joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406400
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4860f0]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x406444
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004567fb
add esp, 0x120
ret
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x406469
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004567fb
add esp, 0x120
ret
mov ecx, 1
cmp eax, ecx
jne 0x40648f
mov esi, 2
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004567fb
add esp, 0x120
ret
cmp eax, 2
jne 0x40658e
mov eax, dword [esp + 8]
cmp eax, 4
ja 0x4064be
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004567fb
add esp, 0x120
ret
cmp eax, 5
jne 0x40652f
mov eax, dword [esp + 0xc]
sub eax, 0
je 0x406512
sub eax, ecx
je 0x4064f5
sub eax, ecx
jne 0x40658e
mov esi, 6
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004567fb
add esp, 0x120
ret
mov esi, 5
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004567fb
add esp, 0x120
ret
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004567fb
add esp, 0x120
ret
cmp eax, 6
jne 0x40658e
mov eax, dword [esp + 0xc]
sub eax, 0
je 0x40657d
sub eax, ecx
je 0x406556
sub eax, ecx
jne 0x40658e
xor edx, edx
cmp byte [esp + 0x11e], cl
sete dl
add edx, 0xa
jmp 0x40658c
xor eax, eax
cmp byte [esp + 0x11e], cl
sete al
add eax, 8
mov esi, eax
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004567fb
add esp, 0x120
ret
xor edx, edx
cmp byte [esp + 0x11e], cl
setne dl
add edx, 7
mov esi, edx
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004567fb
add esp, 0x120
ret
Function at 0x4065b0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x46c260
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4860f0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
test esi, esi
je 0x40677a
test ebx, ebx
je 0x40677a
lea eax, [esp + 0x10]
push eax
push 0x46e66c
push 1
push 0
push 0x46e67c
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x406624
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x406746
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push 0x46e69c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jge 0x40664b
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x406746
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
test eax, eax
jge 0x40666a
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x406746
test edi, edi
je 0x406693
cmp word [edi], 0
je 0x406693
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
test eax, eax
jge 0x406693
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x406746
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 2
push ebx
push eax
call edx
test eax, eax
jge 0x4066b4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x406746
lea eax, [esp + 0xc]
push eax
mov ecx, ebx
call fcn.00401990
mov ecx, 0x5c
lea esi, [esp + 0xc]
mov dword [esp + 0x24], 0
call fcn.00406b00
mov ecx, 0x2f
mov edi, eax
call fcn.00406b00
cmp edi, eax
jle 0x4066e8
mov eax, edi
inc eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0xc]
call fcn.004020e0
lea edi, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.00403ae0
lea ecx, [esp + 0x18]
call fcn.00401a40
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0
push ecx
push 0x2005
push 0x1008
call esi
push 0
push ebx
push 0x2005
push 2
call esi
mov ecx, edi
mov esi, 1
mov dword [esp + 0x24], 0xffffffff
call fcn.00401a40
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406756
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x406766
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x406a40
Capabilities:
Check if file exists
Get file version info

Disassembly:
sub esp, 8
push ebp
xor ebp, ebp
cmp edi, ebp
je 0x406aec
cmp word [edi], bp
je 0x406aec
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406a71
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebp
add esp, 8
ret
push esi
push ebp
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
je 0x406ae4
push ebx
push esi
call fcn.004564eb
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x406ae3
push ebx
push esi
push ebp
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x406ada
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x4729c8
push ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x406ada
mov eax, dword [esp + 0xc]
movzx edx, word [eax + 0xa]
mov ecx, dword [esp + 0x18]
mov dword [ecx], edx
movzx edx, word [eax + 8]
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov ebp, 1
push ebx
call fcn.00457270
add esp, 4
pop ebx
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebp
add esp, 8
ret

Function at 0x406c70
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x46b52e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4860f0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], vtable.CInstallLogic.0
xor edi, edi
mov dword [esp + 0x20], edi
mov eax, dword [esi + 0x32c]
cmp eax, edi
je 0x406cbf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x32c], edi
add esi, 0x328
lea eax, [esp + 0x10]
push esi
push eax
mov ebx, str.4399ExtraceTool.exe
call fcn.00405cd0
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 8
push eax
call edi
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406d03
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push esi
push ecx
mov ebx, str.4399InstallPacket.7z
call fcn.00405cd0
mov eax, dword [eax]
add esp, 8
push eax
call edi
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406d3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x20], 0xffffffff
mov esi, dword [esi]
sub esi, 0x10
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406d61
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x406e70
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push 0xffffffffffffffff
push 0x46b500
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x4860f0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
test eax, eax
jne 0x406f65
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x10]
push edx
mov ebx, 0x472c58
call fcn.00405cd0
add esp, 8
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406ee4
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x406fa4
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, 0x472c58
call fcn.00405cd0
mov eax, dword [eax]
add esp, 8
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406f40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406f65
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406f8d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteFileMakeSure_Error_ErrorCode:_d_n
mov eax, 4
call fcn.00409bb0
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406fe2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40700a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x4075a0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46c76c
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4860f0]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push esi
mov eax, dword [0x4860f0]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x26]
push ecx
mov word [esp + 0x28], ax
call fcn.00459a90
add esp, 0xc
push 0x104
lea edx, [esp + 0x20]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x407617
or eax, 0xffffffff
jmp 0x40773d
push 4
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0xc]
call fcn.0040d270
lea ecx, [esp + 0x1c]
mov dword [esp + 0x240], 0
push ecx
mov ecx, dword [esp + 0x10]
call fcn.004071f0
lea esi, [esp + 0x14]
call fcn.0040d3a0
lea edx, [esp + 0x1c]
mov byte [esp + 0x240], 1
mov ecx, dword [esp + 0x14]
push edx
call fcn.004071f0
lea esi, [esp + 0x18]
call fcn.0040d490
push eax
lea eax, [esp + 0x14]
push eax
mov ebx, 0x472ce8
mov byte [esp + 0x248], 2
call fcn.00405cd0
add esp, 8
mov byte [esp + 0x240], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4076b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040d070
mov byte [esp + 0x244], 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4076e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x240], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407710
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40773b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret
Function at 0x407a50
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b8d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4860f0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [0x489c30]
push 0x472df4
push 0x81
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x407c60
mov ecx, dword [0x489c30]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x407c60
mov edx, dword [0x489c30]
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edx
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_LockResource]
push edi
mov dword [esp + 0x1c], eax
call ebp
mov edi, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x328]
add edi, 0x328
sub eax, 0x10
call fcn.00403a70
add eax, 0x10
mov dword [esp + 0x30], eax
push str.4399ExtraceTool.exe
lea eax, [esp + 0x34]
push eax
mov eax, 0x13
mov dword [esp + 0x30], 0
call fcn.00405e40
mov ecx, dword [esp + 0x30]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407c38
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407c31
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x14], ecx
jne 0x407c31
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x489c30]
push 0x472df4
push 0x83
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x407c26
mov eax, dword [0x489c30]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x407c26
mov ecx, dword [0x489c30]
push esi
push ecx
call ebx
mov edx, dword [esp + 0x1c]
push edx
mov ebx, eax
call ebp
mov ebp, eax
mov eax, edi
lea edi, [esp + 0x30]
call fcn.00403ae0
mov edx, str.4399InstallPacket.7z
call fcn.00405a90
mov eax, dword [esp + 0x30]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407c26
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407c1f
cmp dword [esp + 0x14], ebx
jne 0x407c1f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
call fcn.00401a40
mov eax, 1
jmp 0x407c62
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x30]
call fcn.00401a40
jmp 0x407c60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407c60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x409900
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40
push ebx
push esi
add eax, 0x328
push eax
lea ecx, [esp + 0xc]
push ecx
mov ebx, str.4399GameHall.exe
call fcn.00405cd0
push 0x3c
lea edx, [esp + 0x18]
push 0
push edx
mov esi, eax
call fcn.00459a90
mov eax, dword [esi]
add esp, 0x14
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x1c], str.open
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
mov eax, dword [esp + 8]
neg esi
sbb esi, esi
add eax, 0xfffffff0
neg esi
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40998e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
pop esi
pop ebx
add esp, 0x40
ret

Function at 0x409d20
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x409d2e
pop esi
ret 8
push ebx
mov ebx, dword [esp + 0xc]
push edi
test ebx, ebx
je 0x409d71
mov edi, dword [esp + 0x14]
test edi, edi
je 0x409d71
push 2
push 0
push eax
call fcn.00457701
mov eax, dword [esi + 8]
push eax
push 1
lea ecx, [edi + edi]
push ecx
push ebx
call fcn.004578e8
mov edx, dword [esi + 8]
push edx
call fcn.00457af4
add esp, 0x20
pop edi
pop ebx
mov eax, 1
pop esi
ret 8
pop edi
pop ebx
xor eax, eax
pop esi
ret 8
Function at 0x40cbe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
mov ebx, ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40cc51
push ebp
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push ebp
call fcn.0045aa90
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x10]
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
pop ebp
test eax, eax
je 0x40cc5a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
test edi, edi
je 0x40cc90
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [edi], vtable.Gdiplus::Bitmap.0
mov dword [esp + 0x18], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov edx, dword [esp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 4], edx
jmp 0x40cc92
xor edi, edi
mov eax, dword [esp + 0x18]
mov dword [eax], edi
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test edi, edi
jne 0x40ccc7
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x40cda0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46c072
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x4860f0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
mov eax, dword [0x4860f0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov dword [esp + 0x228], 0
mov dword [esp + 8], 0
mov eax, dword [0x488da4]
mov edx, dword [eax + 0xc]
mov ecx, 0x488da4
mov dword [esp + 0xc], esi
call edx
add eax, 0x10
mov dword [esi], eax
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x1a]
mov dword [esp + 0x230], 0
push ecx
mov dword [esp + 0x14], 1
mov word [esp + 0x1c], ax
call fcn.00459a90
add esp, 0xc
push 1
push 0x1a
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40ce7d
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ce50
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x10]
mov ebx, eax
push ecx
mov eax, esi
call fcn.004018b0
push str.43994399GameHall_
push esi
mov eax, 0x13
call fcn.00405e40
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004567fb
add esp, 0x224
ret
Function at 0x40ceb0
Capabilities:
Check if file exists
Get file version info

Disassembly:
sub esp, 8
push ebp
xor ebp, ebp
cmp ebx, ebp
je 0x40cf6f
cmp word [ebx], bp
je 0x40cf6f
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40cee1
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebp
add esp, 8
ret
push esi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
je 0x40cf67
push edi
push esi
call fcn.004564eb
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x40cf66
push edi
push esi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40cf5d
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x4729c8
push edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40cf5d
mov eax, dword [esp + 0xc]
movzx edx, word [eax + 0xa]
mov dword [0x489f20], edx
movzx ecx, word [eax + 8]
mov dword [0x489f24], ecx
movzx edx, word [eax + 0xe]
mov dword [0x489f28], edx
movzx eax, word [eax + 0xc]
mov dword [0x489f2c], eax
mov ebp, 1
push edi
call fcn.00457270
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 8
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebp
add esp, 8
ret

Function at 0x40d070
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d08b
or eax, 0xffffffff
pop esi
add esp, 0x20
ret
push ebx
xor ebx, ebx
cmp esi, ebx
jne 0x40d09b
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x20
ret
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40d0a0
sub eax, edx
sar eax, 1
push ebp
mov ebp, eax
jne 0x40d0be
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x20
ret
push edi
xor ecx, ecx
lea edi, [ebp + 2]
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004564eb
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x40d0ee
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x20
ret
lea eax, [edi + edi]
push eax
push ebx
push esi
call fcn.00459a90
mov edx, dword [esp + 0x40]
lea ecx, [ebp + ebp]
push ecx
push edx
push esi
call fcn.0045aa90
add esp, 0x18
lea ecx, [esp + 0x10]
mov eax, 0x14
push ecx
mov word [esp + 0x24], ax
mov dword [esp + 0x2a], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2e], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push esi
mov edi, eax
call fcn.00457270
add esp, 4
mov eax, edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x20
ret