joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1654
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x4a16a1
xor ebx, ebx
jmp 0x4a1696
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00419914
test eax, eax
jne 0x4a1695
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x4a174c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a1677
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4a16ad
je 0x4a16b6
jmp 0x4a16bf
call fcn.0049cc5c
mov esi, eax
jmp 0x4a16c1
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x4a16c1
xor esi, esi
test si, si
je 0x4a174c
xor ebx, ebx
jmp 0x4a16e7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x4a16e6
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4a174c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a16ce
xor ebx, ebx
jmp 0x4a1741
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov dx, 0x3ff
and dx, si
movzx edx, dx
cmp eax, edx
jne 0x4a1740
mov ax, 0x3ff
and ax, si
cmp ax, 4
jne 0x4a1735
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.004a1628
push eax
mov eax, esi
call fcn.004a1628
pop edx
cmp edx, eax
jne 0x4a1740
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x4a174c
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4a16f6
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4a1b38
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a1c0f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a1c2c
push ebx
push 0x4a1c3c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087a4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405864
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084c8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a1bba
mov ax, 0x83
call fcn.004a175c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a1b0c
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a1bc3
call fcn.004a1b0c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1c16
lea eax, [ebp - 4]
call fcn.004079f4
ret
Function at 0x4a1d2c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a1df7
jmp 0x4a1deb
cmp dword [esi + 0x10], 0x1000
jne 0x4a1dd7
test byte [esi + 0x15], 1
jne 0x4a1dd7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1d88
cmp ebp, 2
je 0x4a1d88
cmp ebp, 0x10
je 0x4a1d88
cmp ebp, 0x20
jne 0x4a1da4
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a1da4
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a1db5
mov eax, dword [esi]
add eax, ebx
call fcn.004a1d24
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a1da8
cmp byte [esp + 4], 0
je 0x4a1dd7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a1df7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a1d5d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1000ebb3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000ebf2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000ebf2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000ebf2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000ebf2
cmp dword [ecx + 0x74], 0xe
jbe 0x1000ebf2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001186f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001190c
push ebx
push esi
call fcn.10011838
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100117cc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100118b9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001190b
push edi
push eax
call fcn.1001282a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100118d9
call fcn.10010314
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001190a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100117cc
add esp, 0x20
test eax, eax
jne 0x100118f8
push edi
call fcn.10010314
jmp 0x10011900
push ebx
call fcn.10010314
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10011b79
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019888
push 0x10019880
push str.FlsAlloc
push 0x1f
call fcn.10011a95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011bad
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
jmp 0x10011bb3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10011bf7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10019898
push 0x10019890
push str.FlsGetValue
push 0x21
call fcn.10011a95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011c2e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10011c36
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100198a0
push 0x10019898
push str.FlsSetValue
push 0x22
call fcn.10011a95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10011c70
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10018150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100172f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001731d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001731d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402400
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4398c3
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x448050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
or ecx, 0xffffffff
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x20], 0x44c2bc
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [ebp - 4], eax
lea ebx, [edi + 0x34]
mov dword [edi], vtable.TiXmlDocument.0
mov dword [ebx], 0x44c2bc
mov byte [ebp - 4], 1
mov dword [edi + 0x40], ecx
mov dword [edi + 0x3c], ecx
push 0x43ef1c
xor esi, esi
mov dword [edi + 0x38], 4
mov byte [edi + 0x44], al
mov byte [edi + 0x2c], al
mov dword [edi + 0x30], eax
call fcn.00401140
xor eax, eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4025d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
jne 0x40261c
cmp byte [edi + 0x2c], bl
jne 0x402614
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4025f7
sub eax, esi
push edx
lea ebx, [edi + 0x34]
mov esi, eax
call fcn.00401140
or eax, 0xffffffff
mov dword [edi + 0x40], eax
mov dword [edi + 0x3c], eax
pop esi
xor al, al
pop ebx
pop ebp
ret 4
mov esi, dword [edi + 0x18]
test esi, esi
je 0x402634
mov ecx, esi
mov eax, dword [ecx]
mov edx, dword [eax]
mov esi, dword [esi + 0x28]
push 1
call edx
test esi, esi
jne 0x402623
xor ecx, ecx
push 2
or eax, 0xffffffff
push ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
push ebx
mov dword [edi + 8], eax
mov dword [edi + 4], eax
call fcn.00424eeb
push ebx
call fcn.004250fb
push 0
mov ebx, eax
mov eax, dword [ebp + 8]
push 0
push eax
call fcn.00424eeb
add esp, 0x1c
test ebx, ebx
jg 0x402692
cmp byte [edi + 0x2c], 0
jne 0x402614
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 0xc
mov edx, dword [str.Error_document_empty.]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402686
jmp 0x4025fe
lea ecx, [ebx + 1]
push ecx
call fcn.00424770
mov edx, dword [ebp + 8]
push edx
push 1
mov esi, eax
push ebx
push esi
mov byte [esi], 0
call fcn.004253aa
add esp, 0x14
cmp eax, 1
je 0x4026ec
push esi
call fcn.0042477b
add esp, 4
cmp byte [edi + 0x2c], 0
jne 0x402614
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4026e0
jmp 0x4025fe
mov byte [esi + ebx], 0
cmp byte [esi], 0
mov eax, esi
mov ecx, esi
je 0x40271c
lea esp, [esp]
mov dl, byte [eax]
cmp dl, 0xd
jne 0x402713
mov byte [ecx], 0xa
inc eax
inc ecx
cmp byte [eax], 0xa
jne 0x402717
jmp 0x402716
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x402700
push 0
mov byte [ecx], 0
mov eax, dword [edi]
mov edx, dword [eax + 8]
push 0
push esi
mov ecx, edi
call edx
push esi
call fcn.0042477b
add esp, 4
xor eax, eax
cmp byte [edi + 0x2c], al
pop esi
sete al
pop ebx
pop ebp
ret 4

Function at 0x405a10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x405a28
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x405a5a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x405a56
cmp esi, eax
jae 0x405a5a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x405a48
cmp esi, eax
jb 0x405a60
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x4063c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x14
push edi
lea eax, [ebp - 4]
push eax
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
jne 0x4063e0
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push 2
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edx, dword [ebp - 4]
mov ebx, eax
mov eax, dword [ebp + 8]
push ebx
push edi
push edx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0x43f558
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
push esi
test eax, eax
jne 0x40643c
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0x16]
mov dx, word [eax + 0x14]
mov di, word [eax + 0x12]
mov bx, word [eax + 0x10]
mov word [ebp - 0x10], cx
mov word [ebp - 0xe], dx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
movzx eax, word [ebp - 0xe]
movzx ecx, word [ebp - 0x10]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
movzx edx, bx
push edx
movzx eax, di
push eax
push str._d._d._d._d
push ecx
call fcn.004264f7
add esp, 0x18
pop esi
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4064a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
sub esp, 0xc
push esi
mov dword [ecx], 0xffffffff
lea ecx, [ebp - 4]
mov dword [edx], 0xffffffff
mov edx, dword [ebp + 8]
mov dword [eax], 0xffffffff
mov eax, dword [ebp + 0xc]
push ecx
push edx
mov dword [eax], 0xffffffff
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x4064e4
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push esi
push 2
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ecx, dword [ebp + 8]
mov ebx, eax
mov eax, dword [ebp - 4]
push ebx
push esi
push eax
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0x43f558
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
push edi
test eax, eax
jne 0x406540
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 0x12]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
movzx ecx, word [eax + 0x10]
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
movzx ecx, word [eax + 0x16]
mov edx, dword [ebp + 0x14]
movzx eax, word [eax + 0x14]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406c10
Capabilities:
Get file size

Disassembly:
push esi
push 0
push 0
push 3
push 0
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406c2f
xor eax, eax
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x406c50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439478
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x448050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
or ebx, 0xffffffff
cmp esi, ebx
je 0x406cfc
push 0x22c
lea ecx, [ebp - 0x23c]
push 0
push ecx
call fcn.00427020
add esp, 0xc
lea edx, [ebp - 0x23c]
push edx
push esi
mov dword [ebp - 0x23c], 0x22c
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x406cf5
mov edi, dword [sym.imp.KERNEL32.DLL_Process32NextW]
lea esp, [esp]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push ecx
call fcn.00426238
add esp, 8
test eax, eax
je 0x406d39
lea edx, [ebp - 0x23c]
push edx
push esi
call edi
test eax, eax
jne 0x406cd0
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x406d1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424761
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x406d5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x406d1d
Function at 0x408d70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ad08
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x448050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov ecx, dword [eax - 0xc]
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x408db8
call fcn.004054b0
lea ecx, [ebp - 0x10]
push ecx
push 0
push eax
push 0x408c40
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408df4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x408e10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x448050]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x408e47
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424761
mov esp, ebp
pop ebp
ret
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov word [ebp - 0x20a], cx
mov edx, esi
mov ecx, eax
sub edx, ecx
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x408e60
push edi
lea edi, [esi - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x408e73
mov edx, dword [0x43fa0c]
push str.WebGameClient
push esi
mov dword [edi], edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop edi
call fcn.00424761
mov esp, ebp
pop ebp
ret
Function at 0x408ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439443
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x448050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x218]
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edx, dword [0x44c38c]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str._udata.udat
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.00426bfd
add esp, 0xc
push ebx
push ebx
push 2
push ebx
push 3
push 0x10000000
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x23c], eax
cmp eax, ebx
je 0x409052
mov eax, dword [ebp + 8]
mov edi, eax
cmp eax, ebx
jne 0x408f84
xor eax, eax
jmp 0x408fad
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x408f97
xor eax, eax
jmp 0x408fad
lea esi, [eax + eax]
mov eax, esi
call fcn.00433400
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.0040c720
mov ecx, eax
mov dword [ebp - 0x220], 0xf
mov dword [ebp - 0x224], ebx
mov byte [ebp - 0x234], bl
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x408fc8
sub ecx, esi
mov esi, ecx
lea ecx, [ebp - 0x234]
call fcn.0040b1c0
cmp dword [ebp - 0x220], 0x10
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x234]
mov esi, eax
jae 0x408ffb
lea ecx, [ebp - 0x234]
mov edi, dword [ebp - 0x23c]
push ebx
lea edx, [ebp - 0x238]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
cmp dword [ebp - 0x238], esi
je 0x40907c
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x220], 0x10
jb 0x40903c
mov eax, dword [ebp - 0x234]
push eax
call fcn.00424756
add esp, 4
mov dword [ebp - 0x220], 0xf
mov dword [ebp - 0x224], ebx
mov byte [ebp - 0x234], bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409078
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4090e5
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x220], 0x10
jb 0x4090a4
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.00424756
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 0x220], 0xf
mov dword [ebp - 0x224], ebx
mov byte [ebp - 0x234], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4090e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
lea esp, [ebp - 0x24c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424761
mov esp, ebp
pop ebp
ret