joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x421088
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42b1d0]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
xor ebx, ebx
mov dword [esp + 0x64], ebx
mov edi, dword [esp + 0x7c]
cmp edi, dword [esp + 0x80]
jbe 0x406352
call fcn.00413a68
mov ebp, dword [esp + 0x70]
jmp 0x406360
mov esi, dword [esp + 0x80]
cmp dword [esp + 0x7c], esi
jbe 0x406372
call fcn.00413a68
cmp ebp, ebx
je 0x40637c
cmp ebp, dword [esp + 0x70]
je 0x406381
call fcn.00413a68
cmp edi, esi
je 0x4064ab
lea ecx, [esp + 0x1c]
push ecx
call fcn.00402480
mov byte [esp + 0x64], 1
cmp ebp, ebx
jne 0x40649e
call fcn.00413a68
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x4063b1
call fcn.00413a68
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [esp + 0x28]
call fcn.00401850
push 4
push str.NULL
lea ecx, [esp + 0x40]
call fcn.00401c30
sub esp, 0x38
mov esi, esp
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x5c]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push edx
mov ecx, esi
mov dword [esp + 0x58], esi
mov byte [esi + 4], bl
call fcn.00401850
push 0xffffffffffffffff
lea ecx, [esi + 0x1c]
mov byte [esp + 0xa0], 2
push ebx
lea eax, [esp + 0x78]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401850
mov esi, dword [esp + 0x50]
mov ecx, esi
mov byte [esp + 0x9c], 1
call fcn.004065c0
cmp eax, ebx
jne 0x406442
lea ecx, [esp + 0x1c]
push ecx
lea ebx, [esi + 0x64]
call fcn.00407830
xor ebx, ebx
mov esi, 0x10
mov byte [esp + 0x64], bl
cmp dword [esp + 0x50], esi
jb 0x40645e
mov edx, dword [esp + 0x3c]
push edx
call fcn.0041288e
add esp, 4
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], esi
jb 0x406481
mov eax, dword [esp + 0x20]
push eax
call fcn.0041288e
add esp, 4
cmp ebp, ebx
jne 0x4064a6
call fcn.00413a68
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x406496
call fcn.00413a68
add edi, 0x1c
jmp 0x406360
mov eax, dword [ebp]
jmp 0x4063a7
mov eax, dword [ebp]
jmp 0x40648c
mov esi, dword [esp + 0x7c]
cmp esi, ebx
je 0x4064f5
mov edi, dword [esp + 0x80]
cmp esi, edi
je 0x4064e8
add esi, 0x18
cmp dword [esi], 0x10
jb 0x4064d2
mov ecx, dword [esi - 0x14]
push ecx
call fcn.0041288e
add esp, 4
mov dword [esi], 0xf
mov dword [esi - 4], ebx
mov byte [esi - 0x14], bl
add esi, 0x1c
lea edx, [esi - 0x18]
cmp edx, edi
jne 0x4064c1
mov eax, dword [esp + 0x7c]
push eax
call fcn.0041288e
add esp, 4
mov ecx, dword [esp + 0x70]
push ecx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
call fcn.0041288e
add esp, 4
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00412899
add esp, 0x54
ret 0x1c
Function at 0x407510
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x421660
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42b1d0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x11c
mov ebx, ecx
xor edi, edi
call fcn.00412dc7
add esp, 4
push 0x11c
mov esi, eax
push edi
push esi
call fcn.004183e0
add esp, 0xc
push esi
mov dword [esi], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x407586
cmp dword [esi + 4], 6
jb 0x407586
cmp dword [esi + 8], 2
jb 0x407586
mov edi, 1
push esi
call fcn.00412cea
add esp, 4
test edi, edi
je 0x4075b3
call fcn.00405d00
test eax, eax
je 0x4075b3
push str.CRNdisDevice::ModifyMyREG__:_FindWin8OSVersion____MatchedMBIM__
call fcn.004124a0
add esp, 4
mov eax, 1
jmp 0x4076bd
mov eax, dword [ebx + 0x44]
cmp eax, 0xffffffff
je 0x4076ba
test eax, eax
je 0x4076ba
cmp dword [ebx + 0xc0], 0
jbe 0x4076ba
cmp dword [ebx + 0x5c], 0
jbe 0x4076ba
push 0x423d93
lea ecx, [esp + 0x20]
call fcn.00401500
push 0x2e
mov dword [esp + 0x64], 0
push str.SYSTEMCurrentControlSetControlusbflags12D1
lea eax, [esp + 0x24]
mov byte [esp + 0x20], 1
mov byte [esp + 0x21], 0xee
call fcn.00401740
push 0
lea ebp, [ebx + 0x48]
push ebp
or eax, 0xffffffff
lea esi, [esp + 0x24]
call fcn.00401b40
lea eax, [ebx + 0xac]
push 0
push eax
or eax, 0xffffffff
call fcn.00401b40
cmp dword [esp + 0x34], 0x10
mov ecx, dword [esp + 0x20]
jae 0x407640
lea ecx, [esp + 0x20]
lea edi, [esp + 0x18]
call fcn.004048f0
push eax
push str.ModifRegist_return:__d
mov dword [ebx + 0x44], eax
call fcn.004124a0
add esp, 8
push str.12d1
lea ecx, [esp + 0x3c]
call fcn.00401500
push 0
push ebp
or eax, 0xffffffff
lea esi, [esp + 0x40]
mov byte [esp + 0x68], 1
call fcn.00401b40
push 0
lea eax, [ebx + 0xac]
push eax
or eax, 0xffffffff
call fcn.00401b40
cmp dword [esp + 0x50], 0x10
mov edi, dword [esp + 0x3c]
jae 0x40769c
lea edi, [esp + 0x3c]
call fcn.00405fb0
mov ebx, dword [ebx + 0x44]
lea ecx, [esp + 0x38]
call fcn.00401570
lea ecx, [esp + 0x1c]
call fcn.00401570
mov eax, ebx
jmp 0x4076bd
or eax, 0xffffffff
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00412899
add esp, 0x50
ret
Function at 0x40a3c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
mov ebp, dword [esp + 0x110]
push esi
push edi
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
mov esi, edx
call fcn.004183e0
add esp, 0xc
push edi
push 0x104
lea ecx, [esp + 0x14]
push ecx
push str.This_value_is_not_found
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0xc]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a415
sub eax, ecx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00401c30
mov edi, dword [esi + 0x14]
mov eax, edi
cmp edi, 0x17
jb 0x40a43a
mov eax, 0x17
cmp dword [esi + 0x18], 0x10
jb 0x40a445
mov esi, dword [esi + 4]
jmp 0x40a448
add esi, 4
mov ecx, str.This_value_is_not_found
mov edx, esi
call fcn.00401040
test eax, eax
jne 0x40a47f
cmp edi, 0x17
jb 0x40a47f
cmp edi, 0x17
setne al
test eax, eax
jne 0x40a47f
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00412899
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00412899
add esp, 0x108
ret
Function at 0x40b760
Capabilities:
Get disk information

Disassembly:
sub esp, 0x324
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x320], eax
push ebx
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x18]
push 0
push eax
mov ebx, ecx
call fcn.004183e0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x228]
push 0
push ecx
call fcn.004183e0
add esp, 0xc
push 0x104
lea edx, [esp + 0x120]
push 0
push edx
call fcn.004183e0
mov ebp, dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
add esp, 0xc
mov dword [esp + 0x10], 5
lea ebx, [ebx]
mov esi, 0x61
lea edi, [esi - 0x47]
jmp 0x40b7e0
push esi
lea eax, [esp + 0x18]
push 0x425748
push eax
call fcn.004132bd
add esp, 0xc
push 0x104
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call ebp
test eax, eax
je 0x40b868
push str.Harddisk
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x40b868
lea ecx, [esp + 0x14]
call fcn.0040c6e0
test eax, eax
je 0x40b853
push esi
lea ecx, [esp + 0x120]
push str.._c:
push ecx
call fcn.004132bd
add esp, 0xc
lea ecx, [esp + 0x11c]
call fcn.0040b600
jmp 0x40b868
lea edx, [esp + 0x11c]
push edx
push str._s_is_not_huawei_SD_Card
call fcn.004124a0
add esp, 8
inc esi
sub edi, 1
jne 0x40b7e0
sub dword [esp + 0x10], 1
jne 0x40b7d0
mov ecx, dword [esp + 0x330]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00412899
add esp, 0x324
ret
Function at 0x40e120
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
mov ebp, dword [esp + 0x110]
push esi
push edi
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
mov esi, edx
call fcn.004183e0
add esp, 0xc
push edi
push 0x104
lea ecx, [esp + 0x14]
push ecx
push str.This_value_is_not_found
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0xc]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e175
sub eax, ecx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00401c30
mov edi, dword [esi + 0x14]
mov eax, edi
cmp edi, 0x17
jb 0x40e19a
mov eax, 0x17
cmp dword [esi + 0x18], 0x10
jb 0x40e1a5
mov esi, dword [esi + 4]
jmp 0x40e1a8
add esi, 4
mov ecx, str.This_value_is_not_found
mov edx, esi
call fcn.00401040
test eax, eax
jne 0x40e1c7
cmp edi, 0x17
jb 0x40e1c7
cmp edi, 0x17
setne al
test eax, eax
je 0x40e1cc
mov eax, 1
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00412899
add esp, 0x108
ret 4

Function at 0x40e9b0
Capabilities:
Terminate thread

Disassembly:
cmp byte [esi + 0x18], 0
je 0x40e9c2
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi + 0x10], 0
jne 0x40e9de
cmp byte [esi + 0x18], 0
je 0x40e9d8
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 0xfffffffc
ret
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [esi + 0x10], 0
cmp byte [esi + 0x18], 0
je 0x40e9fe
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
ret
Function at 0x40f310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jg 0x40f332
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040efbb
push eax
push esi
push dword [ebp + 8]
call fcn.0040ef70
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040efbb
push eax
push esi
push dword [ebp + 8]
call fcn.0040ef70
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040efbb
push eax
push esi
push dword [ebp + 8]
call fcn.0040ef70
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040efab
invalid
retf
Function at 0x411840
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x42b1d0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
mov ebp, dword [esp + 0x110]
push esi
push edi
push 0x104
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
mov esi, edx
call fcn.004183e0
add esp, 0xc
push edi
push 0x104
lea ecx, [esp + 0x14]
push ecx
push 0x423d93
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0xc]
push edx
call fcn.00412c85
mov ecx, eax
add esp, 4
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4118a0
sub ecx, edi
push ecx
push eax
mov ecx, esi
call fcn.00401c30
cmp dword [esi + 0x18], 0x10
mov edi, dword [esi + 0x14]
mov eax, edi
jb 0x4118c2
mov esi, dword [esi + 4]
jmp 0x4118c5
add esi, 4
xor eax, eax
mov ecx, 0x423d93
mov edx, esi
call fcn.00401040
test eax, eax
jne 0x4118dc
test edi, edi
setne al
xor ecx, ecx
test eax, eax
setne cl
pop edi
pop esi
pop ebp
mov eax, ecx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00412899
add esp, 0x108
ret

Function at 0x411a30
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.JThread.0
cmp byte [esi + 0x18], 0
push edi
je 0x411a4c
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi + 0x10], 0
jne 0x411a5e
cmp byte [esi + 0x18], 0
je 0x411a7e
mov ecx, dword [esi + 0x14]
push ecx
jmp 0x411a78
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov byte [esi + 0x10], 0
cmp byte [esi + 0x18], 0
je 0x411a7e
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp byte [esi + 0x28], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x411a90
mov ecx, dword [esi + 0x24]
push ecx
call edi
cmp byte [esi + 0x20], 0
je 0x411a9c
mov edx, dword [esi + 0x1c]
push edx
call edi
cmp byte [esi + 0x18], 0
je 0x411aa8
mov eax, dword [esi + 0x14]
push eax
call edi
pop edi
pop esi
ret
Function at 0x411ab0
Capabilities:
Check mutex on windows
Create thread

Disassembly:
cmp byte [esi + 0x2c], 0
push ebx
push edi
jne 0x411b0b
cmp byte [esi + 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov bl, 1
jne 0x411ad8
push 0
push 0
push 0
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x411b3d
mov byte [esi + 0x18], bl
cmp byte [esi + 0x20], 0
jne 0x411af0
push 0
push 0
push 0
call edi
mov dword [esi + 0x1c], eax
test eax, eax
je 0x411b3d
mov byte [esi + 0x20], bl
cmp byte [esi + 0x28], 0
jne 0x411b08
push 0
push 0
push 0
call edi
mov dword [esi + 0x24], eax
test eax, eax
je 0x411b3d
mov byte [esi + 0x28], bl
mov byte [esi + 0x2c], bl
cmp byte [esi + 0x18], 0
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x411b1f
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call edi
cmp byte [esi + 0x10], 0
je 0x411b43
cmp byte [esi + 0x18], 0
je 0x411b35
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 0xfffffffb
pop ebx
ret
pop edi
or eax, 0xffffffff
pop ebx
ret
cmp byte [esi + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
je 0x411b55
mov edx, dword [esi + 0x14]
push edx
call ebx
cmp byte [esi + 0x20], 0
je 0x411b63
mov eax, dword [esi + 0x1c]
push 0xffffffffffffffff
push eax
call edi
mov eax, dword [esi + 4]
test eax, eax
je 0x411b78
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
lea ecx, [esi + 8]
push ecx
push 0
push esi
push 0x411c20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x411ba8
cmp byte [esi + 0x20], al
je 0x411ba0
mov edx, dword [esi + 0x1c]
push edx
call ebx
pop edi
mov eax, 0xfffffffe
pop ebx
ret
cmp byte [esi + 0x18], 0
je 0x411bb6
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call edi
cmp byte [esi + 0x10], 0
jne 0x411be0
lea esp, [esp]
cmp byte [esi + 0x18], 0
je 0x411bda
mov ecx, dword [esi + 0x14]
push ecx
call ebx
cmp byte [esi + 0x18], 0
je 0x411bda
mov edx, dword [esi + 0x14]
push 0xffffffffffffffff
push edx
call edi
cmp byte [esi + 0x10], 0
je 0x411bc0
cmp byte [esi + 0x18], 0
je 0x411bec
mov eax, dword [esi + 0x14]
push eax
call ebx
cmp byte [esi + 0x20], 0
je 0x411bf8
mov ecx, dword [esi + 0x1c]
push ecx
call ebx
cmp byte [esi + 0x28], 0
je 0x411c12
mov edx, dword [esi + 0x24]
push 0xffffffffffffffff
push edx
call edi
cmp byte [esi + 0x28], 0
je 0x411c12
mov eax, dword [esi + 0x24]
push eax
call ebx
pop edi
xor eax, eax
pop ebx
ret

Function at 0x412899
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b1d0]
jne 0x4128a3
repz ret
jmp fcn.00414a46
Function at 0x41d0bf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00415997
and dword [ebp - 4], 0
cmp dword [0x42cc44], 0
mov ebx, eax
jne 0x41d170
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d221
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41d221
push eax
call fcn.00415925
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42cc44], eax
call esi
push eax
call fcn.00415925
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42cc48], eax
call esi
push eax
call fcn.00415925
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42cc4c], eax
call esi
push eax
call fcn.00415925
pop ecx
mov dword [0x42cc54], eax
test eax, eax
je 0x41d170
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00415925
pop ecx
mov dword [0x42cc50], eax
mov eax, dword [0x42cc50]
cmp eax, ebx
je 0x41d1c8
cmp dword [0x42cc54], ebx
je 0x41d1c8
push eax
call fcn.004159a0
push dword [0x42cc54]
mov esi, eax
call fcn.004159a0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d1c8
test edi, edi
je 0x41d1c8
call esi
test eax, eax
je 0x41d1bf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d1bf
test byte [ebp - 0xc], 1
jne 0x41d1c8
or dword [ebp + 0x10], 0x200000
jmp 0x41d201
mov eax, dword [0x42cc48]
cmp eax, ebx
je 0x41d201
push eax
call fcn.004159a0
pop ecx
test eax, eax
je 0x41d201
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d201
mov eax, dword [0x42cc4c]
cmp eax, ebx
je 0x41d201
push eax
call fcn.004159a0
pop ecx
test eax, eax
je 0x41d201
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42cc44]
call fcn.004159a0
pop ecx
test eax, eax
je 0x41d221
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d223
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402470
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [ebp + 8]
movq xmm0, qword [ecx + 6]
push ebx
push esi
movzx eax, word [ecx + 4]
lea esi, [ecx + 6]
push edi
mov word [ebp - 0x1c], ax
movzx eax, word [esi + 8]
push esi
mov word [ebp - 0x12], ax
mov al, byte [esi + 0xa]
push str.SELECT__FROM_CashShopData_WHERE_AccountID_s
push 0x43ddd8
mov dword [ebp - 0x20], 0x1820c1
movq qword [ebp - 0x1a], xmm0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], 0
call fcn.00414490
add esp, 0xc
test al, al
je 0x40256c
push dword [0x43dde4]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x40256c
push str.WCoinC
call fcn.004146e0
cmp eax, 0xffffffff
jne 0x4024ee
or eax, eax
jmp 0x4024ff
shl eax, 0xd
add eax, 0x43f5be
push eax
call fcn.0041d98e
add esp, 4
push str.WCoinP
mov dword [ebp - 0xc], eax
call fcn.004146e0
cmp eax, 0xffffffff
jne 0x402515
or eax, eax
jmp 0x402526
shl eax, 0xd
add eax, 0x43f5be
push eax
call fcn.0041d98e
add esp, 4
push str.GoblinPoint
mov dword [ebp - 8], eax
call fcn.004146e0
cmp eax, 0xffffffff
jne 0x40253c
or eax, eax
jmp 0x40254d
shl eax, 0xd
add eax, 0x43f5be
push eax
call fcn.0041d98e
add esp, 4
push dword [0x43dde4]
mov dword [ebp - 4], eax
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x43dde4]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
jmp 0x4025da
push dword [0x43dde4]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call edi
mov ebx, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x43dde4]
call ebx
push esi
push str.INSERT_INTO_CashShopData__AccountID_WCoinC_WCoinP_GoblinPoint__VALUES___s_0_0_0_
push 0x43ddd8
call fcn.00414490
add esp, 0xc
push dword [0x43dde4]
test al, al
jne 0x4025b9
call edi
push 2
push dword [0x43dde4]
call ebx
mov byte [ebp - 0xf], 1
jmp 0x4025da
call edi
push 2
push dword [0x43dde4]
call ebx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x20
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.00415d90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402600
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov ecx, dword [ebp + 8]
movq xmm0, qword [ecx + 6]
lea edx, [ecx + 6]
push esi
push edi
movzx eax, word [ecx + 4]
mov word [ebp - 0x38], ax
movzx eax, word [edx + 8]
mov word [ebp - 0x2e], ax
mov al, byte [edx + 0xa]
mov byte [ebp - 0x2c], al
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x20], eax
movzx eax, word [ecx + 0x20]
mov word [ebp - 0x1c], ax
mov eax, dword [ecx + 0x24]
push edx
mov dword [ebp - 0x18], eax
mov al, byte [ecx + 0x28]
push str.SELECT__FROM_CashShopData_WHERE_AccountID_s
push 0x43ddd8
mov dword [ebp - 0x3c], 0x1183cc1
mov dword [ebp + 8], edx
movq qword [ebp - 0x36], xmm0
mov byte [ebp - 0x2b], 0
mov byte [ebp - 0x14], al
call fcn.00414490
add esp, 0xc
test al, al
je 0x40278b
push dword [0x43dde4]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x40278b
push str.WCoinC
call fcn.004146e0
cmp eax, 0xffffffff
jne 0x4026a6
or eax, eax
jmp 0x4026b7
shl eax, 0xd
add eax, 0x43f5be
push eax
call fcn.0041d98e
add esp, 4
push str.WCoinP
mov dword [ebp - 0x10], eax
call fcn.004146e0
cmp eax, 0xffffffff
jne 0x4026cd
or eax, eax
jmp 0x4026de
shl eax, 0xd
add eax, 0x43f5be
push eax
call fcn.0041d98e
add esp, 4
push str.GoblinPoint
mov dword [ebp - 0xc], eax
call fcn.004146e0
cmp eax, 0xffffffff
jne 0x4026f4
or eax, eax
jmp 0x402705
shl eax, 0xd
add eax, 0x43f5be
push eax
call fcn.0041d98e
add esp, 4
push dword [0x43dde4]
mov esi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
mov dword [ebp - 8], eax
call esi
mov edi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x43dde4]
call edi
push 0x53
push dword [ebp + 8]
push str.SELECT_count___FROM_CashShopInventory_WHERE_AccountID_s_AND_InventoryType_d
push 0x43ddd8
call fcn.00414490
add esp, 0x10
test al, al
je 0x402777
push dword [0x43dde4]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x402777
push 0x43f5be
call fcn.0041d98e
add esp, 4
mov dword [ebp - 4], eax
push dword [0x43dde4]
call esi
push 2
push dword [0x43dde4]
call edi
jmp 0x4027a9
push dword [0x43dde4]
call esi
push 2
push dword [0x43dde4]
call edi
jmp 0x4027a5
push dword [0x43dde4]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x43dde4]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov byte [ebp - 0x2b], 1
push 0x3c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0xc]
call fcn.00415d90
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8