + 0x14], 0x10
jb 0x425871
mov edx, dword [edx]
mov eax, dword [edi + 0x4c]
lea ecx, [edi + 0x4c]
push edx
call dword [eax + 0x58]
mov eax, dword [ebp - 0xc4]
cmp eax, 0x10
jb 0x425899
inc eax
lea ecx, [ebp - 0xd8]
push eax
push dword [ebp - 0xd8]
call fcn.00408ff0
lea ecx, [ebp - 0x5c]
call fcn.00426c10
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x5c], vtable.std::ios_base.0
call fcn.005a487e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
Function at 0x425940
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cfe6c
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
cmp byte [edi + 4], 0
je 0x425b44
lea eax, [ebp - 0xdc]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
call fcn.0042e0d0
xor ecx, ecx
add esp, 4
mov edx, 2
lea esi, [eax + 1]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005ad210
add esp, 4
mov ebx, eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push esi
push ebx
call fcn.004027a0
add esp, 0x14
lea eax, [ebp - 0xc8]
push 0xb0
push 0
push eax
call fcn.005a7a20
add esp, 4
lea ecx, [ebp - 0xc8]
call fcn.00425ed0
mov edx, str._KakaoGame_
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.0042b5d0
push dword [ebp - 0xd4]
mov ecx, eax
call fcn.00426640
mov edx, 0x61f248
mov ecx, eax
call fcn.0042b930
push dword [ebp - 0xd2]
mov ecx, eax
call fcn.00426640
mov edx, 0x61f248
mov ecx, eax
call fcn.0042b930
push dword [ebp - 0xd0]
mov ecx, eax
call fcn.00426640
mov edx, 0x61c768
mov ecx, eax
call fcn.0042b930
push dword [ebp - 0xce]
mov ecx, eax
call fcn.00426640
mov edx, 0x61fc3c
mov ecx, eax
call fcn.0042b930
mov edx, ebx
mov ecx, eax
call fcn.0042b930
mov edx, 0x61fc1c
mov ecx, eax
call fcn.0042b5d0
push ebx
call fcn.005ad20b
add esp, 4
lea eax, [ebp - 0xf4]
lea ecx, [ebp - 0xc8]
push eax
call fcn.00425dc0
cmp dword [eax + 0x14], 8
jb 0x425aa5
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0xe0]
cmp eax, 8
jb 0x425aca
inc eax
lea ecx, [ebp - 0xf4]
push eax
push dword [ebp - 0xf4]
call fcn.00402e30
cmp dword [edi + 0x64], 0
je 0x425b25
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0xc8]
call fcn.00425dc0
mov ecx, eax
mov byte [ebp - 4], 2
cmp dword [ecx + 0x14], 8
jb 0x425af0
mov ecx, dword [ecx]
mov eax, dword [edi + 0x4c]
push ecx
lea ecx, [edi + 0x4c]
call dword [eax + 0x58]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xe0]
cmp eax, 8
jb 0x425b1c
inc eax
lea ecx, [ebp - 0xf4]
push eax
push dword [ebp - 0xf4]
call fcn.00402e30
mov eax, dword [edi + 0x4c]
lea ecx, [edi + 0x4c]
call dword [eax + 0x4c]
lea ecx, [ebp - 0x60]
call fcn.00425de0
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x60], vtable.std::ios_base.0
call fcn.005a487e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret
Function at 0x425bd0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cfeab
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
cmp byte [edi + 4], 0
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
je 0x425cee
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x208
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.005a7a20
mov eax, dword [esi]
lea ecx, [ebp - 0x21c]
add esp, 0xc
push 0
push 0x104
push ecx
mov ecx, esi
call dword [eax + 0xc]
call fcn.0045fe71
mov ecx, eax
test ecx, ecx
jne 0x425c67
push 0x80004005
call fcn.00402d80
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x21c]
push eax
movzx eax, word [ebp - 0x222]
push ebx
push eax
movzx eax, word [ebp - 0x224]
push eax
movzx eax, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push str._KakaoGame___d:_d:_d._d___name_:__s_n
push eax
call fcn.004057a0
mov esi, dword [ebp - 0x220]
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [edi + 0x64], 0
je 0x425cd2
mov eax, dword [edi + 0x4c]
lea ecx, [edi + 0x4c]
push esi
call dword [eax + 0x58]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x425cee
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 8
Function at 0x42d8c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d072a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.005a4e7b
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x42d980
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x61fd8c
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.005a72e7
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x648518
push eax
call fcn.005a7b7a
push edi
push esi
call fcn.005a4d2f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 4
Function at 0x431ff0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0a98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x64dff0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x10], esi
call fcn.00403f00
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.0040bf20
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x432053
cmp dword [eax + 0x20], 0
jne 0x43206e
push 0
push 0
push edi
push 0x431a80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x432090
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432490
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0b98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x64dff0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
call fcn.00403f00
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00403f00
mov esi, dword [ebx + 0x10]
add esp, 8
lea edi, [eax + 0x10]
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 4
lea ecx, [esi + 0xe0]
push eax
call fcn.00403f70
mov eax, dword [ebp + 0x10]
lea edx, [edi - 0x10]
or edi, 0xffffffff
mov dword [esi + 0xe8], eax
mov byte [ebp - 4], 3
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x432529
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x432547
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x432570
cmp dword [esi + 0x20], 0
je 0x432570
mov ecx, esi
call fcn.00433000
push 1
push 0
push dword [esi + 0x20]
mov dword [esi + 0xe4], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x43258b
push 0
push 0
push ebx
push 0x431a60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4325a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x4325c8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x434340
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0d30
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x64dff0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
push dword [ebp + 8]
push str.CNoxPlayer::_startProcess
push str.__s__:_aguemnts__s_
call fcn.00404190
push eax
call fcn.00425940
lea eax, [esi + 4]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x70]
push 0x61c774
push eax
call fcn.0041ecb0
push 0x61d1d0
push eax
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 1
push eax
call fcn.0040d830
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041ad30
add esp, 0x34
mov byte [ebp - 4], 4
or esi, 0xffffffff
mov edx, dword [ebp - 0x6c]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4343ed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, esi
mov edx, dword [ebp - 0x70]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43440b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x40
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.005a7a20
add esp, 0xc
mov dword [ebp - 0x68], 0x44
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x434461
push str.CNoxPlayer::_startProcess
push str.__s__:_CreateProcess_fail
call fcn.00404190
push eax
call fcn.00425940
add esp, 0xc
xor edi, edi
jmp 0x434464
mov edi, dword [ebp - 0x1c]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x434482
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x4344a1
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005a3521
mov esp, ebp
pop ebp
ret 4