joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fe48
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45fff3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45ffd4
mov dl, 1
mov eax, dword [0x41a3cc]
call fcn.00403428
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004041e8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45ffc3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044dcfc
test al, al
je 0x45ffb6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x460004
lea eax, [ebp - 0x254]
call fcn.00409ad8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45ffb6
xor eax, eax
push ebp
push 0x45ffaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x46003c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45ff98
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404458
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45ff98
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ffb6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45feb9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041ed14
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fffa
lea eax, [ebp - 0x260]
call fcn.004041e8
ret

Function at 0x460970
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4b7bbc]
cmp byte [eax + 0xa5], 0
jne 0x4609e1
cmp dword [0x4b7bd4], 0
jne 0x4609a2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x46092c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4b7bd4], eax
cmp dword [0x4b7bd0], 0
jne 0x4609bd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4b7bd0], eax
cmp dword [0x4b7bd8], 0
jne 0x4609e1
push esp
push 0
push 0
push 0x4608d0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4b7bd8], eax
pop edx
ret
Function at 0x460ad8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x460aef
add esp, 0xfffffff0
call fcn.004037bc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00424cc8
mov eax, dword [0x4b5f00]
cmp word [eax + 2], 0
jne 0x460b17
mov eax, dword [0x4b5f00]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00462240
mov eax, dword [0x4b600c]
cmp word [eax + 2], 0
jne 0x460b31
mov eax, dword [0x4b600c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00462438
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x419d68]
call fcn.00403428
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x419d68]
call fcn.00403428
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x427834]
call fcn.0042f0b0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x460cb8
mov eax, dword [0x4b5d70]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042f480
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4629e8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4b5d70]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040da64
test eax, eax
je 0x460c26
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040949c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040da8c
test eax, eax
je 0x460c3a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404458
mov eax, dword [0x4b5b8c]
cmp byte [eax], 0
jne 0x460c6e
mov eax, ebx
call fcn.00460de0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00462bc4
mov eax, ebx
call fcn.00463588
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x460cae
call fcn.00403814
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461060
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4b7bbc]
cmp dword [eax + 0x30], 0
je 0x46110a
cmp dword [ebx + 0x94], 0
jne 0x461104
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x460ff0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x461104
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4610ca
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x461104
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c6d8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4610d9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x461c6c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x461ca1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004042d8
jmp 0x461cae
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040423c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x462da0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x462de1
mov eax, esi
call fcn.004492a0
test al, al
je 0x462de1
mov eax, dword [ebx + 0x84]
call fcn.00448f9c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x462de1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00448f9c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x483307
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4b4e6a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x48335f
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4b4e8b
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x483355
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x483363
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x49caf0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x49cb1e
mov eax, ebx
call fcn.0049d5a4
cmp dword [ebx + 0x40], 0
je 0x49cb17
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x49cb8f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x49cb81
cmp dword [ebx + 8], 0
je 0x49cb40
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x49cb52
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x49cb81
cmp dword [ebx + 8], 0
je 0x49cb33
cmp eax, 3
je 0x49cb65
dec eax
jne 0x49cb33
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49cb33
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x49cb33
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x49cbad
cmp dword [ebx + 0x14], 0xcc
je 0x49cbad
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0049cbb8
pop ebx
ret

Function at 0x4aedd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x10c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4aee76
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
mov edx, 0x104
call fcn.00407350
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov ebx, eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404458
mov eax, dword [ebp - 0x10c]
mov ecx, ebx
mov edx, 1
call fcn.00404708
mov eax, dword [ebp - 0x108]
mov edx, esi
call fcn.0040d820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aee7d
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.0040420c
ret
Function at 0x401840
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x108
mov eax, dword [0x452504]
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x110]
test eax, eax
jne 0x40187f
mov ecx, dword [0x453424]
test ecx, ecx
je 0x40187f
mov ecx, dword [ecx + 4]
lea eax, [esp]
push eax
push 0x104
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp]
mov edx, dword [esp + 0x10c]
push 0
push eax
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
call fcn.00435083
add esp, 0x108
ret

Function at 0x402490
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x452504]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x11c], eax
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push 0x4467e0
push SysReAllocString
mov dword [esp + 0x18], 0
call esi
test eax, eax
je 0x4024ed
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
push 0x4467e0
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x40260a
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x446704
push edx
mov dword [esp + 0x24], 0x104
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4025ff
lea eax, [esp + 0x14]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402530
sub eax, edx
mov dword [esp + 0x10], eax
je 0x4025ff
call fcn.00415fa0
lea ecx, [esp + 0x14]
push ecx
add eax, 0x6055
push 0x4464f8
push eax
call fcn.004352bf
lea edx, [esp + 0x20]
push edx
call fcn.0043523a
mov eax, dword [esp + 0x14]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
push str.hangame
push ecx
call fcn.00435188
add esp, 8
test eax, eax
je 0x4025a4
mov eax, 2
pop esi
mov ecx, dword [esp + 0x118]
call fcn.00435083
add esp, 0x11c
ret
lea edx, [esp + 0x14]
push str.jr.naver
push edx
call fcn.00435188
add esp, 8
test eax, eax
je 0x4025d3
mov eax, 4
pop esi
mov ecx, dword [esp + 0x118]
call fcn.00435083
add esp, 0x11c
ret
lea eax, [esp + 0x14]
push str.naver
push eax
call fcn.00435188
add esp, 8
neg eax
sbb eax, eax
neg eax
pop esi
mov ecx, dword [esp + 0x118]
call fcn.00435083
add esp, 0x11c
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x11c]
xor eax, eax
pop esi
call fcn.00435083
add esp, 0x11c
ret
Function at 0x402620
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 2
xor ebp, ebp
push ebp
push 0x4467e0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x402676
mov ecx, dword [esp + 0x10]
push esi
push edi
push 1
push ebp
push 0x446704
push ecx
call ebx
test eax, eax
jne 0x40266b
mov ebp, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 2
push 0
push 0x4467e0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4026c1
mov ecx, dword [esp + 0x10]
push esi
push edi
push 1
push eax
push str.Default_Page_URL
push ecx
call ebx
mov edx, dword [esp + 0x10]
push esi
push edi
push 1
push 0
push 0x446704
push edx
call ebx
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x4026e0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 4]
cmp eax, 8
push esi
push edi
ja case.0x4026ee.3
jmp dword [eax*4 + 0x4027d4]
mov eax, str.http:__www.naver.com_
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402700
sub eax, esi
inc eax
push eax
push str.http:__www.naver.com_
call fcn.00402620
test eax, eax
je case.0x4026ee.0
call fcn.00415fa0
mov esi, eax
call fcn.00415fa0
mov edi, eax
call fcn.00415fa0
add esi, 0x6055
push esi
add edi, 0x5f50
add eax, 0xbcf7
push edi
push eax
call fcn.0041c180
add esp, 0xc
pop edi
pop esi
ret 8
call fcn.0042b8b0
test eax, eax
jne case.0x4026ee.0
push str.D_NGAME
call fcn.0042b730
add esp, 4
pop edi
pop esi
ret 8
mov esi, dword [esp + 0xc]
mov eax, esi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402771
sub eax, edi
inc eax
push eax
push esi
call fcn.00402620
pop edi
pop esi
ret 8
mov eax, str.http:__jr.naver.com_
lea esi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x402790
sub eax, esi
pop edi
inc eax
pop esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.http:__jr.naver.com_
jmp fcn.00402620
mov eax, str.http:__www.naver.com_
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4027b5
sub eax, esi
inc eax
pop edi
pop esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.http:__www.naver.com_
jmp fcn.00402620
Function at 0x4045a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x452504]
push esi
mov dword [esp + 0x118], eax
call fcn.00415fa0
mov esi, eax
call fcn.00415fa0
add esi, 0x8163
push esi
add eax, 0x52f0
push eax
lea eax, [esp + 0x18]
push 0x446508
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x1c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop esi
jne 0x4046d2
mov edx, dword [esp]
lea eax, [esp + 4]
push eax
push 0x453498
lea ecx, [esp + 0x10]
push ecx
push 0
push str.LOCATION
push edx
mov dword [esp + 0x1c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4046c8
jmp 0x404640
mov cl, byte [eax + 0x453498]
mov byte [eax + 0x4535a0], cl
inc eax
test cl, cl
jne 0x404640
mov eax, 0x453498
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404660
sub eax, edx
dec eax
test eax, eax
jle 0x4046a6
mov cl, 0x5c
cmp byte [eax + 0x4535a0], cl
je 0x40469f
dec eax
test eax, eax
jg 0x404670
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x114]
call fcn.00435083
add esp, 0x118
ret
mov byte [eax + 0x4535a0], 0
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x114]
call fcn.00435083
add esp, 0x118
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
xor eax, eax
call fcn.00435083
add esp, 0x118
ret
Function at 0x407210
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 1
push 0
push 0x56
push 0xf7
push SysReAllocString
push SysReAllocString
push 0
push SysReAllocString
push str.HanUpdate
push str.DEFAULTCLASS
push 0
mov esi, ecx
call fcn.00402300
push 0
mov ecx, esi
mov edi, eax
call fcn.004019b0
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esi + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, edi
pop edi
pop esi
ret

Function at 0x4078a1
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00415fa0
mov ecx, eax
call fcn.00413340
test eax, eax
je 0x407923
lea eax, [esp + 4]
push eax
push 4
push esi
push 0x4179a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x78], eax
jne 0x4078e7
mov ecx, dword [esi + 4]
push eax
push 0xffffffffffffffff
push 0xcfc
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.00415fa0
mov esi, eax
call fcn.00415fa0
push 0xd0
add esi, 0xbcf7
add eax, 0x8163
push esi
push eax
call fcn.0041c2d0
add esp, 0xc
call fcn.00415fa0
mov dword [eax + 0x12e74], 0xd2
pop esi
pop ecx
ret
Function at 0x40cbe0
Capabilities:
Copy file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x452504]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x220]
push esi
push edi
mov dword [esp + 0x21c], eax
lea eax, [esp + 0x14]
push 0x446508
push eax
call ebx
push esi
push edi
lea ecx, [esp + 0x128]
push str._sSysfiles_s
push ecx
call ebx
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x24c]
add esp, 0x20
cmp eax, ecx
pop edi
pop esi
pop ebx
jb 0x40cc73
jne 0x40cc52
mov edx, dword [esp + 0x21c]
cmp edx, dword [esp + 0x224]
jb 0x40cc73
lea eax, [esp]
push eax
call fcn.0042fce0
add esp, 4
mov ecx, dword [esp + 0x208]
call fcn.00435083
add esp, 0x20c
ret 0x18
push 0
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [esp + 0x208]
call fcn.00435083
add esp, 0x20c
ret 0x18

Function at 0x40cca0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x452504]
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [esp + 0x210]
push ecx
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10c]
push 0x446508
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
push ecx
push edx
lea eax, [esp + 0x11c]
push eax
call fcn.0042fbc0
mov ecx, dword [esp + 0x224]
call fcn.00435083
add esp, 0x228
ret 0xc

Function at 0x40d070
Capabilities:
Check mutex on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
xor ebp, ebp
push 0x190
call esi
push str.HG_HANSTART_SELFUPDATE
push 1
push 0x100000
call edi
test eax, eax
mov dword [0x45420c], eax
je 0x40d0b5
push 0x1388
push eax
call ebx
cmp eax, 0x102
je 0x40d0c5
inc ebp
cmp ebp, 5
jl 0x40d088
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x40d0d0
Capabilities:
Copy file

Disassembly:
sub esp, 0x824
mov eax, dword [0x452504]
push 0x64
mov dword [esp + 0x824], eax
mov byte [esp + 4], 0
mov byte [esp + 0x20c], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push 0x5c
push ecx
call fcn.004366e3
add esp, 8
test eax, eax
je 0x40d12f
inc eax
lea edx, [esp + 0x410]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40d125
lea edx, [esp + 0x618]
push edx
call fcn.0042fe50
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0x620]
push ecx
lea edx, [esp + 0x214]
push 0x446508
push edx
call fcn.004352bf
lea eax, [esp + 0x21c]
push eax
lea ecx, [esp + 0x18]
push ecx
push str.copy__s_to__s_n
call fcn.004301d0
add esp, 0x20
push 0
lea edx, [esp + 0x20c]
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40d1a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._NEW_hgstart_download__clone_copying_to_real_dir_failed__lasterror__d__n
call fcn.004301d0
add esp, 8
mov ecx, dword [esp + 0x820]
call fcn.00435083
add esp, 0x824
ret
Function at 0x40e070
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.HANGAME_HANSTART
push 1
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [esi], eax
pop esi
jne 0x40e099
push 0x10001
call fcn.0041a6e0
add esp, 4
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40e0bd
push 0
push 0x107
push 0x10002
call fcn.0041a7d0
add esp, 0xc
xor eax, eax
ret
mov eax, 1
ret

Function at 0x40e130
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x452504]
push ebx
mov dword [esp + 0x118], eax
lea eax, [esp + 4]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push str.Control_PanelDesktopWindowMetrics
push SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e282
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push str.Shell_Icon_Size
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e277
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x18]
push 0x4477d8
push eax
call fcn.00436b4d
mov ecx, dword [esp + 0x14]
inc ecx
push ecx
lea edx, [esp + 0x24]
push 0x4477d8
push edx
call fcn.004352bf
lea eax, [esp + 0x2c]
add esp, 0x18
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e1d0
mov ecx, dword [esp + 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push ebx
push str.Shell_Icon_Size
push ecx
call edi
test eax, eax
jne 0x40e276
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push ebx
push 0x3e8
push 2
push str.WindowMetrics
push 0x2a
push 0x1a
push 0xffff
call esi
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push 0x4477d8
push eax
call fcn.004352bf
lea eax, [esp + 0x28]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x40e236
mov edx, dword [esp + 0xc]
sub eax, ecx
push eax
lea ecx, [esp + 0x20]
push ecx
push 1
push ebx
push str.Shell_Icon_Size
push edx
call edi
test eax, eax
jne 0x40e275
push ebx
push 0x3e8
push 2
push str.WindowMetrics
push 0x2a
push 0x1a
push 0xffff
call esi
mov ebx, 1
pop esi
pop edi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x118]
mov eax, ebx
pop ebx
call fcn.00435083
add esp, 0x118
ret