joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d7a0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ed108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call fcn.0045ae70
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x38]
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], edx
lea ecx, [esp + 0x10]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x40]
lea edx, [esp + 0xc]
push ecx
xor ebx, ebx
push edx
push eax
mov dword [esp + 0x3c], ebx
mov dword [esi], 0x4f75c4
mov dword [esi + 8], str.sign_gump
mov dword [esi + 0x60], ebx
mov dword [esi + 0x54], eax
mov dword [esi + 0x64], ebx
call fcn.004447f0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push str.framedata_for_CDumbGump
push 8
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.dumb_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x20]
imul eax, dword [esi + 0x24]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x20]
imul ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov word [ecx + 2], dx
mov eax, dword [esi + 0x3c]
xor ecx, ecx
xor edx, edx
mov eax, dword [eax + 4]
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
add eax, 4
push edx
push eax
mov eax, dword [esi + 0x54]
push ebx
push ebx
push eax
push fcn.004c00b0
call fcn.00444850
mov edx, dword [esi + 0x54]
lea ecx, [esp + 0x50]
push ecx
push edx
call fcn.00459210
mov edx, dword [esi + 0x3c]
add esp, 0x40
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x18]
push ebx
push ebx
push ebx
push eax
mov eax, dword [edx + 4]
mov edx, dword [esp + 0x58]
add eax, 4
push ecx
mov ecx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x30]
sub ecx, eax
inc ecx
push ecx
mov ecx, dword [esp + 0x38]
push edx
push 0x386
push 1
push ecx
push eax
call fcn.004424b0
mov ecx, dword [esp + 0x58]
add esp, 0x30
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret 0x18
Function at 0x45fc70
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push esi
push edi
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x74166c
push 0
push str.SOFTWAREOrigin_Worlds_OnlineUltima_Online1.0HWProfile
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x45fcab
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
lea edx, [esi + 1]
push edx
push 3
push 0
push str.processorType
push eax
call edi
test eax, eax
je 0x45fcd7
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
lea ecx, [esi + 2]
push 2
push ecx
push 3
push 0
push str.processorClock
push edx
call edi
test eax, eax
je 0x45fcf9
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
lea eax, [esi + 4]
push 1
push eax
push 3
push 0
push str.nProcessors
push ecx
call edi
test eax, eax
je 0x45fd1b
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
lea edx, [esi + 5]
push 0x20
push edx
push 1
push 0
push str.szVideoCardDescrip1
push eax
call edi
test eax, eax
je 0x45fd3d
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
lea ecx, [esi + 0x25]
push 0x20
push ecx
push 1
push 0
push str.szVideoCardDescrip2
push edx
call edi
test eax, eax
je 0x45fd5f
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
lea eax, [esi + 0x45]
push 0x20
push eax
push 1
push 0
push str.szModemManufacturer
push ecx
call edi
test eax, eax
je 0x45fd81
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
lea edx, [esi + 0x65]
push 0x20
push edx
push 1
push 0
push str.szModemDescrip
push eax
call edi
test eax, eax
je 0x45fda3
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
lea ecx, [esi + 0x86]
push 2
push ecx
push 3
push 0
push str.totalRAMInMB
push edx
call edi
test eax, eax
je 0x45fdc8
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
lea eax, [esi + 0x88]
push 2
push eax
push 3
push 0
push str.largestPartitionInMB
push ecx
call edi
test eax, eax
je 0x45fded
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
add esi, 0x8c
push 4
push esi
push 3
push 0
push str.timeZoneBias
push edx
call edi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 8
ret
Function at 0x467fe0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ed54e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0045ae70
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov ebp, 1
push str.HTMLBox_framedata
push 8
mov dword [esp + 0x24], ebx
mov dword [esi], 0x4f7d88
mov dword [esi + 0x9c], eax
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xb0], ebp
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xac], ebp
mov byte [esi + 0xb4], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.HTMLBox_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
add esp, 0x10
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
push 0x104
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x34]
cmp eax, ebx
mov word [ecx + 2], dx
jne 0x468119
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebx
mov byte [esp + 0x1c], 1
je 0x468140
push ebp
push ebx
push 0x11b7
push ebx
push esi
mov ecx, eax
call fcn.00465c20
jmp 0x468142
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebx
mov byte [esp + 0x1c], 2
je 0x468140
push ebp
push ebx
push 0x1b7
push ebx
push esi
mov ecx, eax
call fcn.00465c20
jmp 0x468142
xor eax, eax
mov dword [esi + 0xa0], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esi + 0xa0]
push ebp
push eax
mov byte [esp + 0x24], bl
call fcn.004660f0
mov ecx, dword [esp + 0x24]
push ebp
push ecx
mov ecx, esi
call fcn.0045a530
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x468400
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ed593
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0045ae70
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov ebp, 1
push str.HTMLBox_framedata
push 8
mov dword [esp + 0x24], ebx
mov dword [esi], 0x4f7f20
mov dword [esi + 0x9c], eax
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xb0], ebp
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xac], ebp
mov byte [esi + 0xb4], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.HTMLBox_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
push 0x104
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov word [ecx + 2], dx
call fcn.004ddf8e
add esp, 0x14
mov dword [esp + 0x28], eax
mov byte [esp + 0x1c], 1
cmp eax, ebx
je 0x46852e
push ebp
push ebx
push 0x1b7
push ebx
push esi
mov ecx, eax
call fcn.00465c20
jmp 0x468530
xor eax, eax
mov ecx, dword [esp + 0x2c]
push ebp
push ecx
mov ecx, eax
mov byte [esp + 0x24], bl
mov dword [esi + 0xa0], eax
call fcn.004660f0
mov edx, dword [esp + 0x24]
push ebp
push edx
mov ecx, esi
call fcn.0045a530
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x468840
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ed5d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0045ae70
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov dword [esi], 0x4f80b8
mov dword [esi + 0x9c], eax
mov dword [esi + 0x1834], ebx
mov dword [esi + 0x1838], ebx
mov dword [esi + 0x50], ebx
mov ebp, 1
push str.HTMLBox_framedata
mov dword [esi + 0x4c], ebx
push 8
mov dword [esp + 0x24], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x181c], ebx
mov dword [esi + 0x1824], ebp
mov dword [esi + 0x1818], ebx
mov dword [esi + 0x1820], ebp
mov dword [esi + 0x1828], ebx
mov dword [esi + 0x182c], ebx
mov dword [esi + 0x1830], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.HTMLBox_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
add esp, 0x10
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
lea eax, [esi + 0x870]
mov word [ecx + 2], dx
mov ecx, 0x1f4
mov dword [eax - 0x7d0], ebx
mov dword [eax], ebx
mov dword [eax + 0x7d0], ebx
add eax, 4
dec ecx
jne 0x468968
or eax, 0xffffffff
push 0xb0
mov dword [esi + 0x1810], eax
mov dword [esi + 0x1814], eax
mov dword [esi + 0x183c], 0xdac
mov dword [esi + 0x1840], 0xdad
mov dword [esi + 0x1844], 0xdae
mov dword [esi + 0x1848], 0xdaf
mov dword [esi + 0x184c], 0xdb0
mov dword [esi + 0x1850], 0xdb1
mov dword [esi + 0x1854], 0xdb2
mov dword [esi + 0x1858], 0xdb3
mov dword [esi + 0x185c], 0xdb4
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x28], eax
cmp eax, ebx
mov byte [esp + 0x1c], 1
je 0x468a09
push esi
mov ecx, eax
call fcn.00435f10
jmp 0x468a0b
xor eax, eax
mov dword [esi + 0x1860], eax
mov eax, dword [esp + 0x24]
push ebp
push eax
mov ecx, esi
mov byte [esp + 0x24], bl
call fcn.0045a530
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x46a3b0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4ed653
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0045ae70
mov eax, dword [esp + 0x28]
mov cl, byte [esp + 0x2c]
xor ebx, ebx
mov dword [esi], 0x4f8250
mov dword [esi + 0x9c], eax
mov ebp, 1
push str.HTMLBox_framedata
mov dword [esi + 0x888], ebx
push 8
mov dword [esp + 0x24], ebx
mov dword [esi + 0x88c], ebx
mov byte [esi + 0x874], cl
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x87c], ebx
mov dword [esi + 0x884], ebp
mov dword [esi + 0x878], ebx
mov dword [esi + 0x880], ebp
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.HTMLBox_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x3c]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x20]
lea edi, [esi + 0xa0]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
xor eax, eax
mov word [ecx + 2], dx
mov ecx, 0x1f4
rep stosd dword es:[edi], eax
push 0xb0
mov dword [esi + 0x870], 0xffffffff
mov dword [esi + 0x890], 0xdac
mov dword [esi + 0x894], 0xdad
mov dword [esi + 0x898], 0xdae
mov dword [esi + 0x89c], 0xdaf
mov dword [esi + 0x8a0], 0xdb0
mov dword [esi + 0x8a4], 0xdb1
mov dword [esi + 0x8a8], 0xdb2
mov dword [esi + 0x8ac], 0xdb3
mov dword [esi + 0x8b0], 0xdb4
call fcn.004ddf8e
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebx
mov byte [esp + 0x1c], 1
je 0x46a559
push esi
mov ecx, eax
call fcn.00435f10
jmp 0x46a55b
xor eax, eax
mov dword [esi + 0x8b4], eax
mov eax, dword [esp + 0x24]
push ebp
push eax
mov ecx, esi
mov byte [esp + 0x24], bl
call fcn.0045a530
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x46df70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
mov ebx, ecx
push 0x11
call esi
xor ecx, ecx
push 0x10
test ax, ax
setl cl
mov edi, ecx
call esi
push 0x12
call esi
test ax, ax
mov eax, dword [esp + 0x10]
jge 0x46dfac
cmp eax, 0x73
je case.0x46dfd7.42
cmp eax, 9
jne 0x46dfac
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov ecx, dword [0xcc02c8]
test ecx, ecx
je 0x46dfed
mov ecx, dword [0xb66128]
test ecx, ecx
jne 0x46dfed
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x46dfed
add eax, 0xffffffdf
cmp eax, 0x30
ja case.0x46dfd7.42
xor edx, edx
mov dl, byte [eax + 0x46e164]
jmp dword [edx*4 + 0x46e13c]
mov eax, dword [esp + 0x14]
push eax
push 0
call fcn.0047d1e0
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov ecx, dword [esp + 0x14]
push ecx
push 1
call fcn.0047d1e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov edx, dword [esp + 0x14]
push edx
push 2
call fcn.0047d1e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esp + 0x14]
push eax
push 3
call fcn.0047d1e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esp + 0x14]
push ecx
push 4
call fcn.0047d1e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov edx, dword [esp + 0x14]
push edx
push 5
call fcn.0047d1e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esp + 0x14]
push eax
push 6
call fcn.0047d1e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esp + 0x14]
push ecx
push 7
call fcn.0047d1e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
test edi, edi
je 0x46dfed
mov al, byte [0xcc9322]
test al, al
je 0x46e0dd
lea edx, [ebx + 0x120]
lea esi, [ebx + 0xc]
push edx
push esi
call fcn.004cb010
push esi
call fcn.004caee0
add esp, 0xc
mov dword [ebx + 8], eax
jmp 0x46e112
lea edi, [ebx + 0x120]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebx + 8], ecx
mov ecx, dword [ebx + 0x228]
mov dword [ebx + 0x114], ecx
mov ecx, ebx
call fcn.0046f070
pop edi
pop esi
mov dword [0xcc02dc], 1
mov eax, 1
pop ebx
ret 8
Function at 0x4720e0
Capabilities:
Terminate process

Disassembly:
mov al, byte [0xcc02fc]
push ebx
xor ebx, ebx
cmp al, bl
je 0x472135
cmp byte [0xcc02fe], bl
je 0x472111
mov eax, dword [0xcc0300]
cmp eax, ebx
je 0x472111
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0xcc0300], ebx
mov byte [0xcc02fe], bl
mov eax, dword [0xcc0310]
cmp eax, ebx
je 0x472123
push eax
call fcn.004ddac0
add esp, 4
mov dword [0xcc0310], ebx
mov byte [0xcc0304], bl
mov byte [0xcc02fc], bl
pop ebx
ret
Function at 0x478af0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x47ead0
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0xcc5170]
sub esp, 8
push ebx
xor ebx, ebx
cmp al, bl
jne 0x47ed0c
push edi
push fcn.0047f3f0
call fcn.004e0a9f
add esp, 4
push 0xd58730
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push str.UO_Player
push 0x542d68
push 0xcc4e98
mov dword [0xcc2f80], ebx
mov dword [0x541be0], ebx
mov byte [0xcc4b14], bl
mov byte [0xcc4eb8], bl
call fcn.004de113
mov ecx, 0xc
xor eax, eax
mov edi, 0xd15b30
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 3
mov ecx, 0x3e3
mov word [0xcc4c62], ax
mov word [0xcc4c5e], ax
lea eax, [esp + 0xc]
mov byte [0xcc4af0], bl
push eax
push 1
push ebx
push str.SOFTWAREOrigin_Worlds_OnlineUltima_Online1.0
push reloc.WSOCK32.dll_bind
mov byte [0xcc2d98], bl
mov byte [0xcc2db8], bl
mov byte [0xcc2d78], bl
mov dword [0xcc4c18], 1
mov dword [0xcc4c38], ebx
mov dword [0xcc4c3c], ebx
mov dword [0xcc4c40], ebx
mov dword [0xcc4c24], ebx
mov dword [0xcc5058], ebx
mov dword [0xcc4e70], 0x32
mov dword [0xcc4c68], ebx
mov word [0xcc4c64], cx
mov word [0xcc4c60], cx
mov dword [0xcc4b10], ebx
mov dword [0xcc2f40], ebx
mov dword [0xcc4c44], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x47ec06
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push 0xcc4c70
push ebx
push ebx
push str.ExePath
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x47ec1e
push 0x10
push str.ERROR
push str.Ultima_Online_does_not_appear_to_be_installed_correctly_on_your_system._n_nPlease_re_install_UO_by_running_the_setup.exe_program_located_on_your_UO_CD_ROM
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
add esp, 8
ret
push esi
mov esi, 0xcc4c70
push 0x5c
push esi
call fcn.004df5b0
add esp, 8
test eax, eax
je 0x47ec4d
push 0x5c
push esi
call fcn.004df5b0
inc eax
push 0x5c
mov esi, eax
push esi
call fcn.004df5b0
add esp, 0x10
test eax, eax
jne 0x47ec33
push 1
mov byte [esi], bl
push str.uo.cfg
mov byte [0xcc2f44], bl
mov dword [0xcc2df4], ebx
call fcn.00437a60
mov ecx, dword [0xcc2f40]
add esp, 8
cmp ecx, ebx
mov eax, str.login.cfg
pop esi
je 0x47ec7c
mov eax, ecx
push ebx
push eax
call fcn.00437a60
add esp, 8
call fcn.0047fd10
call fcn.00473ea0
mov dword [0xcc2f74], ebx
mov dword [0xcc2f78], ebx
mov dword [0xcc2f7c], 4
mov dword [0xcc4e78], ebx
mov byte [0xcc4e74], bl
mov dword [0xcc2f70], ebx
mov dword [0xcc2f6c], ebx
mov dword [0xcc2f68], ebx
mov dword [0xcc2f5c], ebx
mov dword [0xcc2f64], ebx
mov dword [0xcc2f60], ebx
mov dword [0xcc2f58], ebx
mov dword [0xcc2f54], ebx
mov dword [0xcc2f50], ebx
mov dword [0xcc2f4c], ebx
mov dword [0xcc2f48], ebx
mov dword [0xcc2d70], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xcc2d6c], eax
mov byte [0xcc5170], 1
pop ebx
add esp, 8
ret
Function at 0x47f7c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebp
xor ebx, ebx
mov esi, eax
push ebx
mov dword [0xcc51ec], esi
call fcn.004e0ade
mov edx, dword [0xcc2848]
mov dword [0xcc51f0], eax
mov eax, esi
add esp, 4
sub eax, edx
cmp eax, 0x21
jb 0x47f86e
mov edx, dword [0xcc2844]
mov ecx, esi
sub ecx, edx
xor edi, edi
cmp ecx, 0x3e8
mov dword [0xcc2848], esi
jb 0x47f85a
mov eax, dword [0xcc4c40]
mov dword [0xcc2844], esi
inc eax
cmp eax, 0x14
mov dword [0xcc4c40], eax
jl 0x47f855
mov eax, dword [0xcc4c3c]
mov dword [0xcc4c40], ebx
inc eax
cmp eax, 0x3c
mov dword [0xcc4c3c], eax
jl 0x47f855
mov eax, dword [0xcc4c38]
mov dword [0xcc4c3c], ebx
inc eax
cmp eax, 0x18
mov dword [0xcc4c38], eax
jl 0x47f855
mov dword [0xcc4c38], ebx
mov edi, 1
call fcn.0047adf0
call fcn.00458d80
cmp edi, 1
jne 0x47f86e
call fcn.00488d00
mov ecx, dword [0xcc2848]
mov edx, esi
sub edx, ecx
cmp edx, 0x3e
jb 0x47f888
mov dword [0xcc2848], esi
call fcn.00401e90
mov edx, dword [0xcc2840]
mov eax, esi
sub eax, edx
cmp eax, 0x4c
jb 0x47f980
mov dword [0xcc2840], esi
call ebp
mov edi, dword [0xcc2d6c]
mov ecx, eax
mov edx, ecx
mov eax, 0x10624dd3
sub edx, edi
imul edx, dword [0x50a1c0]
mul edx
mov eax, dword [0xcc2d70]
shr edx, 6
sub eax, edx
mov dword [0xcc2d70], eax
jns 0x47f8d4
mov dword [0xcc2d70], ebx
mov dword [0xcc2d6c], ecx
call fcn.00480f40
call fcn.00475e60
call fcn.004d30e0
call fcn.004d41f0
call fcn.0047d620
call fcn.004879b0
call fcn.004d16b0
call fcn.00473460
mov eax, dword [0xcc0494]
cmp eax, ebx
je 0x47f911
dec eax
mov dword [0xcc0494], eax
cmp dword [esp + 0x14], ebx
jne 0x47f91c
call fcn.00448d40
cmp dword [0xcc51c4], ebx
jne 0x47f93c
mov eax, dword [0xcc516c]
cmp dword [eax + 0x1c], ebx
jne 0x47f93c
mov ecx, dword [0xcc51f0]
mov dword [0xcc51c8], ecx
jmp 0x47f973
mov eax, dword [0xcc51f0]
mov esi, dword [0xcc51c8]
mov edx, eax
sub edx, esi
cmp edx, 0x3c
jle 0x47f973
mov dword [0xcc51c8], eax
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004a1870
add esp, 8
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0xcc516c]
call fcn.004c2f70
cmp byte [0x50d531], bl
jne 0x47f980
call fcn.0045f1f0
pop edi
pop esi
pop ebp
pop ebx
ret