joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066ed0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10073dcb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
push eax
lea ecx, [esp + 0x20]
call fcn.10064cd0
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
mov dword [esp + 0x2c], 0
call edx
push eax
lea ecx, [esp + 0x18]
call fcn.10064cd0
push 0x14
mov byte [esp + 0x30], 1
call sub.MFC80U.DLL_Ordinal_762
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov byte [esp + 0x2c], 2
je 0x10066fa2
mov ecx, dword [esp + 0x14]
sub esp, 8
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
test ecx, ecx
mov dword [esp + 0x18], esp
je 0x10066f6d
add ecx, 4
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [esp + 0x24]
sub esp, 8
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x30]
test ecx, ecx
mov dword [esp + 0x20], esp
je 0x10066f97
add ecx, 4
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, eax
call fcn.10062b30
mov edi, eax
jmp 0x10066fa4
xor edi, edi
mov esi, dword [esp + 0x18]
test esi, esi
mov byte [esp + 0x2c], 0
je 0x10066fdb
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10066fdb
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10066fdb
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov esi, dword [esp + 0x20]
test esi, esi
mov dword [esp + 0x2c], 0xffffffff
je 0x10067015
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10067015
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10067015
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x10067030
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10073dcb
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
push eax
lea ecx, [esp + 0x20]
call fcn.10064cd0
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
mov dword [esp + 0x2c], 0
call edx
push eax
lea ecx, [esp + 0x18]
call fcn.10064cd0
push 0x14
mov byte [esp + 0x30], 1
call sub.MFC80U.DLL_Ordinal_762
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
mov byte [esp + 0x2c], 2
je 0x10067102
mov ecx, dword [esp + 0x14]
sub esp, 8
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x20]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
test ecx, ecx
mov dword [esp + 0x18], esp
je 0x100670cd
add ecx, 4
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [esp + 0x24]
sub esp, 8
mov edx, esp
mov dword [edx], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x30]
test ecx, ecx
mov dword [esp + 0x20], esp
je 0x100670f7
add ecx, 4
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, eax
call fcn.10062c80
mov edi, eax
jmp 0x10067104
xor edi, edi
mov esi, dword [esp + 0x18]
test esi, esi
mov byte [esp + 0x2c], 0
je 0x1006713b
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1006713b
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1006713b
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov esi, dword [esp + 0x20]
test esi, esi
mov dword [esp + 0x2c], 0xffffffff
je 0x10067175
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10067175
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10067175
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x1006b430
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1007415e
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
lea edi, [esi + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
mov dword [esp + 0x38], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x3c], 1
mov dword [esi + 0x34], ebx
call fcn.1006ba90
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x44], 2
call fcn.100035d0
cmp dword [esp + 0x2c], 0x10
jb 0x1006b4bc
mov ecx, dword [esp + 0x18]
push ecx
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x1006b4e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10074196
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
lea ecx, [edi + 0xc]
xor eax, eax
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
mov byte [ecx + 4], al
lea esi, [edi + 0x28]
mov dword [esp + 0x28], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ebx, dword [esp + 0x30]
mov edx, dword [ebx]
mov dword [edi], edx
mov edx, dword [ebx + 4]
push 0xffffffffffffffff
push eax
mov dword [edi + 4], edx
mov edx, dword [ebx + 8]
lea eax, [ebx + 0xc]
push eax
mov byte [esp + 0x34], 1
mov dword [edi + 8], edx
call fcn.100035d0
lea eax, [ebx + 0x28]
cmp esi, eax
je 0x1006b583
push eax
lea ecx, [esp + 0x18]
call fcn.1006b220
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 4], edx
mov eax, dword [esi + 8]
push eax
mov dword [esi + 8], ecx
call sub.MFC80U.DLL_Ordinal_266
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x402cf0
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x48
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x6ec21c]
movzx ecx, word [eax + 0x129]
push ecx
lea edx, [esp + 0x10]
push str.._data_aiconfig__d.dat
push edx
call fcn.00589549
push 0x5b9980
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00589502
mov eax, dword [esp + 0x20]
add esp, 0x18
test eax, eax
je 0x402d76
push eax
push 1
push 0x1c64
add edi, 0xec
push edi
call fcn.005893b5
mov edx, dword [esp + 0x18]
push edx
call fcn.005891ea
add esp, 0x14
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.00589034
add esp, 0x48
ret

Function at 0x402d90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x6ec21c]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00589549
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.00588e70
push 0x5b99b4
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00589502
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x402e68
push eax
push 1
push 0x1c64
push edi
call fcn.00589969
mov edx, dword [esp + 0x18]
push edx
call fcn.005891ea
add esp, 0x14
call fcn.00401240
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x402e2b
fadd dword [0x5b9928]
fstp dword [esi + 0xe0]
call fcn.00401240
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x402e51
fadd dword [0x5b9928]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00589034
add esp, 0x4c
ret
mov ecx, esi
call fcn.00402e80
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00589034
add esp, 0x4c
ret
Function at 0x402da3
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x6ec21c]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00589549
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.00588e70
push 0x5b99b4
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00589502
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x402e68
push eax
push 1
push 0x1c64
push edi
call fcn.00589969
mov edx, dword [esp + 0x18]
push edx
call fcn.005891ea
add esp, 0x14
call fcn.00401240
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x402e2b
fadd dword [0x5b9928]
fstp dword [esi + 0xe0]
call fcn.00401240
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x402e51
fadd dword [0x5b9928]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00589034
add esp, 0x4c
ret
mov ecx, esi
call fcn.00402e80
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00589034
add esp, 0x4c
ret
Function at 0x407b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x48], eax
movzx eax, word [esp + 0x54]
push ebp
push edi
mov edi, ecx
push eax
mov ecx, 0x6ec1a8
mov dword [esp + 0x10], eax
call fcn.00494650
mov ebp, eax
mov dword [esp + 8], ebp
test ebp, ebp
je 0x407d3c
push ebx
xor ebx, ebx
push esi
jmp 0x407b90
mov ecx, dword [edi + 0x218]
movzx esi, bx
push esi
call fcn.00408970
test eax, eax
je 0x407bdc
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x78]
call eax
cmp word [esp + 0x14], ax
jne 0x407bdc
mov ecx, dword [edi + 0x218]
push esi
call fcn.00408970
mov esi, eax
test esi, esi
je 0x407bdc
mov ecx, dword [edi + 0x218]
push esi
call fcn.0042fec0
push esi
mov ecx, 0x6eb910
call fcn.00443e90
inc ebx
cmp ebx, 5
jl 0x407b90
mov ebx, dword [ebp + 0x538]
test ebx, ebx
je 0x407d08
mov ebp, dword [esp + 0x60]
mov ecx, dword [edi + 0x218]
push ebp
call fcn.00408970
mov esi, eax
test esi, esi
je 0x407c1d
mov ecx, dword [edi + 0x218]
push esi
call fcn.0042fec0
push esi
mov ecx, 0x6eb910
call fcn.00443e90
push 0x53c
call fcn.00588f26
add esp, 4
test eax, eax
je 0x407c39
mov ecx, eax
call fcn.00493ed0
mov esi, eax
jmp 0x407c3b
xor esi, esi
lea ecx, [esp + 0x38]
call fcn.0042ffc0
lea ecx, [esp + 0x18]
call fcn.0042ffc0
mov edx, dword [ebx + 0x33]
push 2
lea ecx, [esp + 0x3c]
push ecx
push edx
mov ecx, 0x6eb7a0
call fcn.004356c0
mov ecx, dword [ebx + 0x37]
push 2
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, 0x6eb7a0
call fcn.004356c0
mov edx, dword [esi]
mov edx, dword [edx + 0xb4]
lea eax, [ebp + 0x109a0]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x40]
push eax
push 0x28
push 0x28
push 0
push 0
mov ecx, esi
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x220]
add eax, 0x4b8
mov dword [esi + 0x220], ecx
push eax
mov ecx, esi
call fcn.00493f90
mov edx, 0x8e
mov dword [esi + 0x538], ebx
mov word [esi + 0xc], dx
mov ecx, dword [0x6eb928]
push esi
call fcn.00582b00
mov ecx, dword [edi + 0x218]
push esi
push ebp
call fcn.0042fc30
lea ecx, [esp + 0x18]
call fcn.0042ffd0
lea ecx, [esp + 0x38]
call fcn.0042ffd0
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00589034
add esp, 0x4c
ret 8
push 0x9ac
mov ecx, 0x6ee218
call fcn.004d69e0
push eax
push 0x1d
push 0x6ee218
call fcn.004d7c10
add esp, 0xc
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00589034
add esp, 0x4c
ret 8
push 0x9ac
mov ecx, 0x6ee218
call fcn.004d69e0
push eax
push 0x1d
push 0x6ee218
call fcn.004d7c10
mov ecx, dword [esp + 0x5c]
add esp, 0xc
pop edi
pop ebp
xor ecx, esp
call fcn.00589034
add esp, 0x4c
ret 8

Function at 0x40ac40
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
push 0x40abc0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x6ddd94], eax
ret 4
Function at 0x40b030
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x35c
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push ebp
push 0x104
lea eax, [esp + 0x260]
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x25c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40b066
mov ecx, dword [str.mfl.dat]
mov edx, dword [0x5b9d6c]
mov dword [eax], ecx
mov cl, byte [0x5b9d70]
mov dword [eax + 4], edx
lea edx, [esp + 0x25c]
push 0x5b9d10
push edx
mov byte [eax + 8], cl
call fcn.005894eb
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40b0c5
push eax
call fcn.005891ea
add esp, 4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.00589034
add esp, 0x35c
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x160]
push eax
push 0x104
call edi
lea eax, [esp + 0x160]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40b0e4
mov ecx, dword [str.Resource.bin]
mov edx, dword [0x5b9d5c]
mov dword [eax], ecx
mov ecx, dword [0x5b9d60]
mov dword [eax + 4], edx
mov edx, dword [0x5b9d64]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.0058a651
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.0058a651
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b124
lea edx, [esp + 0x160]
push edx
push 0x104
call edi
lea edi, [esp + 0x160]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40b1a0
mov ecx, 6
mov esi, str.ResourceSkillArea.bsad
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea esp, [esp]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.0058a651
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.0058a651
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b1d0
push ebx
call fcn.005891ea
mov ecx, dword [esp + 0x36c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00589034
add esp, 0x35c
ret
Function at 0x40b260
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
mov ecx, 0x6dfb40
call fcn.004268c0
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0x6ddd88], ebp
call ebx
mov edi, eax
push 7
add edi, edi
call ebx
mov esi, eax
push 4
add esi, esi
call ebx
lea ecx, [esi + eax]
mov esi, dword [0x716e74]
xor edx, edx
mov eax, esi
div dword [0x716400]
mov eax, dword [0x716404]
mov edx, dword [eax + edx*4]
test edx, edx
je 0x40b2bd
cmp dword [edx], esi
je 0x40b301
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x40b2b2
push 0
push ebp
push 0
push 0
add ecx, 0x300
push ecx
add edi, 0x400
push edi
push 0
push 0x80000000
push 0x2ca0000
push 0x6ddb88
push 0x6dd988
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0x6ddd8c], esi
test esi, esi
jne 0x40b31d
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [edx + 4]
test edx, edx
je 0x40b2bd
mov eax, dword [edx + 8]
push 0
push ebp
push 0
add eax, ecx
mov ecx, dword [edx + 4]
push 0
push eax
add ecx, edi
push ecx
jmp 0x40b2d2
mov edx, dword [esp + 0x18]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x6dddc0
call fcn.0040ca10
cmp dword [0x6ee148], 0
push 0
mov ecx, 0x6dddc0
push 0
jne 0x40b36e
push 1
call fcn.0040c880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push 2
call fcn.0040c880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x40bb10
Capabilities:
Create directory
Delete file

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push esi
call fcn.0040ac40
mov eax, dword [esp + 0x2c]
mov dword [0x6dd840], 0
mov ecx, str.gvkc9jw0ot0Ut
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40bb51
test dl, dl
je 0x40bb4d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40bb51
add eax, 2
add ecx, 2
test dl, dl
jne 0x40bb31
xor eax, eax
jmp 0x40bb56
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40bb77
push 0
push str.Error__
push 0x5b9e9c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
call fcn.0040aeb0
test eax, eax
je 0x40bb6e
push esi
call fcn.0040ac40
push str.._Log_Debug.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x5b9e88
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str._______________________________________________________
push 0x6fb8b0
call fcn.005256f0
push str._____________________Client_Start______________________
push 0x6fb8b0
call fcn.005256f0
push str._______________________________________________________
push 0x6fb8b0
call fcn.005256f0
add esp, 0x18
call fcn.0040ae20
mov ecx, 0x6fce88
call fcn.00534b50
push 0x7162d2
push 0x6ddb88
call fcn.00589549
push 0x7162d2
push 0x6dd988
call fcn.00589549
push esi
call fcn.0040baa0
add esp, 0x14
mov ecx, 0x6fce88
call fcn.0052fc10
push str.._Resource_QuestScript_QuestString.bin
mov ecx, 0x6f9b08
call fcn.004f4ba0
push str.._Resource_QuestScript_QuestScript.bin
mov ecx, 0x6f9b08
call fcn.004f5720
push str.._Resource_QuestScript_NewbieGuide.bin
mov ecx, 0x6f9b08
call fcn.004f3880
push str.._Resource_QuestScript_QuestNpcList.bin
mov ecx, 0x6f9b08
call fcn.004f4d40
mov ecx, 0x6eb7a0
call fcn.00435bc0
mov eax, dword [esp + 0x30]
push eax
push esi
call fcn.0040b260
add esp, 8
test eax, eax
jne 0x40bc74
call fcn.0040aec0
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
je 0x40bcab
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
jmp 0x40bc88
mov ecx, 0x6dddc0
call fcn.0040cd90
cmp eax, 0xffffffff
jne 0x40bc88
call fcn.0040aec0
mov eax, dword [esp + 0x14]
pop edi
pop ebx
pop esi
add esp, 0x1c
ret 0x10
Function at 0x420d00
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x130
mov eax, dword [0x6dc0d0]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov esi, dword [esp + 0x13c]
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp esi, ebx
je 0x420eb2
cmp byte [esi], bl
je 0x420eb2
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420eb2
mov edx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x420d84
mov dword [esp + 0xc], 0x64
push edi
xor edi, edi
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
jbe 0x420ea0
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea esp, [esp]
xor eax, eax
push edi
push str._04u
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
lea eax, [esp + 0x38]
push 5
push eax
call fcn.00421180
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420e79
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0x104
call ebp
test eax, eax
je 0x420e1f
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x420e79
push esi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x420e3c
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x420e79
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.Characteristics
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 4
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x420e97
mov esi, dword [esp + 0x2c]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x420da0
mov edx, dword [esp + 0x18]
pop ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x420eb4
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
pop ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x420eb4
xor eax, eax
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
call fcn.00589034
add esp, 0x130
ret 4