joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434b70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5387cb
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x300]
push eax
lea eax, [ebp - 0x2e0]
mov dword [ebp - 0x2fc], edi
push eax
push 0x550938
push str.http
push 1
push 0
mov dword [ebp - 0x300], 0x168
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
test eax, eax
js 0x434dc7
xor eax, eax
mov dword [ebp - 0x2e8], 0
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x2e4], 7
mov word [ebp - 0x2f8], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434c01
sub ecx, edx
lea eax, [ebp - 0x2e0]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2f8]
call fcn.00428460
cmp dword [ebp - 0x2e4], 8
lea ecx, [ebp - 0x2f8]
mov eax, dword [ebp - 0x2e8]
cmovae ecx, dword [ebp - 0x2f8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x304], ecx
cmp eax, 2
jb 0x434c78
lea ebx, [ecx + eax*2]
mov eax, ecx
lea ecx, [ebx - 2]
sub ecx, eax
sar ecx, 1
je 0x434c72
nop dword [eax]
cmp word [eax], 0x25
je 0x434d47
add eax, 2
sub ecx, 1
jne 0x434c60
mov edi, dword [ebp - 0x2fc]
push 1
push 0x550958
lea ecx, [ebp - 0x2f8]
call fcn.004370b0
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434c90
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x2f8]
call fcn.004370b0
mov ecx, 0x44
lea eax, [ebp - 0x358]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x434cb7
mov ecx, 0x10
lea eax, [ebp - 0x314]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x434cd0
cmp dword [ebp - 0x2e4], 8
lea ecx, [ebp - 0x314]
push ecx
lea ecx, [ebp - 0x358]
mov dword [ebp - 0x358], 0x44
push ecx
lea eax, [ebp - 0x2f8]
cmovae eax, dword [ebp - 0x2f8]
push 0
push eax
push 0
call fcn.00435e90
add esp, 0x14
test eax, eax
je 0x434dbc
push dword [ebp - 0x314]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x310]
call esi
lea ecx, [ebp - 0x2f8]
call fcn.004218e0
mov eax, 1
jmp 0x434de6
test eax, eax
je 0x434c72
mov edx, 0x550950
mov edi, eax
mov esi, 2
sub edi, edx
nop dword [eax]
mov cx, word [edi + edx]
cmp cx, word [edx]
jne 0x434db4
add edx, 2
sub esi, 1
jne 0x434d60
sub eax, dword [ebp - 0x304]
mov edi, dword [ebp - 0x2fc]
sar eax, 1
cmp eax, 0xffffffff
je 0x434c78
mov edx, edi
lea esi, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x434d90
sub edx, esi
lea ecx, [ebp - 0x2f8]
sar edx, 1
push edx
push edi
push 2
push eax
call fcn.00437270
jmp 0x434cac
add eax, 2
jmp 0x434c54
lea ecx, [ebp - 0x2f8]
call fcn.004218e0
push 0xa
push 0
push 0
push edi
push 0x550938
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x20
cmp ecx, eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
Function at 0x434ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434f61
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x434f2f
cmp eax, 2
jne 0x434f4b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x434f5b
test ecx, ecx
je 0x434f56
test cl, 1
jne 0x434f4b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x434f5b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x435010
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538848
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x596634]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x43515c
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x43515c
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x43515c
call fcn.004126e0
mov ecx, eax
test ecx, ecx
je 0x4351b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
push edi
push 0x800
push 0x800
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.00431850
push eax
push dword [ebp + 0x18]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [esi - 8]
push esi
call fcn.0050ae7c
add esp, 8
test eax, eax
js 0x4351ba
cmp eax, dword [esi - 8]
jg 0x4351ba
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x10]
cmp eax, 0x7ff
je 0x4350d4
cmp eax, 0x7fe
jne 0x43511e
push edi
push 0x1000
push 0x1000
lea ecx, [ebp + 0xc]
call fcn.00431850
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [ebp + 0xc]
push dword [esi - 8]
push esi
call fcn.0050ae7c
add esp, 8
test eax, eax
js 0x4351ba
cmp eax, dword [esi - 8]
jg 0x4351ba
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov edi, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.00430530
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x435148
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
mov edx, 0x54ea3c
mov esi, dword [ebp + 8]
test eax, eax
cmovne edx, eax
xor eax, eax
mov ecx, edx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435184
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.00428460
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040af60
push 0x80070057
call fcn.0040af60
int3
Function at 0x435c40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2858
call fcn.00496d60
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x804]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x800
push 0
push eax
call fcn.004dcfa0
add esp, 0xc
cmp dword [ebp + 0x24], 0
je 0x435cf4
test esi, esi
je 0x435d29
push 0x1000
lea eax, [ebp - 0x1804]
push 0
push eax
call fcn.004dcfa0
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x435cdd
push 0x800
lea eax, [ebp - 0x1804]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push esi
lea eax, [ebp - 0x1804]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea esi, [ebp - 0x1804]
push 0x400
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.0050b03e
add esp, 0xc
jmp 0x435d10
lea ecx, [ebp - 0x804]
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x435d00
cmp dword [ebp + 0x20], 0
je 0x435d3c
lea eax, [ebp - 0x804]
push eax
call fcn.00474780
add esp, 4
test eax, eax
jne 0x435d3c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x2858], 0x44
lea eax, [ebp - 0x2858]
movlpd qword [ebp - 0x2854], xmm0
push eax
movlpd qword [ebp - 0x284c], xmm0
movlpd qword [ebp - 0x2844], xmm0
movlpd qword [ebp - 0x283c], xmm0
movlpd qword [ebp - 0x2834], xmm0
movlpd qword [ebp - 0x282c], xmm0
movlpd qword [ebp - 0x2824], xmm0
movlpd qword [ebp - 0x281c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ax, word [ebp + 0x14]
xorps xmm0, xmm0
push 0x1000
mov word [ebp - 0x2828], ax
lea eax, [ebp - 0x2804]
push 0
push eax
mov dword [ebp - 0x282c], 1
movups xmmword [ebp - 0x2814], xmm0
call fcn.004dcfa0
add esp, 0xc
lea eax, [ebp - 0x804]
test edi, edi
je 0x435ded
push edi
push eax
lea eax, [ebp - 0x2804]
push 0x551134
push eax
call fcn.00430380
add esp, 0x10
jmp 0x435e02
push eax
lea eax, [ebp - 0x2804]
push 0x551144
push eax
call fcn.00430380
add esp, 0xc
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x2858]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x435e70
cmp dword [ebp + 0x18], 0
je 0x435e46
push dword [ebp + 0x1c]
push dword [ebp - 0x2814]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x435e5a
push eax
push dword [ebp - 0x2814]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2810]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2814]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496d46
mov esp, ebp
pop ebp
ret
Function at 0x436050
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538938
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x596634]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4360cb
test al, 0x10
je 0x4360cb
push esi
mov edi, 1
call fcn.00455990
add esp, 4
test eax, eax
jne 0x4360ee
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4360ee
push esi
test edi, edi
jne 0x4360e6
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4360ee
push esi
push str.DeleteFile:_s_suceesss
call fcn.0043c1e0
add esp, 8
jmp 0x4360ee
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x43609c
push esi
push str.DeleteFile:_s_suceesss
call fcn.0043c1e0
add esp, 8
jmp 0x4360ee
call fcn.00455990
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43616f
push esi
lea ecx, [ebp - 0x10]
call fcn.004155f0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov edi, dword [esi + 4]
cmp dword [esi + 8], edi
je 0x43612e
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.004124d0
add eax, 0x10
add esp, 4
mov dword [edi], eax
add dword [esi + 4], 4
jmp 0x43613a
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
push edi
call fcn.0042fe80
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43615c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43a8b0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ecx
push 0
push eax
call fcn.004dcfa0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
add esp, 0xc
push 0x104
push eax
push 0
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push str.NetBridge.dll
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00474780
add esp, 4
test eax, eax
je 0x43aaaa
lea eax, [ebp - 0x20c]
push eax
call fcn.0042f540
mov ecx, eax
call fcn.0042f5e0
test eax, eax
je 0x43aaaa
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004dcfa0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x553190
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43a9a9
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.ludashisetup.exe
lea eax, [ebp - 0x20c]
push eax
call esi
lea ebx, [edi + 0x5c]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], ebx
push eax
mov ecx, ebx
call fcn.0040cb70
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x43aaaa
call fcn.0042f540
mov ecx, eax
call fcn.0042f330
push dword [ebp - 0x214]
lea ebx, [edi + 0x60]
mov dword [ebp - 0x21c], 0
push eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x218], 0
call fcn.0040cf90
mov eax, dword [ebp - 0x21c]
mov dword [ebx], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0x218]
mov dword [ebx + 4], eax
test esi, esi
je 0x43aa54
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x43aa4e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x43aa4e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ebx, dword [ebp - 0x210]
cmp dword [ebx], 0
je 0x43aaaa
push str.CFixPage_AysncStartDownloadLds
call fcn.0043c1e0
mov ecx, dword [ebx]
lea eax, [edi + 0x50]
add esp, 4
neg edi
sbb edi, edi
mov edx, dword [ecx]
and edi, eax
push edi
call dword [edx]
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x214]
mov eax, dword [ecx]
push dword [edx]
call dword [eax + 0x28]
mov ecx, dword [ebx]
push dword [0x594fd0]
push 0
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
push 0
push str.CFixPage_DoDownlaodEnd_succ_:__d
call fcn.0043c1e0
add esp, 8
push 0
push 0
push 0x15d8
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496d46
mov esp, ebp
pop ebp
ret
Function at 0x43d7f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004dcfa0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x22c], 1
push 1
push eax
mov dword [ebp - 0x228], 0x208
call fcn.00432d80
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x43d843
mov eax, dword [eax]
lea ecx, [ebp - 0x228]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x22c]
push ecx
push 0x553984
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [ebp - 0x210]
cmp edx, 8
jb 0x43d8a5
mov ecx, dword [ebp - 0x224]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43d89b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43d8cb
push edx
push ecx
call fcn.00496936
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call fcn.0050a517
xor ecx, ecx
add esp, 4
test eax, eax
setg cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
call fcn.004e8718
int3

Function at 0x43d8f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539810
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x596634]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x84], 0x3a
je 0x43d9f2
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x59bdb4
call fcn.0040fc50
call fcn.00456be0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp + 8]
cmp eax, 1
jl 0x43d94f
cmp eax, 4
jle 0x43d9b6
mov eax, dword [esi + 0x84]
cmp eax, 0x32
je 0x43d982
cmp eax, 0x38
jne 0x43d9b6
push 0
sub esp, 0x28
mov eax, esp
mov dword [ebp + 8], esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 1
push str.questionpage_close
jmp 0x43d9a3
push 0
sub esp, 0x28
mov eax, esp
mov dword [ebp + 8], esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 0
push str.startpage_close
call fcn.0042e1d0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.00423b30
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0044f100
cmp dword [esi + 0x84], 0x3b
jne 0x43d9e1
push str.push_game_start.
call fcn.0043c1e0
add esp, 4
call fcn.00441030
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4421b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x442251
cmp byte [esi + 0x3d], 0
je 0x442251
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x442207
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x442219
sub eax, 1
je 0x44221d
sub eax, 2
je 0x442251
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x44223a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0050e65c
add esp, 0x10
cmp edi, eax
jne 0x442207
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00496d46
mov esp, ebp
pop ebp
ret
Function at 0x442bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x596634]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x442be0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x442c1c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x442c1c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x442d01
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x442c44
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x442c77
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0050cec0
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x442d01
cmp eax, 1
jle 0x442cd4
cmp eax, 3
jne 0x442d01
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00440070
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00496d46
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x442cf1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0050e65c
add esp, 0x10
cmp edi, eax
jne 0x442d01
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x442c07
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00496d46
mov esp, ebp
pop ebp
ret 4
Function at 0x443500
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x443524
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004435f0
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x443545
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x443547
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x4435cf
jg 0x44355a
test esi, esi
je 0x4435cf
test ecx, ecx
jl 0x44359c
jg 0x443564
test eax, eax
je 0x44359c
cmp ebx, ecx
jg 0x443576
jl 0x44356e
cmp esi, eax
jae 0x443576
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004dca20
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4435a2
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x4435cf
jg 0x4435ac
test esi, esi
je 0x4435cf
cmp dword [edi + 0x4c], 0
je 0x4435cf
mov ecx, edi
call fcn.00442720
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0050df34
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4436c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4436e4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004437a0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x443705
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x443707
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x443784
jg 0x44371a
test esi, esi
je 0x443784
test ecx, ecx
jl 0x44375e
jg 0x443724
test eax, eax
je 0x44375e
cmp edi, ecx
jg 0x443736
jl 0x44372e
cmp esi, eax
jae 0x443736
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004dca20
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x443761
mov edx, dword [ebp + 8]
test edi, edi
jl 0x443784
jg 0x44376b
test esi, esi
je 0x443784
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x443784
push eax
push esi
push 1
push edx
call fcn.0050e65c
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc