joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x131c
call fcn.00438220
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x1046
push eax
mov word [ebp - 0x131c], ax
xor edi, edi
lea eax, [ebp - 0x131a]
push eax
call fcn.0042e710
push esi
lea eax, [ebp - 0x131c]
push 0x824
push eax
call fcn.00429ebe
lea eax, [ebp - 0x131c]
push 0x2f
push eax
call fcn.0042a0cf
add esp, 0x20
test eax, eax
je 0x402ef2
add eax, 2
push eax
lea eax, [ebp - 0x131c]
push 0x824
push eax
call fcn.00429ebe
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x2d4], ax
lea eax, [ebp - 0x2d2]
push eax
call fcn.0042e710
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push eax
call fcn.0042e710
push dword [ebp + 8]
lea eax, [ebp - 0xcc]
push 0x443cc0
push eax
call fcn.00403170
push 0x47608c
lea eax, [ebp - 0x2d4]
push 0x104
push eax
call fcn.0042a175
push 0x443cc8
lea eax, [ebp - 0x2d4]
push 0x104
push eax
call fcn.0042a175
add esp, 0x48
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push 0x104
push eax
call fcn.0042a175
push 0x443cc8
lea eax, [ebp - 0x2d4]
push 0x104
push eax
call fcn.0042a175
lea eax, [ebp - 0x131c]
push eax
lea eax, [ebp - 0x2d4]
push 0x104
push eax
call fcn.0042a175
lea eax, [ebp - 0x2d4]
push eax
push 0x104
push ebx
call fcn.00429ebe
add esp, 0x30
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, 1
cmovne edi, ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402f10
Capabilities:
Check if file exists
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1330
call fcn.00438220
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x1046
push eax
mov word [ebp - 0x1324], ax
lea eax, [ebp - 0x1322]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x1324]
push ebx
push 0x824
push eax
call fcn.00429ebe
add esp, 0xc
lea eax, [ebp - 0x1324]
push 0x2f
push eax
call fcn.0042a0cf
add esp, 8
test eax, eax
je 0x403157
add eax, 2
push eax
lea eax, [ebp - 0x1324]
push 0x824
push eax
call fcn.00429ebe
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2dc], ax
push 0x206
push eax
lea eax, [ebp - 0x2da]
push eax
call fcn.0042e710
add esp, 0xc
xor eax, eax
mov word [ebp - 0xd4], ax
push 0xc6
push eax
lea eax, [ebp - 0xd2]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0xd4]
push dword [ebp + 8]
push 0x443cc0
push eax
call fcn.00403170
add esp, 0xc
lea eax, [ebp - 0x2dc]
push 0x47608c
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x2dc]
push 0x443cc8
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x2dc]
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x2dc]
push 0x443cc8
push 0x104
push eax
call fcn.0042a175
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x2dc]
add esp, 0xc
push eax
call esi
test eax, eax
jne 0x40306b
lea ecx, [ebp - 0x2dc]
call fcn.00422410
lea eax, [ebp - 0x1324]
push eax
lea eax, [ebp - 0x2dc]
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x2dc]
push eax
push 0x104
push edi
call fcn.00429ebe
add esp, 0xc
push edi
call esi
test eax, eax
jne 0x40312a
push 0x443ccc
push dword [0x475d7c]
call dword [sym.imp.gbui.dll_GetPluginByName]
mov esi, eax
push esi
call dword [sym.imp.gbui.dll_Plugin_IsValid]
test eax, eax
je 0x4030d8
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0xb8]
push 1
push esi
call dword [sym.imp.gbui.dll_Plugin_Redraw]
xor eax, eax
mov ecx, fcn.00402c40
test ecx, ecx
xorps xmm0, xmm0
movq qword [ebp - 0x132c], xmm0
cmovne eax, ecx
mov dword [ebp - method.CDownloadCallback.virtual_0], vtable.CDownloadCallback.0
mov dword [ebp - 0x1328], eax
lea eax, [ebp - 0x132c]
push eax
push 0
push edi
push ebx
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc
movsd xmm0, qword [0x44aec0]
sub esp, 8
movsd qword [esp], xmm0
call fcn.00402c40
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4036f0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebx
mov ebx, dword [0x475d7c]
push esi
push edi
push str.DIAGNOSE_WINDOW_CLASS
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403749
push 0
push str.DIAGNOSE_WINDOW_CLASS
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x403749
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
mov eax, dword [esi]
test eax, eax
je 0x403760
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
pop edi
pop esi
pop ebx
ret 4
push ebx
mov ecx, esi
call fcn.00403500
test al, al
je 0x403741
push 0
push 0
push esi
push 0x403630
push 0
push 0
call fcn.0042a2ab
mov eax, dword [esi]
add esp, 0x18
pop edi
pop esi
pop ebx
ret 4
Function at 0x4129a0
Capabilities:
Read file via mapping

Disassembly:
push esi
push edi
push 0x447bd0
push 0x100
xor edi, edi
push edi
push 2
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x4129c3
pop edi
pop esi
ret
push 0x100
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
test ecx, ecx
je 0x4129f6
mov eax, dword [ecx]
mov dword [0x475d74], eax
mov eax, dword [ecx + 4]
push ecx
mov dword [0x475d78], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x413130
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push str.D9B7A967_8BD4_E088_558D_626C166166FB
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4131a7
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [0x475d70]
test ecx, ecx
je 0x4131a7
mov eax, dword [ecx]
lea edx, [ebp - 0x20c]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x413940
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 8]
mov edi, eax
push 0x475d70
mov dword [0x475d84], ecx
mov dword [0x475d88], 0
mov dword [0x475d6c], 0
call dword [sym.imp.libgb.dll_Ordinal_1]
push 0x475d4c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [0x475d70]
test ecx, ecx
je 0x4139ae
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x475d70]
mov eax, dword [ecx]
call dword [eax + 0x90]
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 1
mov esi, eax
jl 0x413a61
push str._opentab
push dword [esi]
call fcn.0042bf8f
add esp, 8
test eax, eax
jne 0x413a2e
call fcn.004129a0
test eax, eax
jne 0x4139f5
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 8], 2
jne 0x413a15
mov ecx, dword [esi + 4]
call fcn.00412d30
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0x10
xor ecx, ecx
call fcn.00412d30
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0x10
push str._opengame
push dword [esi]
call fcn.0042bf8f
add esp, 8
test eax, eax
jne 0x413a61
call fcn.004129a0
test eax, eax
je 0x4139e1
call fcn.00412f20
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0x10
push 1
call fcn.0042a58a
add esp, 4
mov dword [0x475d64], eax
test edi, edi
je 0x413a81
call fcn.004132c0
test eax, eax
jne 0x4139e1
call fcn.00412a10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4144d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x30
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.0042e710
mov eax, dword [0x475d84]
add esp, 0xc
mov dword [ebp - 0x4c], 0x30
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x414400
push 0x7f00
push 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x24], str.LOADING_WINDOW_CLASS
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
call esi
push 0
push dword [0x475d84]
push 0
push 0
push 0x1e
push 0xfa
push 0
push 0
push SysReAllocString
push 0x443ebc
push str.LOADING_WINDOW_CLASS
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
jne 0x414599
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
push 0x476008
push 0xffffffffffffffeb
push edi
mov dword [0x476008], edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [0x475d7c]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push 0
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret

Function at 0x414620
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x44e310]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [0x476008]
push esi
test eax, eax
jne 0x414645
call fcn.004144d0
jmp 0x4146b6
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4146c4
mov esi, dword [0x475d7c]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
push eax
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0
push dword [0x476008]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [0x476008]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x475d74]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x4146e0
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [0x476008]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [0x475d74]
call dword [sym.imp.USER32.dll_EnableWindow]
ret

Function at 0x414a60
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x127c
call fcn.00438220
mov eax, dword [0x44e310]
xor eax, esp
mov dword [esp + 0x1278], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x1262
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [esp + 0x18]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.__opentab
lea eax, [esp + 0x1c]
push 0x932
push eax
call fcn.0042a175
add esp, 0xc
test esi, esi
je 0x414af4
push 0x44822c
lea eax, [esp + 0x1c]
push 0x932
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [esp + 0x18]
push esi
push 0x932
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push ecx
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00423320
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x414b2c
mov eax, ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1278]
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x414b96
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
xor esi, esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push 0x4149a0
mov dword [esp + 0x18], esi
call edi
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x414b98
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
cmp esi, 0xc8
jge 0x414b98
lea eax, [esp + 0x10]
push eax
push 0x4149a0
call edi
push 0xa
inc esi
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x414b60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1278]
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [esp + 0x1284]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret

Function at 0x4157e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.00414620
mov eax, dword [esi]
push esi
call dword [eax + 0x9c]
mov esi, dword [0x475ff8]
test esi, esi
je 0x415858
lea esp, [esp]
cmp dword [esi], eax
je 0x415820
mov esi, dword [esi + 0x32e8]
test esi, esi
jne 0x415810
jmp 0x415858
push edi
mov dword [ebp - 0x10], 0x52e
mov dword [ebp - 0xc], 0x32ec
mov dword [ebp - 8], esi
call fcn.0041ccb0
mov edi, eax
push edi
call fcn.00414c40
lea eax, [ebp - 0x10]
push eax
push edi
push 0x4a
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
add esi, 4
push esi
push edi
call fcn.00414e60
pop edi
push 0
push dword [0x476008]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [0x475d74]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415890
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.00414620
mov eax, dword [esi]
push esi
call dword [eax + 0x9c]
mov esi, dword [0x476058]
test esi, esi
je 0x415908
lea esp, [esp]
cmp dword [esi], eax
je 0x4158d0
mov esi, dword [esi + 0x32e8]
test esi, esi
jne 0x4158c0
jmp 0x415908
push edi
mov dword [ebp - 0x10], 0x52e
mov dword [ebp - 0xc], 0x32ec
mov dword [ebp - 8], esi
call fcn.0041ccb0
mov edi, eax
push edi
call fcn.00414c40
lea eax, [ebp - 0x10]
push eax
push edi
push 0x4a
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
add esi, 4
push esi
push edi
call fcn.00414e60
pop edi
push 0
push dword [0x476008]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [0x475d74]
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret 0xc

Function at 0x415a50
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [0x47649c]
mov ebx, ecx
test esi, esi
je 0x415a87
push edi
nop
push dword [esi]
mov edi, dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x415a80
push 0
push 0
push 0x531
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, edi
test edi, edi
jne 0x415a60
pop edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0x1a4]
call esi
mov eax, dword [ebx + 4]
test eax, eax
je 0x415aa8
push 0
push dword [eax + 0x194]
call esi
mov eax, dword [ebx + 8]
test eax, eax
je 0x415ab9
push 0
push dword [eax + 0x194]
call esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x415aca
push 0
push dword [eax + 0x194]
call esi
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x415adb
push 0
push dword [eax + 0x194]
call esi
push 0
push dword [ebx + 0x1a4]
call esi
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x416430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov edi, edx
push 0x206
push eax
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x20e]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x447d00
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x210]
push esi
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
test edi, edi
je 0x4164db
push 0x44822c
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x210]
push edi
push 0x104
push eax
call fcn.0042a175
add esp, 0xc
lea eax, [ebp - 0x220]
mov dword [ebp - 0x268], 0x44
push eax
lea eax, [ebp - 0x268]
mov dword [ebp - 0x264], 0
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x260], 0x443ebc
push eax
push 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x238], 5
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x416567
push dword [ebp - 0x21c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x220]
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x416d80
Capabilities:
Create directory
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x246]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x248]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x443cc8
lea eax, [ebp - 0x248]
push 0x104
push eax
call fcn.0042a175
push str.4177GameBox_Data_
lea eax, [ebp - 0x248]
push 0x104
push eax
call fcn.0042a175
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x248]
add esp, 0x18
push 0
push eax
call esi
push 0
lea eax, [ebp - 0x248]
push eax
call esi
push str.soft_download.ini
lea eax, [ebp - 0x248]
push 0x104
push eax
call fcn.0042a175
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x248]
add esp, 0xc
push eax
push 0
push str.year
push str.config
call esi
mov ebx, eax
lea eax, [ebp - 0x248]
push eax
push 0
push str.month
push str.config
call esi
mov edi, eax
lea eax, [ebp - 0x248]
push eax
push 0
push 0x4487dc
push str.config
call esi
mov esi, eax
xorps xmm0, xmm0
xor eax, eax
movq qword [ebp - 0x256], xmm0
mov word [ebp - 0x258], ax
mov dword [ebp - 0x24e], eax
mov word [ebp - 0x24a], ax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x258]
movzx eax, word [ebp - 0x256]
imul ecx, edx, 0x64
add ecx, eax
movzx eax, word [ebp - 0x252]
imul ecx, ecx, 0x64
add ecx, eax
imul eax, ebx, 0x64
add eax, edi
imul eax, eax, 0x64
add eax, esi
cmp eax, ecx
je 0x416fa2
xor eax, eax
xorps xmm0, xmm0
push edx
mov word [ebp - 0x2c], ax
mov word [ebp - 0x1a], ax
mov word [ebp - 0x18], ax
mov word [ebp - 6], ax
mov word [ebp - 0x40], ax
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x2c]
push 0x443cc0
push eax
movdqu xmmword [ebp - 0x2a], xmm0
movdqu xmmword [ebp - 0x16], xmm0
movdqu xmmword [ebp - 0x3e], xmm0
call fcn.004187a0
movzx eax, word [ebp - 0x256]
push eax
lea eax, [ebp - 0x18]
push 0x443cc0
push eax
call fcn.004187a0
movzx eax, word [ebp - 0x252]
push eax
lea eax, [ebp - 0x40]
push 0x443cc0
push eax
call fcn.004187a0
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x248]
add esp, 0x24
push eax
lea eax, [ebp - 0x2c]
push eax
push str.year
push str.config
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x18]
push eax
push str.month
push str.config
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x4487dc
push str.config
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
Function at 0x416fc0
Capabilities:
Create directory
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x44e310]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x246]
push eax
call fcn.0042e710
add esp, 0xc
lea eax, [ebp - 0x248]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x443cc8
lea eax, [ebp - 0x248]
push 0x104
push eax
call fcn.0042a175
push str.4177GameBox_Data
lea eax, [ebp - 0x248]
push 0x104
push eax
call fcn.0042a175
push 0x443cc8
lea eax, [ebp - 0x248]
push 0x104
push eax
call fcn.0042a175
add esp, 0x24
lea eax, [ebp - 0x248]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.soft_installinfo.ini
lea eax, [ebp - 0x248]
push 0x104
push eax
call fcn.0042a175
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea eax, [ebp - 0x248]
add esp, 0xc
push eax
push 0
push str.year
push str.config
call esi
mov ebx, eax
lea eax, [ebp - 0x248]
push eax
push 0
push str.month
push str.config
call esi
mov edi, eax
lea eax, [ebp - 0x248]
push eax
push 0
push 0x4487dc
push str.config
call esi
mov esi, eax
xorps xmm0, xmm0
xor eax, eax
movq qword [ebp - 0x256], xmm0
mov word [ebp - 0x258], ax
mov dword [ebp - 0x24e], eax
mov word [ebp - 0x24a], ax
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x258]
movzx eax, word [ebp - 0x256]
imul ecx, edx, 0x64
add ecx, eax
movzx eax, word [ebp - 0x252]
imul ecx, ecx, 0x64
add ecx, eax
imul eax, ebx, 0x64
add eax, edi
imul eax, eax, 0x64
add eax, esi
cmp eax, ecx
je 0x4171db
test esi, esi
jne 0x4171ee
xor eax, eax
xorps xmm0, xmm0
push edx
mov word [ebp - 0x2c], ax
mov word [ebp - 0x1a], ax
mov word [ebp - 0x18], ax
mov word [ebp - 6], ax
mov word [ebp - 0x40], ax
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x2c]
push 0x443cc0
push eax
movdqu xmmword [ebp - 0x2a], xmm0
movdqu xmmword [ebp - 0x16], xmm0
movdqu xmmword [ebp - 0x3e], xmm0
call fcn.004187a0
movzx eax, word [ebp - 0x256]
push eax
lea eax, [ebp - 0x18]
push 0x443cc0
push eax
call fcn.004187a0
movzx eax, word [ebp - 0x252]
push eax
lea eax, [ebp - 0x40]
push 0x443cc0
push eax
call fcn.004187a0
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x248]
add esp, 0x24
push eax
lea eax, [ebp - 0x2c]
push eax
push str.year
push str.config
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x18]
push eax
push str.month
push str.config
call esi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x4487dc
push str.config
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429eaf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429eaf
mov esp, ebp
pop ebp
ret