joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405580
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x476590
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0x47bd30
lea ecx, [esp + 8]
call fcn.00402f80
mov edx, dword [esp + 4]
mov eax, dword [edx - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [edx - 8]
sub eax, 0x105
or eax, ecx
mov dword [esp + 0x10], 0
jge 0x4055da
push 0x105
lea ecx, [esp + 8]
call fcn.00401800
mov edx, dword [esp + 4]
push esi
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4055f3
xor eax, eax
jmp 0x405607
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4055f8
sub eax, esi
js 0x40571c
cmp eax, dword [ecx - 8]
jg 0x40571c
mov dword [ecx - 0xc], eax
mov ecx, dword [esp + 8]
mov byte [eax + ecx], 0
call fcn.0046990a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edx, [eax + 0x10]
mov dword [esp + 4], edx
mov eax, dword [edx - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [edx - 8]
sub eax, 0x105
or eax, ecx
mov byte [esp + 0x14], 1
jge 0x40565b
push 0x105
lea ecx, [esp + 8]
call fcn.00401800
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push edx
push 0
push 0x47bd2c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, dword [esp + 4]
test edx, edx
jne 0x40567a
xor eax, eax
jmp 0x40568f
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405680
sub eax, esi
js 0x40571c
cmp eax, dword [edx - 8]
jg 0x40571c
mov dword [edx - 0xc], eax
mov ecx, dword [esp + 4]
lea edx, [esp + 4]
mov byte [eax + ecx], 0
mov ecx, dword [esp + 0x20]
push edx
call fcn.00404df0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call fcn.004052c0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 8
mov byte [esp + 0x14], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4056e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40570c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
push 0x80070057
call fcn.004011a0
int3

Function at 0x405a00
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareNexonCStrike_OnlineSettings_
push reloc.WS2_32.dll_accept
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405a51
mov ecx, dword [esp + 0xc]
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push str.ConnectionTime
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x405a60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x14
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareNexonCStrike_OnlineSettings_
push reloc.WS2_32.dll_accept
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405aed
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push str.ConnectionFailed
push edx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405ac8
inc dword [esp]
jmp 0x405acf
mov dword [esp], 1
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 4
push 0
push str.ConnectionFailed
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x14
ret
Function at 0x40cde0
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push edi
push eax
call fcn.00468d00
mov ebx, dword [esp + 0x18]
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push ebx
mov dword [esi + 0x10], 0
mov dword [esp + 0x14], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x40ce22
pop edi
pop esi
mov eax, 0x80004005
pop ebx
pop ecx
ret 4
push edi
call fcn.00468d05
add esp, 4
test eax, eax
mov dword [esi + 0x10], eax
jne 0x40ce3e
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
pop ecx
ret 4
mov edx, dword [esp + 0xc]
push eax
push edi
push edx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40ce77
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x40ce64
call esi
pop edi
pop esi
pop ebx
pop ecx
ret 4
call esi
pop edi
and eax, 0xffff
pop esi
or eax, 0x80070000
pop ebx
pop ecx
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x40f390
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x476f91
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
mov eax, dword [0x49afa0]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x274]
mov dword [esp + 0x260], eax
cmp dword [edi + 0x18], 0x10
mov ebp, ecx
lea esi, [edi + 4]
jb 0x40f3d1
mov eax, dword [esi]
jmp 0x40f3d3
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40f3e3
test al, 0x10
je 0x40f415
xor ebx, ebx
push ebx
lea esi, [ebp + 0x14]
push 0x47bd2c
mov ecx, esi
call fcn.004083b0
push 0x10
push str.File_not_found:
mov ecx, esi
call fcn.0040b980
push 0xffffffffffffffff
push ebx
push edi
mov ecx, esi
call fcn.0040b890
xor al, al
jmp 0x40f561
mov eax, dword [edi + 0x18]
xor ebx, ebx
cmp eax, 0x10
mov dword [esp + 0x14], ebx
jb 0x40f425
mov esi, dword [esi]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edi, 0xf
lea eax, [esp + 0x50]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40f453
sub eax, edx
push eax
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x3c]
call fcn.004083b0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x158]
push ecx
push 0x104
mov dword [esp + 0x274], ebx
mov byte [eax], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edx, [esp + 0x50]
push edx
call esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
push ecx
mov ecx, ebp
mov byte [esp + 0x274], 2
call fcn.0040eee0
test al, al
jne 0x40f508
mov eax, dword [esp + 0x30]
mov ebp, 0x10
cmp eax, ebp
jb 0x40f4db
mov edx, dword [esp + 0x1c]
push edx
call fcn.00468d00
add esp, 4
lea eax, [esp + 0x158]
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call esi
cmp dword [esp + 0x4c], ebp
jb 0x40f504
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00468d00
add esp, 4
xor al, al
jmp 0x40f561
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
mov ecx, ebp
call fcn.00410530
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x30]
mov ebp, 0x10
cmp eax, ebp
jb 0x40f534
mov eax, dword [esp + 0x1c]
push eax
call fcn.00468d00
add esp, 4
lea ecx, [esp + 0x158]
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call esi
cmp dword [esp + 0x4c], ebp
jb 0x40f55d
mov edx, dword [esp + 0x38]
push edx
call fcn.00468d00
add esp, 4
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x254]
pop ebx
call fcn.004497f7
add esp, 0x260
ret 4
Function at 0x4119e0
Capabilities:
Execute vbscript javascript or jscript in memory

Disassembly:
push 0xffffffffffffffff
push 0x477391
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x49afa0]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], esi
call fcn.00468834
lea edi, [esi + 0x20]
mov dword [esi], method.CEnumUnknown.virtual_0
mov dword [esi + 0x1c], 0x47d008
mov dword [esp + 0x38], 0
mov dword [edi], 0
lea ebx, [esi + 0x24]
mov dword [ebx], 0
lea ebp, [esi + 0x28]
mov dword [ebp], 0
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x3c], 3
mov dword [esi + 0x2c], ecx
call fcn.004119b0
test ebp, ebp
mov eax, dword [eax]
mov dword [esp + 0x40], eax
je 0x411a83
test eax, eax
je 0x411a6f
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esp + 0x40]
mov ecx, dword [ebp]
test ecx, ecx
je 0x411a80
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, dword [esp + 0x40]
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x411a91
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, esi
call fcn.004744d6
lea edx, [esp + 0x1c]
push edx
push str.JavaScript
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
test eax, eax
jl 0x411ac1
push edi
push 0x47cff8
push 0x17
push 0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [edi]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x10], eax
je 0x411ae0
mov edx, dword [ecx]
lea eax, [esp + 0x10]
push eax
push 0x47d0a4
push ecx
call dword [edx]
mov eax, dword [esp + 0x10]
test ebx, ebx
mov byte [esp + 0x38], 4
mov ebp, eax
je 0x411b03
test eax, eax
je 0x411af5
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebx]
test eax, eax
je 0x411b01
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [ebx], ebp
mov eax, dword [edi]
mov edx, dword [eax]
lea ecx, [esi + 0x1c]
push ecx
push eax
call dword [edx + 0xc]
mov eax, dword [edi]
mov ecx, dword [eax]
push 2
push str.host
push eax
call dword [ecx + 0x20]
mov eax, dword [edi]
mov edx, dword [eax]
push 2
push 0x47d088
push eax
call dword [edx + 0x20]
mov eax, dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edi, dword [edi]
mov edx, dword [edi]
push 2
push edi
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
mov byte [esp + 0x38], 3
je 0x411b52
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0x30]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x20]
pop ebx
call fcn.004497f7
add esp, 0x2c
ret 4
Function at 0x4160b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477a1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
lea ecx, [esi + 0x4c]
push eax
push edx
mov dword [esp + 0x20], 5
call fcn.0041fb20
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x40]
lea ecx, [esi + 0x38]
push eax
push edx
mov byte [esp + 0x20], 4
call fcn.0041fb20
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x30]
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
push edx
rep stosb byte es:[edi], al
call fcn.00468d00
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
push edx
rep stosb byte es:[edi], al
call fcn.00468d00
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
push edx
rep stosb byte es:[edi], al
call fcn.00468d00
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov esi, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
push edx
rep stosb byte es:[edi], al
call fcn.00468d00
mov ecx, dword [esp + 0x20]
add esp, 0x10
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4160c7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477a1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
lea ecx, [esi + 0x4c]
push eax
push edx
mov dword [esp + 0x20], 5
call fcn.0041fb20
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x40]
lea ecx, [esi + 0x38]
push eax
push edx
mov byte [esp + 0x20], 4
call fcn.0041fb20
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x30]
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
push edx
rep stosb byte es:[edi], al
call fcn.00468d00
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
push edx
rep stosb byte es:[edi], al
call fcn.00468d00
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
push edx
rep stosb byte es:[edi], al
call fcn.00468d00
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov esi, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
push edx
rep stosb byte es:[edi], al
call fcn.00468d00
mov ecx, dword [esp + 0x20]
add esp, 0x10
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4163c6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x477aa7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 1
mov dword [esp + 8], esi
call fcn.004267c0
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esp + 0x10], 1
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 7
call fcn.00421db0
lea ecx, [esi + 0x48]
mov byte [esp + 0x10], 8
call fcn.00421db0
mov ecx, dword [esp + 8]
mov byte [esi + 0x5c], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4172b0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
cmp eax, 0xea60
mov dword [esp + 0xc], eax
jbe 0x4172ca
mov dword [esp + 0xc], 0xea60
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareNexonCStrike_OnlineSettings_
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41730f
push 4
lea edx, [esp + 0x10]
push edx
push 4
push eax
mov eax, dword [esp + 0x10]
push str.Upload
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret 4

Function at 0x4173a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareNexonCStrike_OnlineSettings_
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41740b
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 4]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push str.Upload
push edx
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41740b
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add esp, 0x14
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add esp, 0x14
ret
Function at 0x417580
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x477b4b
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
lea eax, [esp + 0x10]
push eax
mov ebx, ecx
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareNexonCStrike_OnlineSettings_
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41769b
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.Upload
push edx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41769b
push esi
push edi
call fcn.0044a7cb
cdq
mov ecx, 0xa
idiv ecx
mov ecx, ebx
mov edi, dword [edx*8 + 0x498820]
call fcn.00417360
test al, al
jne 0x417623
mov ecx, ebx
call fcn.00417320
push 8
call fcn.00468cd5
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x2c], 0
je 0x417648
mov ecx, eax
call fcn.0041d8c0
mov esi, eax
jmp 0x41764a
xor esi, esi
mov ecx, esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.0041d900
push str.Dummy.dat
push edi
mov ecx, esi
call fcn.0041d970
mov ecx, dword [esp + 0x14]
cmp ecx, eax
ja 0x417676
cmp ecx, 0xc8
jae 0x41767e
push eax
mov ecx, ebx
call fcn.004172b0
mov ecx, esi
call fcn.0041d8e0
test esi, esi
je 0x417699
mov ecx, esi
call fcn.0041d8d0
push esi
call fcn.00468d00
add esp, 4
pop edi
pop esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x41c610
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareNexonCStrike_OnlineSettings_
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41c669
mov edx, dword [esp + 0xc]
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c648
sub eax, esi
inc eax
push eax
push edx
mov edx, dword [esp + 0xc]
push 1
push 0
push str.RegionCode
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret 4

Function at 0x41c680
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x24
mov eax, dword [0x49afa0]
push esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0xc]
push eax
mov esi, ecx
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareNexonCStrike_OnlineSettings_
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41c6fb
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push str.RegionCode
push edx
mov dword [esp + 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esi + 0x4c]
test eax, eax
mov eax, dword [ecx]
jne 0x41c6f3
lea edx, [esp + 0x14]
push edx
jmp 0x41c6f8
push 0x47ddd8
call dword [eax + 0x2c]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
pop esi
call fcn.004497f7
add esp, 0x24
ret
Function at 0x4218d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x478898
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push str.Integer:_division_by_zero
mov esi, ecx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
call fcn.0044b9e0
add esp, 4
push eax
push str.Integer:_division_by_zero
lea ecx, [esp + 0xc]
call fcn.004083b0
lea eax, [esp + 4]
push eax
push 6
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00413f90
cmp dword [esp + 0x1c], 0x10
jb 0x421946
mov ecx, dword [esp + 8]
push ecx
call fcn.00468d00
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x47ec50
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x421960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x478898
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push str.BER_decode_error
mov esi, ecx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
call fcn.0044b9e0
add esp, 4
push eax
push str.BER_decode_error
lea ecx, [esp + 0xc]
call fcn.004083b0
lea eax, [esp + 4]
push eax
push 1
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00413f90
cmp dword [esp + 0x1c], 0x10
mov dword [esi], 0x47ec50
jb 0x4219dc
mov ecx, dword [esp + 8]
push ecx
call fcn.00468d00
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x47ec58
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x424b30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x478b50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x24]
mov dword [esp + 0xc], 0
call fcn.00421db0
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0
call fcn.00421db0
mov eax, dword [esp + 0x4c]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x50], 1
call fcn.004249f0
mov ebx, dword [esp + 0x58]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00421e30
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
lea ecx, [esi*4]
push ecx
push 0
push edi
call fcn.0044bea0
add esp, 0xc
cmp esi, 4
push edi
jb 0x424bc4
call fcn.0044bf7b
jmp 0x424bc9
call fcn.00468d00
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
add esp, 4
lea edx, [esi*4]
push edx
push 0
push edi
call fcn.0044bea0
add esp, 0xc
cmp esi, 4
push edi
jb 0x424bf4
call fcn.0044bf7b
jmp 0x424bf9
call fcn.00468d00
mov ecx, dword [esp + 0x3c]
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x424c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x478b10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.00421db0
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], 0
call fcn.00421db0
mov eax, dword [esp + 0x4c]
push eax
push esi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x50], 1
call fcn.004249f0
mov ebx, dword [esp + 0x58]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00421e30
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
lea ecx, [esi*4]
push ecx
push 0
push edi
call fcn.0044bea0
add esp, 0xc
cmp esi, 4
push edi
jb 0x424cb4
call fcn.0044bf7b
jmp 0x424cb9
call fcn.00468d00
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
add esp, 4
lea edx, [esi*4]
push edx
push 0
push edi
call fcn.0044bea0
add esp, 0xc
cmp esi, 4
push edi
jb 0x424ce4
call fcn.0044bf7b
jmp 0x424ce9
call fcn.00468d00
mov ecx, dword [esp + 0x3c]
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 8

Function at 0x427850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x478e98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push str.VerifierFilter:_digital_signature_not_valid
mov esi, ecx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
call fcn.0044b9e0
add esp, 4
push eax
push str.VerifierFilter:_digital_signature_not_valid
lea ecx, [esp + 0xc]
call fcn.004083b0
lea eax, [esp + 4]
push eax
push 3
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00413f90
cmp dword [esp + 0x1c], 0x10
jb 0x4278c6
mov ecx, dword [esp + 8]
push ecx
call fcn.00468d00
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x47ec50
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x427ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x478e98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push esi
push str.:_Nonblocking_input_is_not_implemented_by_this_object.
mov esi, ecx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0040bc10
add esp, 0xc
push eax
push 0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00413f90
cmp dword [esp + 0x1c], 0x10
mov dword [esi], 0x47ec50
jb 0x427b2e
mov edx, dword [esp + 8]
push edx
call fcn.00468d00
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x47ec58
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4