joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59bf40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], edx
cmp edx, 7
jbe 0x59bf9d
lea esi, [edx - 8]
shr esi, 3
lea ebp, [esi*8 + 8]
xor esi, esi
nop
lea esi, [esi]
mov ebx, dword [esp + 0x28]
mov edi, dword [ecx + esi]
xor edi, dword [ebx + esi]
mov dword [eax + esi], edi
mov edi, dword [ecx + esi + 4]
xor edi, dword [ebx + esi + 4]
mov dword [eax + esi + 4], edi
add esi, 8
cmp esi, ebp
jne 0x59bf70
add dword [esp + 0x28], esi
add eax, esi
add ecx, esi
and dword [esp + 4], 7
mov edx, dword [esp + 4]
test edx, edx
je 0x59c038
lea esi, [ecx + 4]
lea ebp, [eax + 4]
cmp eax, esi
setae bl
cmp ecx, ebp
mov edi, ebx
setae bl
mov esi, ebx
mov ebx, dword [esp + 0x28]
or esi, edi
lea edi, [ebx + 4]
cmp eax, edi
setae bl
cmp dword [esp + 0x28], ebp
mov edi, ebx
setae bl
mov ebp, ebx
or edi, ebp
mov ebp, dword [esp + 4]
and esi, edi
lea edi, [ebp - 1]
cmp edi, 3
seta bl
mov edi, ebx
mov ebx, esi
mov edx, edi
test bl, dl
je 0x59c040
mov esi, dword [esp + 0x28]
or esi, ecx
or esi, eax
and esi, 3
jne 0x59c040
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov esi, dword [ebx]
xor esi, dword [ecx]
mov dword [eax], esi
movzx ebx, byte [ecx + 4]
xor bl, byte [edx + 4]
mov byte [eax + 4], bl
cmp ebp, 5
je 0x59c038
mov ebx, dword [esp + 0x28]
movzx edx, byte [ecx + 5]
xor dl, byte [ebx + 5]
mov byte [eax + 5], dl
cmp ebp, 6
je 0x59c038
movzx ecx, byte [ecx + 6]
xor cl, byte [ebx + 6]
mov byte [eax + 6], cl
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x28]
movzx edx, byte [ecx]
xor dl, byte [ebx]
mov ebx, dword [esp + 4]
mov byte [eax], dl
cmp ebx, 1
je 0x59c038
mov edi, dword [esp + 0x28]
movzx edx, byte [ecx + 1]
xor dl, byte [edi + 1]
mov byte [eax + 1], dl
cmp ebx, 2
je 0x59c038
movzx edx, byte [ecx + 2]
xor dl, byte [edi + 2]
mov byte [eax + 2], dl
cmp ebx, 3
je 0x59c038
movzx edx, byte [ecx + 3]
xor dl, byte [edi + 3]
mov byte [eax + 3], dl
cmp ebx, 4
je 0x59c038
movzx edx, byte [ecx + 4]
xor dl, byte [edi + 4]
mov byte [eax + 4], dl
cmp ebx, 5
je 0x59c038
movzx edx, byte [ecx + 5]
xor dl, byte [edi + 5]
mov byte [eax + 5], dl
cmp ebx, 6
je 0x59c038
movzx ecx, byte [ecx + 6]
xor cl, byte [edi + 6]
mov byte [eax + 6], cl
jmp 0x59c038
Function at 0x59c0b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
cmp esi, 7
jbe 0x59c181
lea edx, [esi - 8]
shr edx, 3
lea edi, [edx*8 + 8]
mov edx, ebx
lea ecx, [eax + edi]
nop
lea esi, [esi]
mov ebp, dword [edx]
xor dword [eax], ebp
add edx, 8
mov ebp, dword [edx - 4]
xor dword [eax + 4], ebp
add eax, 8
cmp eax, ecx
jne 0x59c0e0
add ebx, edi
and esi, 7
test esi, esi
je 0x59c14c
lea eax, [ecx + 4]
lea edx, [ebx + 4]
cmp ebx, eax
setae al
cmp ecx, edx
setae dl
or eax, edx
lea edx, [esi - 1]
cmp edx, 2
seta dl
test al, dl
je 0x59c151
mov eax, ebx
or eax, ecx
test al, 3
jne 0x59c151
mov eax, dword [ebx]
xor dword [ecx], eax
cmp esi, 4
je 0x59c14c
movzx eax, byte [ebx + 4]
xor byte [ecx + 4], al
cmp esi, 5
je 0x59c14c
movzx eax, byte [ebx + 5]
xor byte [ecx + 5], al
cmp esi, 6
je 0x59c14c
movzx eax, byte [ebx + 6]
xor byte [ecx + 6], al
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx]
xor byte [ecx], al
cmp esi, 1
je 0x59c14c
movzx eax, byte [ebx + 1]
xor byte [ecx + 1], al
cmp esi, 2
je 0x59c14c
movzx eax, byte [ebx + 2]
xor byte [ecx + 2], al
cmp esi, 3
je 0x59c14c
movzx eax, byte [ebx + 3]
xor byte [ecx + 3], al
cmp esi, 4
jne 0x59c12d
jmp 0x59c14c
mov ecx, eax
jmp 0x59c0f9
Function at 0x5aa030
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x6ffdc5
push ebx
sub esp, 0x9c
mov eax, dword [str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_https:__gcc.gnu.org_bugs__:_n]
mov dword [ebp - 0x81], eax
mov eax, dword [0x6ffe29]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0055c2f8
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.0063c7e0
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x691bc4], 0
jne 0x5aa156
mov byte [0x691bc4], 1
call fcn.00648500
test eax, eax
je 0x5aa124
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0055c0e0
mov dword [esp], 2
mov esi, dword [fcn.00567720]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x5aa114
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6fef2d
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x66eb34
jmp 0x66eb2c
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x5aa0da
mov dword [esp], 2
call dword [0x690158]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x66eb27
mov dword [esp], 2
call dword [0x690158]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x718c88
call fcn.0063a6e0
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.00648120
add esp, 0x18
pop ebx
ret
Function at 0x66e840
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00567720
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00567720
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
Function at 0x6962c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0xdb0000
lea edi, [esi - 0x23f000]
push edi
jmp 0x6962da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6962e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6962d0
mov eax, 1
add ebx, ebx
jne 0x6962f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x696304
jne 0x696323
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x696323
dec eax
add ebx, ebx
jne 0x696310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6962e8
add ebx, ebx
jne 0x69631f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x696375
xor ecx, ecx
sub eax, 3
jb 0x69633b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6963aa
sar eax, 1
mov ebp, eax
jmp 0x696346
add ebx, ebx
jne 0x696346
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x696314
inc ecx
add ebx, ebx
jne 0x696354
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x696314
add ebx, ebx
jne 0x696361
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x696356
jne 0x696372
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x696356
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x696394
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x696386
jmp 0x6962d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x696394
add edi, ecx
jmp 0x6962d6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6963b2
cmp byte [edi], 0x11
jne 0x6963b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6963b7
lea edi, [esi + 0x28f000]
mov eax, dword [edi]
or eax, eax
je 0x69642f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x453728]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4538a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6963e4
mov ecx, edi
jns 0x696413
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4538a8]
or eax, eax
je 0x696429
mov dword [ebx], eax
add ebx, 4
jmp 0x696401
call dword [esi + 0x4538b8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x696460
cmp al, 0xef
ja 0x696453
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x696435
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x696442
mov ebp, dword [esi + 0x4538ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x696494
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x401000
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ecx
push esi
push edi
xor edi, edi
xor eax, eax
mov cl, 0x1d
lea esp, [esp]
xor byte [eax + 0x40ff28], cl
inc eax
cmp eax, 0x1f9b0
jb 0x401010
mov eax, dword [esp + 0x10]
push edi
push edi
push 2
push edi
push 1
push 0x40000000
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401067
push edi
lea ecx, [esp + 0xc]
push ecx
push 0x1f9b0
push 0x40ff28
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401060
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x401840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401857
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401888
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401884
cmp esi, eax
jae 0x401888
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x401874
cmp esi, eax
jb 0x40188e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x401ccd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f020]
jne 0x401cd7
repz ret
jmp fcn.0040251c

Function at 0x4086db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402694
and dword [ebp - 4], 0
cmp dword [0x430480], 0
mov ebx, eax
jne 0x40878c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40883d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40883d
push eax
call fcn.00402622
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x430480], eax
call esi
push eax
call fcn.00402622
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x430484], eax
call esi
push eax
call fcn.00402622
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x430488], eax
call esi
push eax
call fcn.00402622
pop ecx
mov dword [0x430490], eax
test eax, eax
je 0x40878c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402622
pop ecx
mov dword [0x43048c], eax
mov eax, dword [0x43048c]
cmp eax, ebx
je 0x4087e4
cmp dword [0x430490], ebx
je 0x4087e4
push eax
call fcn.0040269d
push dword [0x430490]
mov esi, eax
call fcn.0040269d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4087e4
test edi, edi
je 0x4087e4
call esi
test eax, eax
je 0x4087db
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4087db
test byte [ebp - 0xc], 1
jne 0x4087e4
or dword [ebp + 0x10], 0x200000
jmp 0x40881d
mov eax, dword [0x430484]
cmp eax, ebx
je 0x40881d
push eax
call fcn.0040269d
pop ecx
test eax, eax
je 0x40881d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40881d
mov eax, dword [0x430488]
cmp eax, ebx
je 0x40881d
push eax
call fcn.0040269d
pop ecx
test eax, eax
je 0x40881d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430480]
call fcn.0040269d
pop ecx
test eax, eax
je 0x40883d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40883f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011f7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
mov ebx, 0x1f4
push eax
push ebx
push 2
push 0
push 0
push 0x10
mov esi, ecx
call fcn.004019cc
mov edi, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push eax
call edi
push 0x7d0
mov ecx, esi
call fcn.004011c7
mov ecx, esi
call fcn.0040117b
test al, al
je 0x401260
lea eax, [ebp - 4]
mov ecx, esi
push eax
push ebx
push 2
push 0
push 0xf060
push 0x112
call fcn.004019cc
push eax
call edi
push 0x3e8
mov ecx, esi
call fcn.004011c7
mov ecx, esi
call fcn.0040117b
test al, al
je 0x40128e
lea eax, [ebp - 4]
mov ecx, esi
push eax
push ebx
push 2
push 0
push 0
push 0x12
call fcn.004019cc
push eax
call edi
push 0x3e8
mov ecx, esi
call fcn.004011c7
mov ecx, esi
call fcn.0040117b
test al, al
je 0x4012bc
lea eax, [ebp - 4]
mov ecx, esi
push eax
push ebx
push 2
push 0
push 0
push 2
call fcn.004019cc
push eax
call edi
push 0x3e8
mov ecx, esi
call fcn.004011c7
mov esi, dword [esi + 0x10]
test esi, esi
je 0x4012cc
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401b81
Capabilities:
Get common file path

Disassembly:
sub esp, 0x140
push ebx
push esi
push edi
mov esi, ecx
call fcn.004024ee
and dword [esi + 0x130], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
lea eax, [esi + 0x134]
mov ebx, 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call fcn.00401cb0
mov ecx, esi
call fcn.0040240b
lea edi, [esi + 0x24]
push ebx
push edi
call fcn.00401c96
mov ebx, 0x42d42c
push ebx
push edi
call fcn.0041c470
add esp, 0x10
jmp 0x401bf3
push ebx
push edi
call fcn.0041c470
inc eax
push eax
push edi
call fcn.0041cc10
push ebx
push edi
call fcn.0041c470
add esp, 0x18
test eax, eax
jne 0x401bda
mov ebx, 0x42d428
push ebx
push edi
call fcn.0041c470
pop ecx
pop ecx
jmp 0x401c20
push ebx
push edi
call fcn.0041c470
inc eax
push eax
push edi
call fcn.0041cc10
push ebx
push edi
call fcn.0041c470
add esp, 0x18
test eax, eax
jne 0x401c07
push edi
call fcn.0041cb90
lea eax, [eax + esi + 0x21]
mov dword [esp], 0x42d424
push eax
call fcn.0041cc10
pop ecx
lea eax, [esp + 0x10]
pop ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401c5d
push str.RAW_001.exe
push edi
call fcn.0041cc10
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push edi
mov ecx, esi
call fcn.00402509
lea eax, [esi + 0x128]
mov ecx, esi
push eax
call fcn.00402505
push eax
push esi
push str.ReflexiveArcadeRAW_002.wdt
mov ecx, esi
call fcn.00401091
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x140
ret
Function at 0x401fb7
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x4c]
push ebx
push eax
mov edi, ecx
call fcn.0041cd50
push dword [edi + 0x130]
lea eax, [ebp - 0xc4c]
mov dword [ebp - 0x4c], esi
push dword [ebp + 8]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [edi + 0x134]
push eax
push ebx
push 4
push ebx
push ebx
lea eax, [ebp - 0xc4c]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [edi + 0x18]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4020e5
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 8], ebx
push dword [esi]
push dword [esi + 8]
push dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x402089
push dword [edi + 0x128]
lea ecx, [ebp - 0x44c]
call fcn.00411fdd
cmp dword [esi], ebx
mov dword [ebp + 8], ebx
jbe 0x402096
lea ecx, [ebp - 0x44c]
call fcn.0040114f
mov ecx, dword [esi + 8]
mov edx, dword [ebp + 8]
add ecx, edx
sub byte [ecx], al
inc edx
cmp edx, dword [esi]
mov dword [ebp + 8], edx
jb 0x40206a
jmp 0x402096
push str.Could_not_Read_encrypted_EXE.
push ebx
call fcn.00411f6f
pop ecx
pop ecx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push dword [esi]
push dword [esi + 8]
push dword [esi + 4]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [0x435368], ebx
je 0x4020dc
mov ecx, edi
call fcn.00402182
push str.The_integration_header_was_not_valid._The_process_memory_was_mapped_incorrectly.
push dword [edi + 0x18]
call fcn.004020f5
pop ecx
push eax
call fcn.00411f6f
push dword [edi + 0x18]
call fcn.00401e9c
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x402164
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x402172
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret

Function at 0x402173
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x402181
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret
Function at 0x402182
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea edi, [ebx + 8]
mov eax, dword [edi]
test eax, eax
je 0x4021a5
push eax
call esi
and dword [edi], 0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4021b3
push eax
call esi
and dword [ebx + 0xc], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040520a
mov ecx, eax
call fcn.0040528f
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
call esi
push dword [ebp - 4]
call esi
push 2
push 0
push 2
push edi
mov ecx, ebx
call fcn.004011c3
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebp - 8]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call edi
test eax, eax
jne 0x402226
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x808]
push str.GameWrapper:_Duplicate_Pause_Event_failed__last_error__x_n
push eax
call fcn.0041cda8
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 2
push 0
lea eax, [ebx + 0xc]
push 2
push eax
mov ecx, ebx
call fcn.004011c3
push eax
push dword [ebp - 4]
call esi
push eax
call edi
pop edi
pop esi
test eax, eax
pop ebx
jne 0x40226f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x808]
push str.GameWrapper:_Duplicate_Timeout_Event_failed__last_error__x_n
push eax
call fcn.0041cda8
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
leave
ret

Function at 0x402330
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
push pe_nt_image_headers32
mov dword [ebp + 8], edi
push dword [ebx + 0x2c]
call fcn.00401000
push eax
push edi
call fcn.00401e3f
add esp, 0x10
test eax, eax
jne 0x402365
xor al, al
jmp 0x402406
movzx ecx, word [esi + 0x14]
mov edi, eax
sub edi, dword [ebp + 8]
and dword [ebp + 8], 0
lea edx, [ecx + esi + 0x18]
movzx ecx, word [esi + 6]
test ecx, ecx
mov dword [ebp - 4], ecx
jle 0x40239f
mov ecx, dword [edx + 0x14]
cmp edi, ecx
jb 0x402391
mov esi, dword [edx + 0x10]
add esi, ecx
cmp edi, esi
jb 0x40239f
add edx, 0x28
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp - 4]
jl 0x402381
mov ecx, dword [edx + 0xc]
sub ecx, dword [edx + 0x14]
mov edx, dword [ebx + 0xc]
add ecx, dword [edx + 0x34]
add ecx, edi
mov dword [0x435364], ecx
cmp dword [eax + 0x100], 0x100
jne 0x4023e0
cmp byte [eax + 0x105], 0
jne 0x4023e0
add ecx, 0x100
mov dword [0x43536c], 0xc
mov dword [0x435368], ecx
jmp 0x402404
add ecx, 0x104
push 0x18
mov dword [0x435368], ecx
mov eax, dword [eax + 0x100]
pop ecx
mov dword [0x43536c], eax
cmp eax, ecx
jb 0x402404
mov dword [0x43536c], ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402509
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
xor ebx, ebx
cmp dword [ecx + 4], ebx
mov dword [ebp - 0xc], ecx
jne 0x4025f4
push esi
push edi
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x80
push 3
push ebx
mov edi, 0x80000000
push 1
push edi
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
setne al
push str.Game_files_are_corrupt__please_re_install_game_and_try_again.
push eax
call fcn.00411f6f
pop ecx
pop ecx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [str.ReflexiveArcadeBackground.jpg], ebx
mov dword [ebp - 4], ebx
mov dword [ebp + 8], 0x42d5cc
je 0x4025e4
mov eax, dword [ebp + 8]
push ebx
push 0x80
push 3
push ebx
push 1
push edi
push dword [eax]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4025ae
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp - 0x10]
add dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4025d9
cmp byte [ebp + 0xc], bl
jne 0x4025d9
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x110]
push str.file__s_missing_
push eax
call fcn.0041cda8
lea eax, [ebp - 0x110]
push eax
push ebx
call fcn.00411f6f
add esp, 0x14
add dword [ebp + 8], 4
mov eax, dword [ebp + 8]
cmp dword [eax], ebx
jne 0x40257d
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov dword [eax + 4], ecx
mov al, 1
pop ebx
leave
ret 8

Function at 0x4025fb
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [ebp + 0x10]
push ebx
push eax
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0xc]
cmp eax, 0xffffffff
push str.Could_not_get_file_size
mov dword [esi], eax
setne al
push eax
call fcn.00411f6f
push dword [esi]
call fcn.0041c825
add esp, 0xc
lea ecx, [ebp + 8]
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], ebx
push ebx
push ecx
push dword [esi]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40266c
mov eax, dword [esi]
cmp eax, dword [ebp + 8]
jne 0x40266c
mov bl, 1
push str.There_was_an_error_in_reading_the_file_contents_into_memory.
push ebx
call fcn.00411f6f
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret