joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401412
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push 0
and dword [ebx + 4], 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x40148e
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
jmp 0x40146f
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp + 8]
je 0x401475
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40144d
jmp 0x401483
lea eax, [ebp - 0x120]
mov ecx, ebx
push eax
call fcn.0040295e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x401490
xor al, al
pop edi
pop ebx
leave
ret

Function at 0x401e6b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
push ebx
push esi
push edi
mov esi, ecx
call fcn.00402a50
xor eax, eax
mov edi, 0x104
mov dword [esi + 0x130], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea eax, [esi + 0x134]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call fcn.00402059
mov ecx, esi
call fcn.00402805
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.0040203f
mov edi, 0x42e568
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.00417430
add esp, 0x10
jmp 0x401ef4
push edi
push eax
call fcn.00417430
inc eax
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00417cd0
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.00417430
add esp, 0x18
test eax, eax
lea eax, [ebp - 0x104]
jne 0x401ecf
mov edi, 0x42e564
push edi
push eax
call fcn.00417430
pop ecx
pop ecx
jmp 0x401f33
push edi
push eax
call fcn.00417430
inc eax
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00417cd0
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.00417430
add esp, 0x18
test eax, eax
lea eax, [ebp - 0x104]
jne 0x401f0e
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00417cd0
lea eax, [ebp - 0x208]
push eax
call fcn.00417c50
lea eax, [ebp + eax - 0x20b]
push 0x42e560
push eax
call fcn.00417cd0
lea eax, [ebp - 0x208]
push eax
call fcn.004020c3
add esp, 0x18
test al, al
jne 0x401fe2
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00417cd0
mov edi, str._Wrapper.exe
push edi
call fcn.00417c50
mov ebx, eax
lea eax, [ebp - 0x208]
push eax
call fcn.00417c50
add esp, 0x10
cmp eax, ebx
jle 0x401feb
sub eax, ebx
push edi
lea ebx, [ebp + eax - 0x208]
push ebx
call fcn.00417bc0
pop ecx
test eax, eax
pop ecx
jne 0x401feb
push str..exe
push ebx
call fcn.00417cd0
lea eax, [ebp - 0x208]
push eax
call fcn.004020c3
add esp, 0xc
test al, al
je 0x401feb
lea eax, [ebp - 0x208]
push eax
jmp 0x401ff0
push str.RAW_001.exe
lea eax, [esi + 0x24]
push eax
call fcn.00417cd0
pop ecx
lea eax, [ebp - 0xa08]
pop ecx
push 0x800
push eax
call fcn.0040203f
pop ecx
lea eax, [ebp - 0xa08]
pop ecx
push eax
mov ecx, esi
call fcn.00402a6b
lea eax, [esi + 0x128]
mov ecx, esi
push eax
call fcn.00402a67
push eax
push esi
push str.ReflexiveArcadeRAW_002.wdt
mov ecx, esi
call fcn.004010c3
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40238f
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc50
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x50]
push ebx
push eax
mov edi, ecx
call fcn.00417e10
push dword [edi + 0x130]
lea eax, [ebp - 0xc50]
mov dword [ebp - 0x50], esi
push dword [ebp + 8]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [edi + 0x134]
push eax
push ebx
push 4
push ebx
push ebx
lea eax, [ebp - 0xc50]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, edi
call fcn.00402913
test al, al
jne 0x402507
mov esi, dword [ebp + 0xc]
cmp dword [esi], ebx
je 0x402507
push dword [edi + 0x18]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x402507
push dword [edi + 0x128]
lea ecx, [ebp - 0x450]
call fcn.00412ac2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push dword [esi]
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x402488
cmp dword [esi], ebx
mov dword [ebp + 0xc], ebx
jbe 0x40249e
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 0xc]
add eax, ecx
lea ecx, [ebp - 0x450]
mov dword [ebp - 8], eax
mov bl, byte [eax]
call fcn.00401174
sub bl, al
mov eax, dword [ebp - 8]
inc dword [ebp + 0xc]
mov byte [eax], bl
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi]
jb 0x40245b
xor ebx, ebx
jmp 0x40249e
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.Could_not_Read_encrypted_EXE.
call fcn.004032d0
pop ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [esi]
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4024d0
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.Could_not_Write_encrypted_EXE.
call fcn.004032d0
pop ecx
cmp dword [0x436fd4], ebx
je 0x4024fe
mov ecx, edi
call fcn.0040259b
push str.The_integration_header_was_not_valid._The_process_memory_was_mapped_incorrectly.
push dword [edi + 0x18]
call fcn.0040250e
pop ecx
push eax
call fcn.00412a54
push dword [edi + 0x18]
call fcn.00402274
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40257d
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x40258b
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret

Function at 0x40258c
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x40259a
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
Function at 0x40259b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea edi, [ebx + 8]
mov eax, dword [edi]
test eax, eax
je 0x4025be
push eax
call esi
and dword [edi], 0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4025cc
push eax
call esi
and dword [ebx + 0xc], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004060c8
mov ecx, eax
call fcn.00406150
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
call esi
push dword [ebp - 4]
call esi
push 2
push 0
push 2
push edi
mov ecx, ebx
call fcn.004011e8
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebp - 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x40263f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x808]
push str.GameWrapper:_Duplicate_Pause_Event_failed__last_error__x_n
push eax
call fcn.004177f3
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 2
push 0
lea eax, [ebx + 0xc]
push 2
push eax
mov ecx, ebx
call fcn.004011e8
push eax
push dword [ebp - 4]
call esi
push eax
call edi
pop edi
pop esi
test eax, eax
pop ebx
jne 0x402688
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x808]
push str.GameWrapper:_Duplicate_Timeout_Event_failed__last_error__x_n
push eax
call fcn.004177f3
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
leave
ret

Function at 0x40272a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
push pe_nt_image_headers32
mov dword [ebp + 8], edi
push dword [ebx + 0x2c]
call fcn.00401000
push eax
push edi
call fcn.00402217
add esp, 0x10
test eax, eax
jne 0x40275f
xor al, al
jmp 0x402800
movzx ecx, word [esi + 0x14]
mov edi, eax
sub edi, dword [ebp + 8]
and dword [ebp + 8], 0
lea edx, [ecx + esi + 0x18]
movzx ecx, word [esi + 6]
test ecx, ecx
mov dword [ebp - 4], ecx
jle 0x402799
mov ecx, dword [edx + 0x14]
cmp edi, ecx
jb 0x40278b
mov esi, dword [edx + 0x10]
add esi, ecx
cmp edi, esi
jb 0x402799
add edx, 0x28
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 4]
jl 0x40277b
mov ecx, dword [edx + 0xc]
sub ecx, dword [edx + 0x14]
mov edx, dword [ebx + 0xc]
add ecx, dword [edx + 0x34]
add ecx, edi
mov dword [0x436fd0], ecx
cmp dword [eax + 0x100], 0x100
jne 0x4027da
cmp byte [eax + 0x105], 0
jne 0x4027da
add ecx, 0x100
mov dword [0x436fd8], 0xc
mov dword [0x436fd4], ecx
jmp 0x4027fe
add ecx, 0x104
push 0x18
mov dword [0x436fd4], ecx
mov eax, dword [eax + 0x100]
pop ecx
mov dword [0x436fd8], eax
cmp eax, ecx
jb 0x4027fe
mov dword [0x436fd8], ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402832
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
and byte [ebp - 1], 0
push ebx
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
or edi, 0xffffffff
cmp ebx, edi
je 0x40290a
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x130]
mov esi, 0x128
push eax
push ebx
mov dword [ebp - 0x130], esi
call sub.KERNEL32.dll_Process32First
jmp 0x402899
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x128], eax
je 0x40289f
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], esi
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40287b
jmp 0x4028a5
mov edi, dword [ebp - 0x118]
mov eax, dword [ebp + 8]
test eax, eax
je 0x4028ae
mov dword [eax], edi
cmp edi, 0xffffffff
je 0x402902
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], esi
push eax
push ebx
call sub.KERNEL32.dll_Process32First
jmp 0x4028e3
cmp dword [ebp - 0x128], edi
je 0x4028e9
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], esi
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4028c8
jmp 0x402902
push dword [ebp + 0x10]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0xc]
call fcn.00417e70
add esp, 0xc
mov byte [ebp - 1], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret 0xc

Function at 0x402b8b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
test edx, edx
je 0x402bb7
mov ecx, dword [esp + 8]
push esi
push edi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42e738]
xor eax, esi
inc ecx
dec edx
jne 0x402b9d
pop edi
pop esi
ret

Function at 0x402bb8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402c0d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0xc]
push 4
push eax
push dword [ebp + 8]
call fcn.00402b8b
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x402c32
push dword [ebp + 0xc]
lea eax, [ebp - 0x100]
push str.file__s_missing_
push eax
call fcn.004177f3
lea eax, [ebp - 0x100]
push eax
push 0
call fcn.00412a54
add esp, 0x14
mov eax, dword [ebp + 8]
pop esi
leave
ret
Function at 0x402c38
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0xc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x402c96
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push str.could_not_get_size_of_file__s
push eax
call fcn.004177f3
lea eax, [ebp - 0x104]
push eax
call fcn.004032d0
add esp, 0x10
push dword [esi]
call fcn.004177e5
pop ecx
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 4]
push edi
push ecx
mov dword [ebp - 4], edi
push dword [esi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402cda
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push str.could_not_read_file__s
push eax
call fcn.004177f3
lea eax, [ebp - 0x104]
push eax
call fcn.004032d0
add esp, 0x10
mov eax, dword [esi]
push str.There_was_an_error_in_reading_the_file_contents_into_memory.
cmp eax, dword [ebp - 4]
sete al
push eax
call fcn.00412a54
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4031b1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.ReflexiveArcadeRAW_004.wdt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40320b
push ebx
lea eax, [ebp - 4]
push esi
push eax
mov esi, 0x436ffc
push 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push edi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
pop ebx
je 0x40320b
cmp dword [ebp - 4], 8
jne 0x40320b
mov eax, esi
jmp 0x40320d
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x403211
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push str.ReflexiveArcadeRAW_004.wdt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40326e
lea eax, [ebp - 4]
push 0
push eax
push 8
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
setne byte [ebp + 0xb]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0xb], 0
je 0x40326a
cmp dword [ebp - 4], 8
jne 0x40326a
xor eax, eax
inc eax
jmp 0x403270
xor eax, eax
jmp 0x403270
xor al, al
pop esi
leave
ret 4

Function at 0x40408d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
lea eax, [ebp + 0xc]
push ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4040d6
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4040cd
mov bl, 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ebp
ret
Function at 0x4040db
Capabilities:
Create process on windows
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x950
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0xc], ecx
call fcn.00417e10
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 0x50], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x404159
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x950]
push str.GameWrapper:_Duplicate_Thread_Failed__last_error__x_n
push eax
call fcn.004177f3
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x40425c
push 2
push 1
lea eax, [ebp - 8]
push 0x100001
push eax
call esi
push eax
call fcn.00401038
mov ecx, eax
call fcn.004011e8
push eax
call esi
push eax
call edi
test eax, eax
jne 0x4041b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x950]
push str.GameWrapper:_Duplicate_Game_Failed__last_error__x_n
push eax
call fcn.004177f3
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40425c
push dword [ebp - 8]
mov edi, str.0x_08x
lea eax, [ebp - 0x150]
push edi
push eax
call fcn.004177f3
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
push str.GAME_HANDLE
call esi
push dword [ebp - 4]
lea eax, [ebp - 0x150]
push edi
push eax
call fcn.004177f3
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
push str.WRAPPER_HANDLE
call esi
mov eax, dword [ebp - 0xc]
add eax, 0x50
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
push str.ReflexiveArcadeRAW_003.wdt
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x404260
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x950]
push str.GameWrapper:_Create_Process_Failed__last_error__x_n
push eax
call fcn.004177f3
add esp, 0xc
lea eax, [ebp - 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
xor al, al
jmp 0x404262
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404267
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
push esi
push edi
push 0xc
mov dword [ebp - 4], ecx
call fcn.004177e5
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40428d
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x40428f
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0x100000
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x4042e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GameWrapper:_Duplicate_Thread_Failed__last_error__x_n
lea eax, [ebp - 0x808]
push eax
call fcn.004177f3
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test ebx, ebx
jmp 0x40438e
push 2
push 0
lea eax, [ebx + 4]
push 0x100000
push eax
call esi
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x54]
call esi
push eax
call edi
test eax, eax
jne 0x404314
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GameWrapper:_Duplicate_Process_Failed__last_error__x_n
jmp 0x4042c4
push 2
push 0
lea eax, [ebx + 8]
push 0x100001
push eax
call esi
push eax
call fcn.00401038
mov ecx, eax
call fcn.004011e8
push eax
call esi
push eax
call edi
test eax, eax
jne 0x40434b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GameWrapper:_Duplicate_Game_Failed__last_error__x_n
jmp 0x4042c4
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
push ebx
push 0x4043c6
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4043a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x808]
push str.GameWrapper:_Create_Thread_Failed__last_error__x_n
push eax
call fcn.004177f3
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp ebx, esi
je 0x40439e
mov ecx, ebx
call fcn.004043a9
push ebx
call fcn.00417416
pop ecx
xor al, al
jmp 0x4043a4
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404820
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov byte [esi + 0x15], 1
push dword [0x437bc0]
call edi
push 0x42f5b4
push dword [0x437bc0]
call dword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.00401038
mov ecx, eax
call fcn.00401d4e
mov ebx, eax
test ebx, ebx
je 0x4048db
and byte [esi + 0x14], 0
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 1
push ebx
call edi
lea edi, [esi + 4]
cmp dword [edi], 0
jne 0x404887
cmp dword [esi + 0xc], 0
je 0x4048db
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4048db
mov eax, dword [esi + 0xc]
cmp dword [ebp - 8], eax
jne 0x4048b5
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [edi]
jne 0x4048b5
mov ecx, dword [ebp - 4]
cmp ecx, dword [esi + 0x10]
jne 0x4048b5
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [esi + 8]
je 0x4048db
mov ecx, dword [esi + 8]
mov esi, dword [esi + 0x10]
mov edx, dword [edi]
sub esi, ecx
push 1
sub eax, edx
push esi
push eax
push ecx
push edx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x10
push 0
push edi
call fcn.00417e10
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405835
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push dword [0x437bc0]
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esi + 0x38]
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0xc], eax
xor eax, eax
cmp byte [esi], al
je 0x4058c7
mov dword [ebp - 4], eax
call fcn.00408660
test eax, eax
jle 0x4058e0
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x2c]
push eax
call fcn.004086e0
mov esi, eax
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
pop ecx
push 0xcc0020
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
inc dword [ebp - 4]
call fcn.00408660
cmp dword [ebp - 4], eax
jl 0x405877
pop edi
jmp 0x4058e0
push 0xcc0020
push eax
push eax
push ebx
push dword [esi + 0x30]
push dword [esi + 0x34]
push eax
push eax
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
push dword [0x437bc0]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop esi
pop ebx
leave
ret