joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c3ce
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, 0x61a
mov eax, dword [edi + 4]
sub eax, dword [edi]
cdq
idiv ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x43c56a
and dword [ebp - 4], 0
push ebx
push esi
test eax, eax
jle 0x43c565
mov ebx, dword [ebp + 8]
xor esi, esi
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push 0
push eax
mov eax, dword [edi]
push 4
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp + 0xc]
push eax
mov eax, dword [edi]
add eax, 4
push 2
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [edi]
lea eax, [ebp + 0xc]
push 0
push eax
movzx eax, word [esi + ecx + 4]
push eax
lea eax, [ecx + 6]
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp + 0xc]
push eax
mov eax, dword [edi]
add eax, 0x10a
push 2
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [edi]
lea eax, [ebp + 0xc]
push 0
push eax
movzx eax, word [esi + ecx + 0x10a]
push eax
lea eax, [ecx + 0x10c]
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp + 0xc]
push eax
mov eax, dword [edi]
add eax, 0x210
push 4
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [edi]
movzx ecx, word [esi + eax + 0x218]
mov dword [ebp + 8], ecx
test cx, cx
je 0x43c535
lea ecx, [eax + 0x21a]
add ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43c4c0
mov eax, dword [ebp + 8]
sub ecx, edx
movzx eax, ax
cmp ecx, eax
jne 0x43c535
push 0
lea eax, [ebp + 0xc]
push eax
push 1
push 0x50e100
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp + 0xc]
push eax
mov eax, dword [edi]
add eax, 0x214
push 4
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp + 0xc]
push eax
mov eax, dword [edi]
add eax, 0x218
push 2
add eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [edi]
lea eax, [ebp + 0xc]
push 0
push eax
movzx eax, word [esi + ecx + 0x218]
push eax
lea eax, [ecx + 0x21a]
add eax, esi
push eax
jmp 0x43c542
push 0
lea eax, [ebp + 0xc]
push eax
push 1
push 0x50f298
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0xc], 0
je 0x43c571
mov eax, dword [ebp - 4]
add esi, 0x61a
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 8]
jl 0x43c402
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
jmp 0x43c568
Function at 0x43c575
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [0x543e38]
xor ebx, ebx
mov edi, ecx
push ebx
push str.unusual
push str.localaccount
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 2
pop ecx
cmp eax, ecx
jge 0x43c632
inc eax
push eax
push str.unusual
push str.localaccount
call fcn.004309c7
and dword [ebp - 0xc], ebx
lea eax, [ebp - 4]
and dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
mov ecx, edi
call fcn.0043be7a
test eax, eax
je 0x43c63a
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 4], ebx
je 0x43c625
xor eax, eax
cmp dword [ebp - 4], 5
mov word [ebp - 0xa], ax
jb 0x43c5f0
mov al, byte [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 8], al
jmp 0x43c5f3
mov ecx, dword [ebp - 0xc]
shr ecx, 0x10
cmp cx, 0xa
ja 0x43c625
test cx, cx
je 0x43c625
push 2
pop eax
cmp word [ebp - 0xc], ax
jne 0x43c625
push dword [ebp + 8]
lea eax, [esi + 5]
push ecx
push eax
call fcn.0043c730
mov ebx, eax
test ebx, ebx
jne 0x43c625
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x43c63a
push esi
call fcn.004d5e39
pop ecx
jmp 0x43c63a
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push str.unusual
push str.localaccount
call fcn.004309c7
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43c9be
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ecx, ecx
inc ecx
cmp dword [ebp + 0x1c], 0
push edi
mov dword [ebp - 4], ecx
jne 0x43caac
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
cmp edi, 0x497
jne 0x43ca21
mov dword [ebp - 4], ecx
mov ecx, esi
push 0
call fcn.0043e450
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
xor eax, eax
push eax
push eax
push esi
push 0x43e234
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x108], eax
and dword [ebx], 0
cmp dword [ebp - 4], 0
je 0x43ca90
xor eax, eax
inc eax
jmp 0x43caae
cmp edi, 0x495
jne 0x43ca3d
push ecx
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push ecx
mov ecx, esi
call fcn.0043d316
mov dword [ebx], eax
jmp 0x43ca13
cmp edi, 0x692
jne 0x43ca4e
mov eax, ebx
and dword [eax], 0
mov eax, ecx
jmp 0x43caae
cmp edi, 7
jne 0x43ca6a
mov eax, dword [esi]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push edi
call dword [eax + 0x58]
jmp 0x43ca39
cmp edi, 0x111
jne 0x43ca90
mov eax, ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], ecx
jne 0x43ca89
mov ecx, esi
call fcn.0043e023
mov eax, dword [ebp - 4]
xor ecx, ecx
inc ecx
and dword [ebx], 0
test eax, eax
jne 0x43ca4a
push 0
push ebx
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.00415474
test eax, eax
jne 0x43ca19
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x43ce4e
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 6
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
push edi
push dword [esi + 4]
mov dword [esi + 0x11c], 1
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0x108]
test eax, eax
je 0x43ce83
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x43e1f0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0x108]
test eax, eax
je 0x43e225
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 0x108], 0
mov ecx, esi
push 1
call fcn.0043e450
and dword [esi + 0xec], 0
mov ecx, esi
mov eax, dword [esi]
pop esi
jmp dword [eax + 0x2c]
push 0
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x43e716
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
add ecx, 0x28
push 0x545fd8
push 0x544c64
push 0
mov eax, dword [ecx]
push str.account
call dword [eax + 0x20]
push eax
call fcn.004f7704
mov esi, eax
add esp, 0x14
test esi, esi
je 0x43e768
push dword [esi + 0xdc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43e768
push 0x104
push dword [ebp + 8]
push dword [esi + 0xdc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
pop esi
pop ebp
ret 8

Function at 0x43ea26
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0x210
mov eax, 0x4fce99
call fcn.004e336a
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x542750]
mov dword [ebp - 0x21c], eax
push 0x547b18
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push str._sUser.ini
push eax
call fcn.0040301c
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.004db6f0
add esp, 0x18
lea eax, [ebp - 0x218]
mov esi, str.HeadPortrait
push dword [ebp - 0x21c]
push 0x104
push eax
push 0x50e6f0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [edi + 0x28]
test eax, eax
mov eax, dword [ecx]
push esi
je 0x43eaea
call dword [eax + 0x20]
mov esi, eax
test esi, esi
je 0x43eaff
mov edx, dword [esi]
mov ecx, esi
push ebx
push 1
push str.show
call dword [edx + 0x34]
mov eax, dword [esi]
lea ecx, [ebp - 0x218]
push ebx
push ecx
push 0x51e3b8
mov ecx, esi
call dword [eax + 0x34]
jmp 0x43eaff
call dword [eax + 0x20]
test eax, eax
je 0x43eaff
mov edx, dword [eax]
mov ecx, eax
push ebx
push ebx
push str.show
call dword [edx + 0x34]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
lea ecx, [ebp - 0x21c]
call fcn.00403030
lea ecx, [ebp + 8]
call fcn.00403030
call fcn.004e3319
ret 4

Function at 0x43eb21
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
add ecx, 0x28
push esi
push 0x545ae0
push 0x544c64
mov eax, dword [ecx]
push esi
push str.password
call dword [eax + 0x20]
push eax
call fcn.004f7704
add esp, 0x14
test eax, eax
je 0x43eb71
push 0x104
push dword [ebp + 0xc]
mov dword [0x5481d4], 1
push dword [eax + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
and dword [0x5481d4], 0
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x43f554
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fb0a9
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x1c], ebx
cmp dword [ebx + 0x88], 0
mov esi, dword [ebx + 0x78]
mov edi, dword [ebx + 0x74]
jne 0x43f5b5
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
test eax, eax
je 0x43f5ad
push ecx
push esi
push edi
mov ecx, eax
call fcn.004150a8
jmp 0x43f5af
xor eax, eax
mov dword [ebx + 0x88], eax
push dword [ebx + 0x88]
lea ecx, [esp + 0x24]
call fcn.0041504e
and dword [esp + 0x50], 0
lea ecx, [esp + 0x28]
mov eax, dword [ebx + 0x8c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
call fcn.004152bc
push esi
push edi
xor esi, esi
mov byte [esp + 0x58], 1
push esi
push esi
push dword [esp + 0x3c]
push dword [esp + 0x34]
call dword [sym.imp.gdiplus.dll_GdipFillRectangleI]
mov ecx, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x40], esi
cmovne ecx, eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], esi
mov esi, dword [ebx + 0x2c]
mov dword [esp + 0x24], ecx
cmp esi, dword [ebx + 0x30]
je 0x43f665
mov edi, dword [ebp + 8]
mov ecx, dword [esi]
test ecx, ecx
je 0x43f65d
cmp dword [ecx + 0x40], 1
je 0x43f65d
cmp dword [ecx + 0x40], 2
je 0x43f65d
mov eax, dword [ecx]
lea edx, [esp + 0x34]
push edx
call dword [eax + 0xc]
test eax, eax
je 0x43f65d
lea eax, [esp + 0x34]
push eax
push edi
call fcn.0043fc05
test eax, eax
je 0x43f65d
mov ecx, dword [esi]
lea edx, [esp + 0x20]
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
add esi, 4
cmp esi, dword [ebx + 0x30]
jne 0x43f622
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [ebx + 0x88]
mov esi, eax
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push 0xff000000
push eax
push dword [edi + 4]
mov dword [esp + 0x24], esi
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x43f699
mov dword [edi + 8], eax
cmp dword [esp + 0x14], 0
je 0x43f6f8
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esp + 0x14]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push ebx
call edi
push 0xcc0020
mov esi, eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
push dword [eax]
push ebx
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
push dword [esp + 0x38]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push esi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
push dword [esp + 0x20]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43ff27
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x17a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0xf4]
test eax, eax
je 0x43ff4e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x440341
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push str.tips
lea esi, [edi + 0x28]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
xor ebx, ebx
test eax, eax
je 0x440375
mov eax, dword [esi]
mov ecx, esi
push str.tips
call dword [eax + 0x20]
push ebx
push ebx
push str.show
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
mov eax, dword [esi]
mov ecx, esi
push str.result1
call dword [eax + 0x20]
test eax, eax
je 0x44039f
mov eax, dword [esi]
mov ecx, esi
push str.result1
call dword [eax + 0x20]
push ebx
push ebx
push str.show
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
mov eax, dword [esi]
mov ecx, esi
push str.result2
call dword [eax + 0x20]
test eax, eax
je 0x4403c9
mov eax, dword [esi]
mov ecx, esi
push str.result2
call dword [eax + 0x20]
push ebx
push ebx
push str.show
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
mov eax, dword [esi]
mov ecx, esi
push str.clearcache
call dword [eax + 0x20]
test eax, eax
je 0x4403f3
mov eax, dword [esi]
mov ecx, esi
push str.clearcache
call dword [eax + 0x20]
push ebx
push ebx
push str.show
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
mov eax, dword [esi]
mov ecx, esi
push str.waitclearcache
call dword [eax + 0x20]
test eax, eax
je 0x44041e
mov eax, dword [esi]
mov ecx, esi
push str.waitclearcache
call dword [eax + 0x20]
push ebx
push 1
push str.show
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
mov eax, dword [esi]
mov ecx, esi
push str.clearcacheing
call dword [eax + 0x20]
test eax, eax
je 0x440449
mov eax, dword [esi]
mov ecx, esi
push str.clearcacheing
call dword [eax + 0x20]
push ebx
push 1
push str.show
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
mov eax, dword [esi]
mov ecx, esi
push str.refreshgame
call dword [eax + 0x20]
test eax, eax
je 0x440474
mov eax, dword [esi]
mov ecx, esi
push str.refreshgame
call dword [eax + 0x20]
push ebx
push 1
push str.show
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
mov eax, dword [esi]
mov ecx, esi
push str.refreshgame
call dword [eax + 0x20]
test eax, eax
je 0x44049e
mov eax, dword [esi]
mov ecx, esi
push str.refreshgame
call dword [eax + 0x20]
push ebx
push ebx
push str.enable
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x34]
push ebx
push 0x64
push 0x17a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x2c]
push ebx
push ebx
push edi
push 0x4404d0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xf4], eax
pop edi
pop esi
pop ebx
ret
Function at 0x440e62
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, ecx
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00447868
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x442d61
Capabilities:
Create thread
Read .ini file

Disassembly:
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 0xe0], eax
jne 0x442d9d
inc dword [0x548178]
push eax
push eax
push esi
push 0x445667
push eax
push eax
mov dword [esi + 0xe0], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, esi
call fcn.00444c06
mov ecx, esi
pop esi
jmp fcn.00445934
pop esi
ret

Function at 0x442e92
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fd320
mov eax, dword fs:[0]
push eax
sub esp, 0x3b0
mov eax, dword [0x5415b0]
xor eax, esp
mov dword [esp + 0x3a8], eax
push ebx
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x3c0]
mov dword fs:[0], eax
mov ebx, ecx
lea edi, [ebx + 0x1b4]
mov eax, dword [edi]
cmp dword [eax - 8], 0
je 0x442ffb
push 5
push 1
lea eax, [esp + 0x398]
push eax
call fcn.004b2a61
xor esi, esi
mov dword [esp + 0x20], eax
test eax, eax
jle 0x442f53
lea ecx, [esp + 0x24]
call fcn.00410dfe
and dword [esp + 0x3c8], 0
lea eax, [esp + 0x24]
push eax
push dword [esp + esi*4 + 0x394]
call fcn.004b0b0e
test eax, eax
je 0x442f3b
push dword [edi]
push dword [esp + 0xa0]
call fcn.004d6cd4
pop ecx
pop ecx
test eax, eax
je 0x442fb6
or dword [esp + 0x3c8], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.0041057c
inc esi
cmp esi, dword [esp + 0x20]
jl 0x442f01
mov eax, dword [0x542750]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c8], 1
lea ecx, [esp + 0x18]
mov eax, dword [ebx + 4]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0x718
call fcn.00402a9f
lea eax, [ebx + 0x1b0]
push eax
lea ecx, [esp + 0x20]
call fcn.00402a9f
push 0x10
call fcn.004d6a5a
mov esi, eax
pop ecx
test esi, esi
je 0x442fc9
mov ecx, dword [0x542750]
mov dword [esi + 8], ecx
mov ecx, dword [0x542750]
mov dword [esi + 0xc], ecx
jmp 0x442fcb
or dword [esp + 0x3c8], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.0041057c
jmp 0x442ffb
xor esi, esi
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00442a32
xor eax, eax
push eax
push eax
push esi
push 0x4427e5
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 0x1c]
call fcn.00403030
lea ecx, [esp + 0x18]
call fcn.00403030
xor eax, eax
mov ecx, dword [esp + 0x3c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3a8]
xor ecx, esp
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x444042
Capabilities:
Create thread

Disassembly:
push 0x18
mov eax, 0x4fd43c
call fcn.004e3337
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov eax, dword [ecx + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0xe8]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
call fcn.00446261
push 0x18
mov dword [ebp - 0x20], 0x70c
call fcn.004d6a5a
mov esi, eax
pop ecx
test esi, esi
je 0x4440a1
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
jmp 0x4440a3
mov esi, edi
mov eax, dword [ebp - 0x24]
lea ecx, [esi + 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 8], eax
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 4], 0x70c
call fcn.00446261
push edi
push edi
push esi
push 0x46dbb0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x18]
call fcn.00410dd2
xor eax, eax
call fcn.004e3305
ret 4

Function at 0x4449f9
Capabilities:
Check if file exists
Create thread

Disassembly:
push 4
mov eax, 0x4fd4b5
call fcn.004e3337
mov ebx, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x444af1
mov edx, esi
xor edi, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x444a19
sub edx, ecx
sar edx, 1
je 0x444af1
mov edx, esi
lea ecx, [ebp + 8]
call fcn.00427fa2
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444a7b
lea esi, [ebx + 0x24]
mov edi, str.useravatar
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x20]
test eax, eax
je 0x444ae9
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x20]
push 0
push dword [ebp + 8]
mov ecx, eax
mov edx, dword [eax]
push 0x51e3b8
call dword [edx + 0x34]
jmp 0x444ae9
mov edx, str.webgameuseravatar.png
lea ecx, [ebp - 0x10]
call fcn.00448a63
lea ecx, [ebx + 0x24]
mov byte [ebp - 4], 1
mov eax, dword [ecx]
mov edi, str.useravatar
push edi
call dword [eax + 0x20]
test eax, eax
je 0x444abb
lea ecx, [ebx + 0x24]
mov eax, dword [ecx]
push edi
call dword [eax + 0x20]
xor edi, edi
mov ecx, eax
push edi
push dword [ebp - 0x10]
mov edx, dword [eax]
push 0x51e3b8
call dword [edx + 0x34]
jmp 0x444abd
xor edi, edi
lea ecx, [ebp - 0x10]
call fcn.00403030
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x444ac8
sub esi, ecx
sar esi, 1
je 0x444ae9
push edi
push edi
push ebx
push 0x4458e4
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp + 8]
call fcn.00403030
call fcn.004e3305
ret 4
Function at 0x444b29
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x4fd4d8
call fcn.004e3337
mov esi, ecx
xor edi, edi
cmp dword [esi + 0xe8], edi
je 0x444bbb
cmp dword [esi + 0x12c], edi
je 0x444b5b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x12c]
add dword [esi + 0x130], eax
mov eax, dword [0x542750]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x14]
mov eax, dword [esi + 0xe8]
mov dword [ebp - 0x1c], eax
lea eax, [esi + 0xf4]
push eax
call fcn.00402a9f
lea eax, [esi + 0xf8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402a9f
mov edx, dword [esi + 0x130]
lea ecx, [ebp - 0x1c]
call fcn.0046491c
lea ecx, [ebp - 0x10]
call fcn.00403030
lea ecx, [ebp - 0x14]
call fcn.00403030
lea ecx, [ebp - 0x18]
call fcn.00403030
jmp 0x444be4
mov esi, dword [esi + 0x1a8]
test esi, esi
je 0x444be4
push edi
xor edx, edx
mov ecx, esi
call fcn.0046497b
pop ecx
test eax, eax
je 0x444be4
push edi
push edi
push esi
push 0x465478
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.004e3305
ret

Function at 0x445934
Capabilities:
Read .ini file

Disassembly:
push 0x28
mov eax, 0x4fd689
call fcn.004e3337
mov esi, ecx
mov eax, dword [esi + 0xf4]
xor edi, edi
mov eax, dword [eax - 8]
test eax, eax
jne 0x445a06
cmp dword [esi + 0x190], edi
jne 0x4459ad
lea ecx, [ebp - 0x34]
call fcn.004420f8
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x20]
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0xe8]
mov dword [ebp - 0x24], eax
lea eax, [esi + 0x108]
push eax
mov dword [ebp - 0x30], 0x712
call fcn.00402a9f
sub esp, 0x24
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.00445a30
call fcn.0046ff50
add esp, 0x24
lea ecx, [ebp - 0x34]
call fcn.00445a0c
jmp 0x445a06
test eax, eax
jne 0x445a06
mov eax, dword [esi + 0x190]
test eax, eax
je 0x445a06
cmp dword [esi + 0x164], edi
je 0x445a06
cmp dword [eax + 8], edi
jne 0x445a06
cmp dword [eax + 0xc], edi
jbe 0x445a06
push dword [0x543e38]
push edi
push str.ManualTipCount
push str.TouristGame
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 3
jge 0x445a06
mov eax, dword [esi + 0x190]
push edi
imul eax, dword [eax + 0xc], 0x3e8
push eax
push 0x429
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.004e3305
ret

Function at 0x445c87
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebx
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov eax, dword [esi + 0xf4]
cmp dword [eax - 8], ecx
jne 0x445cc8
push dword [0x543e38]
mov ebx, str.ManualTipCount
mov edi, str.TouristGame
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc eax
push eax
push ebx
push edi
call fcn.004309c7
push 0
mov ecx, esi
call fcn.00445aa6
pop edi
pop esi
pop ebx
ret
cmp dword [esi + 0x154], ecx
je 0x445cf4
cmp dword [esi + 0x150], ecx
jne 0x445cc4
push ecx
push ecx
push esi
push 0x445c13
push ecx
push ecx
mov dword [esi + 0x150], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x445cc4
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.004452ce