joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434c70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x528
push esi
xor esi, esi
cmp word [0x14c76fc], si
je 0x434c95
mov eax, dword [esp + 0x530]
cmp eax, dword [0x4d73d0]
je 0x434e9f
cmp dword [0x14d1bd0], esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
push edi
jne 0x434db1
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
xor ebp, ebp
mov dword [esp + 0x1c], esi
jmp 0x434cc0
xor esi, esi
lea esp, [esp]
movzx ecx, word [esp + 0x1c]
mov edi, dword [ecx*4 + 0x4d73d4]
push 1
call fcn.0043d050
push 2
push esi
push edi
lea edi, [esp + 0x3c]
call fcn.00472860
add esp, 0x10
test eax, eax
je 0x434ea7
push esi
mov esi, dword [esp + 0x30]
push esi
call dword [section..xqrf]
push 0
lea edx, [esp + 0x2c]
push edx
mov edi, eax
push 2
lea eax, [esp + 0x30]
push eax
push esi
call ebx
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x2c]
push edx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x20]
movzx eax, cx
mov edx, 0x7ffffffe
sub edx, eax
lea eax, [edi + edx*2]
cmp eax, ebp
jbe 0x434d39
mov ebp, eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
cmp ax, dx
jbe 0x434d4c
mov edx, eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x10]
cmp cx, ax
jbe 0x434d5b
mov eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
inc ecx
cmp cx, 4
mov dword [esp + 0x1c], ecx
jb 0x434cba
movzx eax, ax
movzx ecx, dx
add eax, ecx
shl eax, 2
mov edx, 0x12985f4
call fcn.00474ce0
mov dword [0x14d1bc8], eax
mov eax, ebp
mov edx, 0x12985f4
call fcn.00474ce0
mov dword [0x14d1bd0], eax
movzx eax, word [esp + 0x10]
shl eax, 1
mov edx, 0x12985f4
call fcn.00474ce0
mov dword [0x14d1bcc], eax
xor esi, esi
mov edx, dword [esp + 0x53c]
mov edi, dword [edx*4 + 0x4d73d4]
push 1
call fcn.0043d050
push 2
push esi
push edi
lea edi, [esp + 0x3c]
call fcn.00472860
add esp, 0x10
test eax, eax
je 0x434ea7
push esi
mov esi, dword [esp + 0x30]
push esi
call dword [section..xqrf]
push 0
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push 2
lea ecx, [esp + 0x20]
push ecx
push esi
call ebx
push 0
lea edx, [esp + 0x1c]
push edx
push 2
lea eax, [esp + 0x1c]
push eax
push esi
call ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [eax + ecx]
mov word [0x14c76fc], dx
push 0
movzx edx, ax
mov eax, dword [0x14d1bcc]
mov word [0x14c7700], cx
lea ecx, [esp + 0x1c]
push ecx
shl edx, 1
push edx
push eax
push esi
call ebx
movzx edx, word [esp + 0x10]
push 0
lea ecx, [esp + 0x1c]
push ecx
mov eax, 0x7ffffffe
sub eax, edx
mov edx, dword [0x14d1bd0]
lea ecx, [edi + eax*2]
push ecx
push edx
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cx, word [0x14c76fc]
test cx, cx
mov eax, dword [0x14d1bd0]
jbe 0x434e8f
mov edx, dword [0x14d1bc8]
movzx esi, cx
nop
mov dword [edx], eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x434e82
add edx, 4
dec esi
jne 0x434e80
mov edx, dword [esp + 0x53c]
pop edi
pop ebp
mov dword [0x4d73d0], edx
pop ebx
pop esi
add esp, 0x528
ret
pop edi
pop ebp
pop ebx
mov word [0x14c7700], si
mov word [0x14c76fc], si
pop esi
add esp, 0x528
ret
Function at 0x4350e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x510
push esi
push edi
push 1
mov esi, eax
call fcn.0043d050
push 2
push 0
push esi
lea edi, [esp + 0x1c]
call fcn.00472860
add esp, 0x10
test eax, eax
je 0x435167
mov esi, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0xc]
push eax
push 4
push 0x14c76e0
push esi
call edi
mov eax, dword [0x14c76e0]
imul eax, eax, 0x1c
push eax
mov dword [0x1298608], 0
call dword [0x1269d34]
mov edx, dword [0x14c76e0]
imul edx, edx, 0x1c
add esp, 4
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push eax
push esi
mov dword [0x14c76dc], eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x510
ret
push esi
push str.Unable_to_open_sound_group_definitions_file__s_n
call fcn.004777d0
push str.Cant_locate_audgroup.dat
push 0x4c38e4
call fcn.004777d0
add esp, 0x10
pop edi
mov dword [0x14c76dc], 0
mov dword [0x14c76e0], 0
pop esi
add esp, 0x510
ret
Function at 0x439ea0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x514
push edi
push 1
call fcn.0043d050
mov eax, dword [esp + 0x520]
push 2
push 0
push eax
lea edi, [esp + 0x1c]
call fcn.00472860
add esp, 0x10
test eax, eax
jne 0x439ed4
xor al, al
pop edi
add esp, 0x514
ret
mov edi, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 2
lea edx, [esp + 0x18]
push edx
push edi
call esi
movzx eax, word [esp + 0xc]
mov dword [0x14d8800], eax
shl eax, 2
mov edx, 0x12985f4
call fcn.00474ce0
mov edx, dword [0x14d8800]
push 0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [edx*4]
push ecx
push eax
push edi
mov dword [0x14d8808], eax
call esi
push 0
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x18]
push eax
push edi
call esi
movzx ecx, word [esp + 0xc]
push 0
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x18]
push eax
push edi
mov dword [0x14d87fc], ecx
call esi
movzx eax, word [esp + 0xc]
add eax, dword [0x14d87fc]
mov dword [0x14d87f8], eax
lea eax, [eax + eax*8]
shl eax, 2
mov edx, 0x12985f4
call fcn.00474ce0
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x14d87f8]
lea edx, [ecx + ecx*8]
shl edx, 2
push edx
push eax
push edi
mov dword [0x14d8804], eax
call esi
mov eax, dword [0x14d8804]
mov word [eax + 0x2f4], 0xa
mov eax, dword [0x14d87f8]
xor ebp, ebp
test eax, eax
jbe 0x439ff7
xor eax, eax
push ebx
lea esp, [esp]
lea esi, [eax + eax*8]
shl esi, 2
mov ebx, 8
jmp 0x439fc0
mov ecx, dword [0x14d8804]
lea edx, [esi + ecx + 4]
push edx
push 0x14d2e84
call fcn.0048a170
mov ecx, dword [0x14d8804]
mov dword [esi + ecx + 4], eax
add esp, 8
add esi, 4
dec ebx
jne 0x439fc0
mov ecx, dword [0x14d87f8]
inc ebp
movzx eax, bp
cmp eax, ecx
jb 0x439fb0
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
mov al, 1
pop edi
add esp, 0x514
ret
Function at 0x4722d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
mov eax, dword [0x1529f3c]
mov edx, dword [0x1528d94]
imul eax, eax, 0x118
push esi
push edi
add eax, edx
push 0x40
push eax
mov dword [esp + 0x10], 0x40333333
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x40333333
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0x40333333
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0x3f800000
call fcn.00481680
add esp, 8
mov esi, 0x152a080
mov edi, 0x190
lea ecx, [ecx]
mov ecx, dword [0x1529f3c]
mov eax, dword [0x1528d98]
imul ecx, ecx, 0x5c
add ecx, eax
push ecx
lea edx, [esp + 0xc]
push edx
push esi
call fcn.004817d0
add esp, 0xc
add esi, 0x118
dec edi
jne 0x472380
pop edi
pop esi
add esp, 0x40
ret

Function at 0x4727f0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebx, 0x61
mov esi, 0x1545600
lea esp, [esp]
push ebx
lea eax, [esp + 0x10]
push str._c:_
push eax
mov dword [esi], 0
call fcn.0049abb1
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call edi
cmp eax, 5
nop
nop
mov dword [esi], 1
mov byte [0x1545668], bl
add esi, 4
inc ebx
cmp esi, 0x1545664
jle 0x472810
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x473160
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x14c75e0]
sub esp, 0x624
test eax, eax
je 0x47317b
mov eax, 1
add esp, 0x624
ret
movsx eax, byte [0x1545668]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
push esi
push edi
mov edi, 3
mov dword [esp + 0x10], eax
mov ebp, 1
lea ebx, [ebx]
mov ecx, edi
mov eax, str.GAMESAVE.DAT
lea esi, [esp + 0x28]
call fcn.00472a00
xor eax, eax
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x530], cl
inc eax
test cl, cl
jne 0x4731b2
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x40]
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4732c1
cmp edi, ebp
jne 0x4732ba
mov cl, byte [0x1545668]
cmp cl, 0x7a
jne 0x4731fd
mov cl, 0x61
jmp 0x4731ff
inc cl
movsx eax, cl
cmp dword [eax*4 + 0x154547c], ebp
je 0x473211
cmp eax, dword [esp + 0x10]
jne 0x4731f4
mov eax, dword [esp + 0x10]
movsx edx, cl
cmp edx, eax
mov byte [0x1545668], cl
jne 0x4731a0
lea ecx, [esp + 0x28]
push ecx
push str.failed_to_read_file__s_n
call fcn.004777d0
xor edx, edx
add esp, 8
cmp esi, 0xffffffff
setne dl
mov ebp, edx
test ebp, ebp
je 0x4732ad
mov edx, 0x14ca8f0
jmp 0x473250
mov edi, edx
xor eax, eax
add edx, 0x120
cmp edx, 0x14cb430
mov ecx, 0x40
rep stosd dword es:[edi], eax
jl 0x473250
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [esp + 0x14]
push eax
push 0x1ac8
push 0x14ca8d8
push esi
call edi
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x14
lea edx, [esp + 0x20]
push edx
push esi
mov ebx, eax
call edi
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
test ebx, ebx
setne cl
push esi
and eax, ecx
and ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x624
ret
mov edi, ebp
jmp 0x4731a0
lea eax, [esp + 0x28]
push eax
push str.opened_file__s_n
jmp 0x473230
Function at 0x4732d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x758
xor eax, eax
jmp 0x4732e0
mov cl, byte [eax + 0x1545ea0]
mov byte [esp + eax + 0x14c], cl
inc eax
test cl, cl
jne 0x4732e0
call fcn.00473160
mov edx, eax
test edx, edx
mov dword [esp], edx
je 0x47351a
push ebx
push ebp
xor ecx, ecx
mov eax, 0x10
push esi
sub eax, 0x1545ea0
push edi
mov dword [esp + 0x14], ecx
mov ebp, 0x14ca8e0
mov dword [esp + 0x1c], eax
cmp byte [ebp], 0
je 0x4734f7
cmp ebp, 0x14cae80
push ebp
jge 0x473351
push ecx
lea eax, [esp + 0x44]
push str._d__s_Revolution_
push eax
call fcn.0049abb1
mov dword [ebp + 0x110], 0
jmp 0x47336e
add ecx, 0xfffffffb
push ecx
lea ecx, [esp + 0x44]
push str._d__s_Chaos_
push ecx
call fcn.0049abb1
mov dword [ebp + 0x110], 1
add esp, 0x10
push 0x100
push 0x1545ea0
push 0
push 4
push 0x4c12b0
lea ebx, [esp + 0x50]
call fcn.004766e0
add esp, 0x14
test eax, eax
jne 0x4734ef
movsx edx, byte [0x1545668]
mov ebx, 3
mov dword [esp + 0x18], edx
jmp 0x4733b0
mov ecx, ebx
mov eax, str.SAVEDGAME.DAT
lea esi, [esp + 0x5c]
call fcn.00472a00
xor eax, eax
mov cl, byte [esp + eax + 0x5c]
mov byte [esp + eax + 0x664], cl
inc eax
test cl, cl
jne 0x4733c2
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x473542
mov edx, 1
cmp ebx, edx
jne 0x47353b
mov cl, byte [0x1545668]
lea ecx, [ecx]
cmp cl, 0x7a
jne 0x473419
mov cl, 0x61
jmp 0x47341b
inc cl
movsx eax, cl
cmp dword [eax*4 + 0x154547c], edx
je 0x47342d
cmp eax, dword [esp + 0x18]
jne 0x473410
mov eax, dword [esp + 0x18]
mov byte [0x1545668], cl
movsx ecx, cl
cmp ecx, eax
jne 0x4733b0
lea eax, [esp + 0x5c]
push eax
push str.failed_to_read_file__s_n
call fcn.004777d0
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 8
push 0
lea ecx, [esp + 0x3c]
push ecx
push 0x120
lea edx, [ebp - 8]
push edx
push edi
call ebx
mov esi, eax
neg esi
sbb esi, esi
xor eax, eax
neg esi
cmp edi, 0xffffffff
setne al
and esi, eax
mov eax, dword [ebp + 0x114]
and esi, 1
test eax, eax
je 0x4734a2
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
push 0
lea edx, [esp + 0x38]
push edx
push 0x14
lea eax, [esp + 0x2c]
push eax
push edi
call ebx
neg eax
sbb eax, eax
neg eax
push edi
and esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
mov eax, 0x1545ea0
lea edx, [ecx + ebp]
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4734d0
test esi, esi
jne 0x4734f7
push 0x4c12b0
lea ebx, [esp + 0x40]
call fcn.00476790
add esp, 4
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x14]
inc ecx
add ebp, 0x120
cmp ebp, 0x14cb420
mov dword [esp + 0x14], ecx
jl 0x473322
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x14c]
mov byte [eax + 0x1545ea0], cl
inc eax
test cl, cl
jne 0x473520
mov eax, edx
add esp, 0x758
ret
mov ebx, edx
jmp 0x4733b0
lea edx, [esp + 0x5c]
push edx
push str.opened_file__s_n
jmp 0x47344c
Function at 0x4740b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x560
push esi
push edi
push 3
push 0
push str.DEFAULT.OPT
lea edi, [esp + 0x68]
call fcn.00472860
add esp, 0xc
test eax, eax
je 0x47414c
mov esi, dword [esp + 0x5c]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0xc]
push eax
push 0x3c
lea ecx, [esp + 0x2c]
push ecx
push esi
call edi
push 0
lea edx, [esp + 0xc]
push edx
push 0x14
lea eax, [esp + 0x18]
push eax
push esi
call edi
push 0
push esi
call dword [section..xqrf]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xf
lea esi, [esp + 0x20]
mov edi, 0x14ca89c
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x14cc45c]
and eax, 0xfffdffff
mov dword [0x14ca8a0], 0
mov dword [0x14cc45c], eax
call fcn.0048a050
mov eax, 0x1545fe0
call fcn.00477760
mov esi, 1
jmp 0x47414e
xor esi, esi
mov edx, dword [0x14cc45c]
and edx, 0xfffdffff
mov dword [0x14ca8a0], 0
mov dword [0x14cc45c], edx
call fcn.00451740
mov eax, dword [0x1545e98]
test eax, eax
je 0x4741bb
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov eax, esi
jne 0x4741a6
mov ecx, dword [0x14ca8d0]
pop edi
mov dword [0x14c75f4], 1
mov dword [0x14c75a4], ecx
pop esi
add esp, 0x560
ret
mov edx, dword [0x14ca8d0]
pop edi
mov dword [0x14c75a4], edx
pop esi
add esp, 0x560
ret
mov eax, dword [0x14ca8d0]
mov dword [0x14c75a4], eax
pop edi
mov eax, esi
pop esi
add esp, 0x560
ret

Function at 0x4741d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x624
mov eax, dword [0x14c75e4]
test eax, eax
mov dword [esp], 0
je 0x4741f3
mov eax, 1
add esp, 0x624
ret
mov eax, dword [0x14cc45c]
mov ecx, dword [0x4d73d0]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebp
movsx ebp, byte [0x1545668]
shr eax, 0x11
push esi
and eax, 1
push edi
mov dword [0x14ca8a0], eax
mov dword [0x14ca8a8], ecx
mov edi, 3
mov ecx, edi
mov eax, str.DEFAULT.OPT
lea esi, [esp + 0x28]
call fcn.00472a00
xor eax, eax
jmp 0x474240
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x530], cl
inc eax
test cl, cl
jne 0x474240
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x40]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4742c7
mov edx, 1
cmp edi, edx
jne 0x4742c0
mov cl, byte [0x1545668]
nop
cmp cl, 0x7a
jne 0x474289
mov cl, 0x61
jmp 0x47428b
inc cl
movsx eax, cl
cmp dword [eax*4 + 0x154547c], edx
je 0x47429b
cmp eax, ebp
jne 0x474280
movsx eax, cl
cmp eax, ebp
mov byte [0x1545668], cl
jne 0x474225
lea edx, [esp + 0x28]
push edx
push str.failed_to_read_file__s_n
call fcn.004777d0
add esp, 8
jmp 0x47431a
mov edi, edx
jmp 0x474225
lea ecx, [esp + 0x28]
push ecx
push str.opened_file__s_n
call fcn.004777d0
add esp, 8
cmp esi, 0xffffffff
je 0x47431a
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x14]
push eax
push 0x3c
push 0x14ca89c
push esi
call edi
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x14
lea edx, [esp + 0x20]
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], 1
call fcn.00489470
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [0x14cc49c], 0
pop ebx
add esp, 0x624
ret
Function at 0x4766e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push esi
push ebx
lea eax, [esp + 8]
push str.SaveGames_s_
push eax
call fcn.0049abb1
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
push 0
lea ecx, [esp + 8]
push ecx
call esi
test eax, eax
jne 0x476765
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
lea edx, [esp + 0xc]
push edx
push str.Failed_to_create_save_game_directory__s___error_was__d_n
call fcn.004777d0
add esp, 0xc
push 0
push str.SaveGames_
call esi
call edi
push eax
push str.Attempt_to_create_SaveGames___error_was__d_n
call fcn.004777d0
add esp, 8
push 0
lea eax, [esp + 0xc]
push eax
call esi
test eax, eax
jne 0x476764
call edi
push eax
lea ecx, [esp + 0xc]
push ecx
push str.Failed_to_create_any_save_game_directory__s___error_was__d_n
call fcn.004777d0
add esp, 0xc
pop edi
mov edx, dword [esp + 0x118]
push ebx
push 0x4c23e0
push edx
call fcn.0049abb1
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x104
ret

Function at 0x476790
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x348
push ebp
push ebx
lea eax, [esp + 0x148]
push str.SaveGames_s
push eax
call fcn.0049abb1
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x148]
push edx
call dword [section..xqrf]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x47683a
push esi
push edi
lea esp, [esp]
mov edi, 0x4c3824
lea esi, [esp + 0x38]
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x476821
mov edi, 0x4c075c
lea esi, [esp + 0x38]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x476821
lea eax, [esp + 0x38]
push eax
push ebx
lea ecx, [esp + 0x258]
push str.SaveGames_s_s
push ecx
call fcn.0049abb1
add esp, 0x10
lea edx, [esp + 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4767d0
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
push ebx
lea ecx, [esp + 0x148]
push 0x4c0678
push ecx
call fcn.0049abb1
add esp, 0xc
lea edx, [esp + 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 2
pop ebp
add esp, 0x348
ret
Function at 0x477960
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push edi
push 0x477c20
push 0x49b978b
push 0x15ca81a
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareGatheringState_of_Emergency
push 0x80000002
call dword [section..xqrf]
test eax, eax
jne 0x477b22
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0xc]
push ecx
push eax
lea edx, [ebp - 0x10]
push edx
push eax
mov eax, dword [ebp - 4]
push 0x4c38e3
push eax
call esi
test eax, eax
jne 0x4779f6
cmp dword [ebp - 0x10], 1
jne 0x4779f6
cmp dword [ebp - 0xc], 0x105
ja 0x4779f6
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x118]
push edx
push 0
push 0
push 0x4c38e3
push eax
call esi
test eax, eax
jne 0x4779f6
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push str.Lang
push ecx
call esi
test eax, eax
jne 0x477b0e
cmp dword [ebp - 0x10], 1
jne 0x477afa
cmp dword [ebp - 0xc], 0x10
ja 0x477afa
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push str.Lang
push ecx
call esi
test eax, eax
jne 0x477b0e
mov edi, str.ENGLISH
lea esi, [ebp - 0x118]
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x477a75
mov eax, dword [ebp - 4]
xor esi, esi
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x477b2a
mov edi, str.FRENCH
lea esi, [ebp - 0x118]
mov ecx, 7
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x477aa2
mov eax, dword [ebp - 4]
mov esi, 1
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x477b2a
mov edi, str.SPANISH
lea esi, [ebp - 0x118]
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x477acc
mov eax, dword [ebp - 4]
mov esi, 2
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x477b2a
xor eax, eax
mov edi, str.ITALIAN
lea esi, [ebp - 0x118]
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
mov edx, eax
mov eax, dword [ebp - 4]
setne dl
push eax
lea edx, [edx + edx + 3]
mov esi, edx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x477b2a
mov eax, dword [ebp - 4]
mov esi, 7
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x477b2a
mov eax, dword [ebp - 4]
mov esi, 6
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x477b2a
mov esi, 8
mov dword [ebp - 8], esi
push esi
push str.Reg_Status___d_n
call fcn.004777d0
add esp, 8
pop ecx
push dword [ebp - 8]
add esp, 0xc
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47e0d0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x44
push esi
push edi
push 0x4c0f48
push str.NetSettings.dat
mov dword [esp + 0x10], 0x40
call fcn.0049b46a
mov esi, eax
add esp, 8
test esi, esi
je 0x47e165
push 2
push 0
push esi
call fcn.0049bb8d
push esi
call fcn.0049babd
push 0
push 0
push esi
mov edi, eax
call fcn.0049bb8d
add esp, 0x1c
cmp edi, 0xc5
jne 0x47e15c
push esi
push 1
push edi
push 0x137d978
call fcn.0049b7bc
push esi
mov edi, eax
call fcn.0049b4ce
add esp, 0x14
cmp edi, 1
jne 0x47e15c
mov al, byte [0x137da3c]
cmp al, 1
je 0x47e284
cmp al, 2
je 0x47e284
pop edi
mov byte [0x137da3c], 1
pop esi
add esp, 0x44
ret
push esi
call fcn.0049b4ce
add esp, 4
mov eax, str.SoE_Server
mov byte [0x14c74d8], 1
call fcn.0047dd00
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x47e1b1
mov edx, dword [str.Mr_Long_Name]
mov eax, dword [0x4bff24]
mov ecx, dword [0x4bff28]
mov dword [esp + 0xc], edx
mov dl, byte [0x4bff2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov byte [esp + 0x18], dl
lea eax, [esp + 0xc]
call fcn.0047dd60
mov eax, 0x4c38e3
call fcn.0047ddc0
mov al, byte [0x14c74d8]
test al, al
mov byte [0x137da3c], 1
jne 0x47e207
push 0x4bff1c
push str.NetSettings.dat
call fcn.0049b46a
mov esi, eax
add esp, 8
test esi, esi
je 0x47e207
push esi
push 1
push 0xc5
push 0x137d978
call fcn.0049b90f
push esi
call fcn.0049b4ce
add esp, 0x14
mov al, byte [0x14c74d8]
test al, al
mov byte [0x137da3b], 0
jne 0x47e24a
push 0x4bff1c
push str.NetSettings.dat
call fcn.0049b46a
mov esi, eax
add esp, 8
test esi, esi
je 0x47e24a
push esi
push 1
push 0xc5
push 0x137d978
call fcn.0049b90f
push esi
call fcn.0049b4ce
add esp, 0x14
push 0x4bff1c
push str.NetSettings.dat
mov byte [0x14c74d8], 0
call fcn.0049b46a
mov esi, eax
add esp, 8
test esi, esi
je 0x47e284
push esi
push 1
push 0xc5
push 0x137d978
call fcn.0049b90f
push esi
call fcn.0049b4ce
add esp, 0x14
pop edi
pop esi
add esp, 0x44
ret
Function at 0x485ee0
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
mov ebx, eax
call edi
mov esi, eax
sub eax, ebx
cmp eax, 1
jle 0x485ef0
rdtsc
mov dword [esp + 0x10], eax
call edi
sub eax, esi
cmp eax, 0x3e8
jle 0x485f01
rdtsc
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
sub ecx, edx
mov eax, 0x431bde83
mul ecx
pop edi
mov eax, edx
pop esi
shr eax, 0x12
pop ebx
add esp, 8
ret