joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e5e0
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eeb38
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x4c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x1009e631
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e661
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax]
cmp ecx, eax
jb 0x1009e6b0
cmp ecx, edx
jb 0x1009e6b0
test eax, eax
je 0x1009e651
cmp ecx, 0xa00000
ja 0x1009e695
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x100f6204
lea ecx, [ebp - 0x14]
call fcn.100c524d
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.100c524d
push 0x1012bb4c
lea eax, [ebp - 0x34]
push eax
call fcn.100c524d
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100c524d
push 0x1012ad98
lea eax, [ebp - 0x20]
push eax
call fcn.100c524d
push 0xcaa82f9b
lea ecx, [ebp - 0x2c]
call fcn.100c524d
push 0x1012ad98
lea eax, [ebp - 0x2c]
push eax
call fcn.100c524d
int3

Function at 0x1009e850
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eec98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebx + 0x18]
lea esi, [ebx + 0x14]
sub edi, dword [esi]
mov ecx, dword [ebp + 8]
lea eax, [edi + ecx]
cmp eax, edi
jl 0x1009e8f1
cmp eax, ecx
jl 0x1009e8f1
cmp eax, 0xa00000
jg 0x1009e8f8
push esi
push eax
mov ecx, esi
call fcn.100c524d
mov eax, dword [esi]
lea ecx, [ebx + 0x40]
push ecx
push dword [ebp + 8]
add eax, edi
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1009e8c6
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1009e913
mov eax, dword [ebx + 0x40]
mov ecx, esi
push esi
add eax, edi
push eax
call fcn.100c524d
push 0xa
mov ecx, ebx
call fcn.100c524d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa82f9c
jmp 0x1009e8fd
push 0xcaa10024
lea ecx, [ebp - 0x1c]
call fcn.100c524d
push 0x1012ad98
lea eax, [ebp - 0x1c]
push eax
call fcn.100c524d
push 0x100f6204
lea ecx, [ebp - 0x10]
call fcn.100c524d
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100c524d
push 0x1012bb4c
lea eax, [ebp - 0x30]
push eax
call fcn.100c524d
int3
Function at 0x100c524d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100c525c
pop dword [ebp - 8]
mov eax, 0xb74c9c04
add eax, 0x58bfb658
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x82115
push 0
mov eax, 0xbbc31e6d
add eax, 0x544c2363
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x55ac
mov esi, eax
mov edx, 0x10164e00
add edx, dword [ebp - 8]
mov edi, 0x3612056d
sub edi, 0x4a52423f
sub dword [ebp - 4], 0x99fbae15
mov ebx, dword [edx]
sub dword [ebp - 4], ebx
add ebx, edi
xor dword [ebp - 4], esi
mov dword [esi], ebx
add dword [ebp - 4], eax
add esi, 0x7002aa2c
add esi, 0x8ffd55d8
add edx, 0xe1be2ea7
sub edx, 0xe1be2ea3
loop 0x100c52af
add eax, 0x680fe731
sub eax, 0x680e9dae
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x43e10f17
sub ecx, 0x33e10f17
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x42077b
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x39
bound eax, qword [esi]
push ebx
xor al, 0x27
leave
mov bl, 0x86
test eax, 0x1b025120
add eax, 0x4ad86404
xchg ebp, eax
mov dl, dl
fdiv st(7)
test ax, 0x9fa6
dec edx
mov dl, 0x62
invalid

Function at 0x42e97f
Capabilities:
Encode data using xor

Disassembly:
dec edx
inc eax
and al, 0x42
insb byte es:[edi], dx
xor eax, edx
or al, bh
clc
push 0x11e87b3f
pushal

Function at 0x4aa26b
Capabilities:
Encode data using xor

Disassembly:
or byte [ecx], al
push ebp
fnsave dword [ebx]
pop edx
popal
jno 0x4aa2a5
cmp al, byte [edx - 0x140f1d8]
jecxz 0x4aa2e8
invalid
and byte [ebp - 0x30], dh
out 0xbc, al
dec ebp
js 0x4aa315
outsd dx, dword [esi]
add dword [ebp + 0x94a1946], esi
lea esi, [ecx - 0x19]
dec ebx
mov eax, dword [0xc9c96808]
pushfd
sub eax, 0x8f4d89f0
xor byte [ebx - 0x80], bh
les ebx, [eax]
fcomi st(2)
xlatb
mov dh, 0x3e
insd dword es:[edi], dx
xor dword [edi - 0x1fbe6bfa], edi
jge 0x4aa29e
pop ss
add eax, 0x9ad372d6
add dword [edx + 0x24], 0xe518e1b0
add dh, dh
pushal
clc
invalid
nop
in eax, 0x88
or eax, 0xea601d7a
push esp
adc eax, 0x81d4718d
sal byte [ebx - 0x29], 1
mov al, byte [0x9b40e5d0]
shl ch, 1
inc eax
wait
enter 0xffffffffffff809d, 0
je 0x4aa2e9
add byte [eax], 0x74
sar byte [edi - 0x1e], 1
jg 0x4aa2fd
jo 0x4aa35b
sahf
invalid
push eax
cmpsb byte [esi], byte es:[edi]
jnp 0x4aa30f
inc esp
push ebx
lahf
ror byte [ebx + 0x3e1d1b56], 1
cmpsb byte [esi], byte es:[edi]
mov byte [0x80d50132], al
fisub word [edi - 0xa]
fsubr dword [esi]
mov eax, dword [0xd959e495]
call 0x51832f2a
push ebx
nop
xor esi, dword [eax - 0x6fb237a4]
mov al, byte [0x24a038d7]
test al, 0xd1
call 0x30642af7
jb 0x4aa39b
jnp 0x4aa3ad
xchg dword [eax + 0x154b043c], eax
mov edi, 0x4854e901
adc eax, 0x54e901bf
dec eax
pushal
push eax
sub dword [edx], esp
invalid
rcr dword [ebx - 0x34], cl
jl 0x4aa422
cmp ebp, dword [eax]
aaa
add edi, ebp
mov ebx, dword [edx - 5]
sbb al, byte [eax + ebp*2]
xchg ebx, eax
mov cl, 0x83
inc esp
invalid
add edx, ecx
mov dword [0x3341a9d5], eax
sbb ah, dh
loopne 0x4aa453
add byte [esi - 0x43], al
pop esp
pop eax
xor byte [eax], 0x3f
sti
mov eax, dword [0xc7407180]
sar byte [ebx + 0x6d], 1
adc dh, al
xchg esp, eax
inc ebx
or bl, dh
inc esp
leave
je 0x4aa42d
shr byte [ecx - 0x476b1fe4], cl
jle 0x4aa4b0
inc ebp
hlt
add eax, 0xeb11ee30
aad 0x65
cdq
push 0x75
dec eax
mov ecx, dword [eax - 0x6f]
mov cl, 0x17
invalid
adc al, 0x30
movsd dword es:[edi], dword [esi]
and byte [ecx - 0xdc24e0c], dh
call 0x94346515
sar byte [edx + 0x71], cl
adc byte [ebx], dh
invalid
Function at 0x41ae70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x41ae92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ae99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ae88
mov eax, 1
add ebx, ebx
jne 0x41aeab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x41aea0
jne 0x41aebc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41aea0
xor ecx, ecx
sub eax, 3
jb 0x41aed0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41af42
mov ebp, eax
add ebx, ebx
jne 0x41aedb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41aee8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41af0c
inc ecx
add ebx, ebx
jne 0x41aef8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x41aeed
jne 0x41af09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41aeed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jle 0x41af2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41af1d
jmp 0x41ae8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41af2c
add edi, ecx
jmp 0x41ae8e
pop esi
sub edi, dword [edi - 4]
push edi
mov edi, esi
mov ecx, 0x8a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41af4e
cmp byte [edi], 0
jne 0x41af4e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41af53
pop edi
mov eax, dword [edi]
or eax, eax
je 0x41afc4
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a064]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41af7b
push edx
mov ecx, edi
jns 0x41afab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [esi + 0x1a068]
pop edx
or eax, eax
je 0x41afc2
mov dword [ebx], eax
add ebx, 4
jmp 0x41af98
popal
ret
popal
jmp 0x408cb0
Function at 0x10008880
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [ebp + 0xc]
push edi
call fcn.10093290
test eax, eax
jne 0x100089e6
cmp byte [0x101170fc], al
jne 0x100088a4
xor edi, edi
jmp 0x100088bf
push 5
call dword [0x10117140]
mov edi, eax
add esp, 4
test edi, edi
je 0x100088bf
push edi
call dword [0x10117148]
add esp, 4
mov edx, dword [ebp + 8]
test edx, edx
jle 0x100089ce
test esi, esi
je 0x100089ce
cmp dword [0x10119650], 0
jne 0x1000895a
push 0
call fcn.10093290
movups xmm0, xmmword [str.expand_32_byte_k]
add esp, 4
movups xmmword [0x10119650], xmm0
test eax, eax
jne 0x10008906
push 0x2c
push eax
push 0x10119660
call sub.VCRUNTIME140.dll_memset
jmp 0x10008936
cmp dword [0x1011720c], 0
je 0x10008929
push 0x2c
push 0
push 0x10119660
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1011720c]
mov dword [0x10119660], eax
jmp 0x10008936
push 0x10119660
push 0x2c
push eax
mov eax, dword [eax + 0x38]
call eax
mov eax, dword [0x10119680]
add esp, 0xc
mov edx, dword [ebp + 8]
xor cl, cl
mov dword [0x1011968c], eax
mov dword [0x10119680], 0
mov byte [0x101196d0], cl
jmp 0x10008960
mov cl, byte [0x101196d0]
movzx eax, cl
cmp edx, eax
jle 0x100089ae
test cl, cl
je 0x10008989
movzx eax, cl
push eax
push 0x10119690
push esi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x101196d0]
add esp, 0xc
sub dword [ebp + 8], eax
add esi, eax
inc dword [0x10119680]
mov edx, 0x10119650
mov ecx, 0x10119690
call fcn.10093290
mov edx, dword [ebp + 8]
mov cl, 0x40
mov byte [0x101196d0], cl
cmp edx, 0x40
jg 0x10008967
movzx eax, cl
sub eax, edx
push edx
add eax, 0x10119690
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
sub byte [0x101196d0], al
jmp 0x100089d8
mov dword [0x10119650], 0
test edi, edi
je 0x100089e6
push edi
call dword [0x10117150]
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401ca0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4c7148
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
xor edi, edi
push 0xffffffffffffffff
push edi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], di
call fcn.004017d0
mov eax, ebx
mov dword [esp + 0x34], edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x401d00
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.00401e40
push 0xffffffffffffffff
push edi
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov eax, esi
mov word [esi + 4], di
call fcn.004017d0
cmp dword [esp + 0x28], 8
jb 0x401d47
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004abbe4
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x2c
ret
Function at 0x4031d0
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x460
mov eax, dword [0x4ea6c4]
xor eax, esp
mov dword [esp + 0x45c], eax
mov eax, dword [esp + 0x464]
push ebx
push esi
push ecx
mov ebx, 8
push ebx
mov dword [esp + 0x1c], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], esi
je 0x403226
lea edx, [esp + 0x38]
push edx
push esi
mov dword [esp + 0x40], 0x428
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x403240
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x45c]
xor ecx, esp
call fcn.004abc64
add esp, 0x460
ret
lea eax, [esp + 0x58]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], 0
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403260
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x5c]
push eax
lea esi, [esp + 0x24]
call fcn.00401700
mov eax, dword [esp + 0x30]
mov ecx, dword [edi + 0x14]
cmp ecx, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x18]
jb 0x403299
lea edx, [esp + 0x10]
cmp dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x20]
jae 0x4032a7
lea ecx, [esp + 0x20]
cmp dword [edi + 0x18], ebx
jb 0x4032b1
mov eax, dword [edi + 4]
jmp 0x4032b4
lea eax, [edi + 4]
mov edx, dword [edx]
push edx
push ecx
call fcn.00406b80
add esp, 8
test eax, eax
sete bl
cmp dword [esp + 0x34], 8
jb 0x4032d9
mov eax, dword [esp + 0x20]
push eax
call fcn.004abbe4
add esp, 4
test bl, bl
jne 0x4032fa
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x38]
push ecx
push edx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x403325
mov ebx, 8
jmp 0x403240
lea eax, [esp + 0x258]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403304
mov esi, dword [esp + 0x14]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x25c]
push eax
call fcn.00401700
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x464]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004abc64
add esp, 0x460
ret
Function at 0x405a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x4c2f38
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4ea6c4]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
fld qword [ebp + 8]
lea edi, [ecx - 0x1ec]
fnstcw word [esp + 0x1a]
push 0x66
movzx eax, word [esp + 0x1e]
fst qword [ecx + 0x18]
or eax, 0xc00
mov dword [esp + 0x20], eax
mov eax, edi
fldcw word [esp + 0x20]
fistp qword [esp + 0x20]
mov esi, dword [esp + 0x20]
fldcw word [esp + 0x1e]
call fcn.00449620
test eax, eax
je 0x405af5
mov edx, dword [eax + 0x4d0]
cmp esi, edx
mov ecx, esi
jge 0x405acf
mov ecx, edx
mov edx, dword [eax + 0x4d4]
cmp ecx, edx
jle 0x405adb
mov ecx, edx
cmp dword [eax + 0x4cc], ecx
je 0x405af5
mov edx, dword [eax]
mov dword [eax + 0x4cc], ecx
mov ecx, eax
mov eax, dword [edx + 0x11c]
call eax
push 0x67
mov eax, edi
call fcn.00449620
mov esi, eax
test esi, esi
je 0x405b66
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], 0
fld qword [ebp + 8]
sub esp, 8
mov dword [esp + 0x88], 0
fstp qword [esp]
lea ecx, [esp + 0x2c]
push str._.2f__
push ecx
call fcn.00407230
mov edx, dword [esi]
mov edx, dword [edx + 0x170]
add esp, 0x10
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call edx
cmp dword [esp + 0x3c], 8
jb 0x405b66
mov eax, dword [esp + 0x28]
push eax
call fcn.004abbe4
add esp, 4
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004abc64
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4075b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c2e52
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4ea6c4]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
xor ebx, ebx
push 0xffffffffffffffff
mov edi, ecx
mov dword [esp + 0x1c], ebx
push ebx
mov ebp, 7
push edi
lea eax, [esp + 0x60]
mov dword [esp + 0x78], ebp
mov dword [esp + 0x74], ebx
mov word [esp + 0x64], bx
call fcn.004017d0
mov dword [esp + 0x7c], ebx
push 2
push 0x4cba80
lea esi, [esp + 0x40]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], bx
call fcn.00401700
mov byte [esp + 0x7c], 1
mov ecx, dword [edi + 0x14]
mov eax, dword [esp + 0x4c]
cmp eax, ecx
mov dword [esp + 0x18], 1
ja 0x407653
push edi
mov ecx, esi
call fcn.00407ff0
test eax, eax
sete al
cmp al, bl
jne 0x4076a2
push 2
push 0x4cba88
lea esi, [esp + 0x24]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], bx
call fcn.00401700
mov dword [esp + 0x7c], 2
mov ecx, dword [edi + 0x14]
mov eax, dword [esp + 0x30]
cmp eax, ecx
mov dword [esp + 0x18], 3
ja 0x40769c
push edi
mov ecx, esi
call fcn.00407ff0
test eax, eax
sete al
cmp al, bl
jne 0x4076a2
mov byte [esp + 0x17], bl
jmp 0x4076a7
mov byte [esp + 0x17], 1
test byte [esp + 0x18], 2
mov esi, 8
je 0x4076d8
and dword [esp + 0x18], 0xfffffffd
cmp dword [esp + 0x34], esi
jb 0x4076cb
mov eax, dword [esp + 0x20]
push eax
call fcn.004abbe4
add esp, 4
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
mov dword [esp + 0x7c], ebx
test byte [esp + 0x18], 1
je 0x4076f6
cmp dword [esp + 0x50], esi
jb 0x4076f6
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.004abbe4
add esp, 4
cmp byte [esp + 0x17], bl
je 0x40773a
lea edx, [esp + 0x38]
push edi
push edx
or eax, 0xffffffff
mov ecx, 2
call fcn.004070f0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea eax, [esp + 0x60]
mov byte [esp + 0x88], 3
call fcn.004017d0
cmp dword [esp + 0x50], esi
jb 0x40773a
mov eax, dword [esp + 0x3c]
push eax
call fcn.004abbe4
add esp, 4
mov ebp, dword [esp + 0x6c]
cmp ebp, esi
mov edx, dword [esp + 0x58]
jae 0x40774a
lea edx, [esp + 0x58]
mov edi, dword [edi + 0x14]
cmp edi, esi
jbe 0x407753
mov edi, esi
xor ecx, ecx
cmp edi, ebx
jbe 0x4077aa
lea esp, [esp]
movzx eax, word [edx + ecx*2]
cmp ax, 0x30
jb 0x407778
cmp ax, 0x39
ja 0x407778
movzx eax, ax
sub eax, 0x30
jmp 0x40779e
cmp ax, 0x61
jb 0x40778c
cmp ax, 0x66
ja 0x40778c
movzx eax, ax
sub eax, 0x57
jmp 0x40779e
cmp ax, 0x41
jb 0x4077dc
cmp ax, 0x46
ja 0x4077dc
movzx eax, ax
sub eax, 0x37
shl ebx, 4
add ecx, 1
add ebx, eax
cmp ecx, edi
jb 0x407760
cmp ebp, esi
jb 0x4077bb
mov edx, dword [esp + 0x58]
push edx
call fcn.004abbe4
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.004abc64
add esp, 0x6c
ret
cmp ebp, esi
jb 0x4077bb
mov ecx, dword [esp + 0x58]
push ecx
jmp 0x4077b3
Function at 0x4084c0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4c2d79
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov esi, ecx
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov dword [esp + 0x18], esi
mov word [esi + 4], di
mov dword [esp + 0x24], edi
push ebx
mov dword [esp + 0x18], 1
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, edi
jle 0x408574
lea ebp, [eax + eax]
xor ecx, ecx
lea eax, [ebp + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ab8e2
add esp, 4
push ebp
mov edi, eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebp
jg 0x40856b
mov word [edi + eax*2], 0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408555
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.00401700
push edi
call fcn.004ab965
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x40a1e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c1818
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
xor ebx, ebx
mov dword [esp + 0x14], vtable.GameMgr::GMBuffer_unsigned_char_.0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [esp + 0x38], ebx
call fcn.00425100
test al, al
jne 0x40a245
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40a275
push eax
jmp 0x40a26d
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [ebp + 0xc]
push edx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x40a28c
cmp esi, ebx
mov dword [edi + 4], eax
je 0x40a275
push esi
call fcn.004ab965
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, ebx
je 0x40a299
push esi
call fcn.004ab965
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a2b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push 0x400
mov esi, eax
mov dword [esp + 0x14], 1
xor bl, bl
call fcn.004acc34
push 0x400
mov edi, eax
push 0
push edi
call fcn.004ae6c0
mov edx, dword [ebp]
add esp, 0x10
lea eax, [esp + 0x18]
push eax
push edi
lea ecx, [esp + 0x18]
push ecx
push 0
push str.Path
push edx
mov dword [esp + 0x30], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a326
mov dword [ebp + 4], eax
mov eax, esi
call fcn.00407a80
push edi
call fcn.004acb57
add esp, 4
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov eax, edi
mov bl, 1
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a330
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.00401700
push edi
call fcn.004acb57
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 4

Function at 0x40a360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c56b8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi]
push ebx
lea ecx, [esp + 0x20]
push ecx
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x40a3bb
mov dword [esi + 4], eax
jmp 0x40a420
mov edi, dword [esp + 0x14]
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.GameMgr::GMBuffer_unsigned_char_.0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.00401c50
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x38], ebx
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
mov edx, dword [ebp + 8]
push esi
lea eax, [esp + 0x20]
push eax
mov dword [edi], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x40a437
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
cmp esi, ebx
je 0x40a420
push esi
call fcn.004ab965
add esp, 4
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x14]
push esi
push edi
call fcn.00423f70
test al, al
je 0x40a413
cmp esi, ebx
je 0x40a453
push esi
call fcn.004ab965
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc