joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cd40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push edi
mov edi, ecx
mov ebx, dword [edi + 0x30]
test ebx, ebx
je 0x45ce16
mov ecx, dword [esp + 0x68]
mov eax, dword [edi + 0x7c]
mov edx, dword [esp + 0x5c]
push ebp
mov ebp, dword [esp + 0x64]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x58], ecx
push esi
mov esi, dword [edi + 0x78]
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x44], ebp
xor ebp, ebp
push ecx
mov ecx, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], eax
call fcn.004469b0
test eax, eax
je 0x45ce14
imul esi, dword [esp + 0x2c]
add esi, dword [esp + 0x28]
lea edx, [esi + ebx]
lea eax, [edx + esi*2]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x3c]
test eax, eax
jle 0x45ce14
mov edx, dword [esp + 0x74]
mov ebx, dword [esp + 0x38]
jmp 0x45cde0
mov ecx, dword [edi + 0x78]
mov eax, dword [esp + 0x64]
imul ecx, ebp
lea eax, [eax + ecx*2]
add eax, ecx
test ebx, ebx
jle 0x45ce0b
mov esi, ebx
mov cl, byte [edx]
mov byte [eax], cl
mov cl, byte [edx + 1]
mov byte [eax + 1], cl
mov cl, byte [edx + 2]
mov byte [eax + 2], cl
add eax, 3
dec esi
jne 0x45cdf5
mov eax, dword [esp + 0x3c]
inc ebp
cmp ebp, eax
jl 0x45cde0
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x50
ret 0x14

Function at 0x45db80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x487c9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 0x14]
mov dword [esi], 0x48bd58
xor ebx, ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov dword [esp + 8], esi
mov byte [ecx + 4], bl
mov eax, fcn.00440620
mov dword [esi + 0x78], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
push 0xb
mov dword [esi + 0x68], eax
push str.DefaultName
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x6c], eax
call fcn.004042c0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x45dcd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x487cd1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x48bd6c
lea ebx, [esi + 4]
mov ecx, ebx
mov dword [esp + 0x18], 2
call fcn.00461660
lea edi, [esi + 0x24]
mov ecx, edi
mov dword [esi + 0x20], 0
call fcn.0045dc20
add esi, 0x30
mov ecx, esi
call fcn.0045dc20
mov ecx, ebx
call fcn.00461670
mov ecx, esi
call fcn.0045dc20
mov eax, dword [esi + 4]
push eax
call fcn.0046683d
add esp, 4
mov ecx, edi
mov dword [esi + 4], 0
call fcn.0045dc20
mov eax, dword [edi + 4]
push eax
call fcn.0046683d
add esp, 4
mov ecx, ebx
mov dword [edi + 4], 0
mov dword [esp + 0x18], 0xffffffff
call fcn.00461640
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x45ddf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x487cf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
mov dword [esp + 0xc], esi
mov dword [esi], 0x48bd6c
call fcn.00461620
lea edi, [esi + 0x24]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x18], ebx
call fcn.0045dc60
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.0045dc60
mov ecx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x20], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x46767c
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x48c518
call fcn.00468d14
mov edi, 0x94
mov eax, edi
call fcn.00465dc0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x48916c]
mov ecx, dword [esi + 0x10]
mov dword [0x4cd984], ecx
mov eax, dword [esi + 4]
mov dword [0x4cd990], eax
mov edx, dword [esi + 8]
mov dword [0x4cd994], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4cd988], esi
cmp ecx, 2
je 0x4676dc
or esi, 0x8000
mov dword [0x4cd988], esi
shl eax, 8
add eax, edx
mov dword [0x4cd98c], eax
xor esi, esi
push esi
mov edi, dword [0x489178]
call edi
cmp word [eax], 0x5a4d
jne 0x467717
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x467717
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x46772f
cmp eax, 0x20b
je 0x46771c
mov dword [ebp - 0x1c], esi
jmp 0x467743
cmp dword [ecx + 0x84], 0xe
jbe 0x467717
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x46773d
cmp dword [ecx + 0x74], 0xe
jbe 0x467717
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0046a424
pop ecx
test eax, eax
jne 0x467757
push 0x1c
call fcn.00467658
pop ecx
call fcn.00469668
test eax, eax
jne 0x467768
push 0x10
call fcn.00467658
pop ecx
call fcn.0046ddad
mov dword [ebp - 4], esi
call fcn.0046d280
test eax, eax
jge 0x467781
push 0x1b
call fcn.00467633
pop ecx
call dword [0x489170]
mov dword [0x4cefc0], eax
call fcn.0046dc8b
mov dword [0x4cd708], eax
call fcn.0046dbe9
test eax, eax
jge 0x4677a7
push 8
call fcn.00467633
pop ecx
call fcn.0046d9b6
test eax, eax
jge 0x4677b8
push 9
call fcn.00467633
pop ecx
push 1
call fcn.0046d4d8
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4677ce
push eax
call fcn.00467633
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x489174]
call fcn.0046d959
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4677ef
movzx eax, word [ebp - 0x40]
jmp 0x4677f2
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0040c490
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x467810
push edi
call fcn.0046d605
call fcn.0046d627
jmp 0x467842
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00468d4f
ret
Function at 0x470135
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x470163
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x47016a
cmp ebx, dword [eax + 4]
jae 0x47016a
xor eax, eax
jmp 0x47035a
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x47017b
xor eax, eax
inc eax
jmp 0x470359
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x470191
cmp ecx, edx
jae 0x4702d6
cmp dword [eax + 4], 0
je 0x47019a
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x470182
cmp dword [ebp + 8], 0
je 0x4701bc
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4702d6
cmp eax, esi
jae 0x4702d6
mov eax, dword [0x4cdb08]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4701e1
cmp dword [esi*4 + 0x4cdb10], edi
je 0x4702da
inc esi
cmp esi, eax
jl 0x4701cf
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4890c8]
test eax, eax
je 0x470356
cmp dword [ebp - 8], 0x1000000
jne 0x470356
test byte [ebp - 0xc], 0xcc
je 0x47025f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x470356
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x470356
cmp word [eax + 0x18], 0x10b
jne 0x470356
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x470356
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x47025f
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x47025f
test byte [ecx + 0x27], 0x80
jne 0x4702d6
push 1
push 0x4cdb50
call dword [0x4890cc]
test eax, eax
jne 0x470173
mov ecx, dword [0x4cdb08]
test ecx, ecx
mov edx, ecx
jle 0x470293
lea eax, [ecx*4 + 0x4cdb0c]
cmp dword [eax], edi
je 0x470293
dec edx
sub eax, 4
test edx, edx
jg 0x470287
test edx, edx
jne 0x4702c4
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4702a0
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4702b8
lea eax, [edx*4 + 0x4cdb10]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4702a6
cmp ecx, 0x10
jge 0x4702c4
inc ecx
mov dword [0x4cdb08], ecx
push 0
push 0x4cdb50
call dword [0x4890cc]
jmp 0x470173
xor eax, eax
jmp 0x470359
test esi, esi
jle 0x470173
mov ebx, dword [0x4890cc]
push 1
push 0x4cdb50
call ebx
test eax, eax
jne 0x470173
cmp dword [esi*4 + 0x4cdb10], edi
je 0x470330
mov eax, dword [0x4cdb08]
lea esi, [eax - 1]
test esi, esi
jl 0x47031e
cmp dword [esi*4 + 0x4cdb10], edi
je 0x47031a
dec esi
jns 0x47030e
test esi, esi
jge 0x47032e
cmp eax, 0x10
jge 0x470329
inc eax
mov dword [0x4cdb08], eax
lea esi, [eax - 1]
jmp 0x470330
je 0x470348
xor ecx, ecx
test esi, esi
jl 0x470348
lea eax, [ecx*4 + 0x4cdb10]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x470336
push 0
push 0x4cdb50
call ebx
jmp 0x470173
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x474100
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x4741a1
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
cmp esi, edx
push edi
jle 0x47414f
mov edi, dword [ecx]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x4962d0]
shl eax, 8
xor eax, ebp
inc edx
cmp edx, esi
jl 0x474131
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x47417c
mov edi, dword [ecx + 8]
lea esp, [esp]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x4962d0]
shl eax, 8
xor eax, ebp
inc edx
cmp edx, esi
jl 0x474160
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
pop edi
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop esi
shr eax, 0x18
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x401000
Capabilities:
Check mutex on windows
Delete file

Disassembly:
sub esp, 0x22c
mov eax, dword [0x424004]
xor eax, esp
mov dword [esp + 0x228], eax
push esi
mov esi, dword [esp + 0x238]
push str._ACDELTREE_BF493F10_9A20_44E3_987D_F32EBC0562BC
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x40103b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 4]
push eax
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x10], 3
mov word [esp + 0x1c], 0x614
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 4]
lea ecx, [esp + 0x24]
push edx
mov word [esp + eax*2 + 0x2a], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [esp + 0x22c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004010b0
add esp, 0x22c
ret

Function at 0x4010b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424004]
jne 0x4010ba
repz ret
jmp fcn.00401480
Function at 0x100012c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100182f8]
mov dword [ebp - 4], eax
jmp 0x100012d9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100012f6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012d0
mov esp, ebp
pop ebp
ret

Function at 0x10001300
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10018308], eax
je 0x1000131e
mov eax, 0x10dd
jmp 0x100013ff
mov eax, dword [0x10018318]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000139c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000137a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000137a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001470
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.10004d64
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10001326
mov dword [0x10018318], 0
call fcn.10001410
mov ecx, dword [0x10018314]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x100013e9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10004d64
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x100013b4
mov dword [0x10018314], 0
mov dword [0x10018308], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001970
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001985
xor eax, eax
jmp 0x100019fa
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x100019b2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x100019f5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x100019f3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x100019ef
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100019f3
xor eax, eax
jmp 0x100019fa
jmp 0x100019a9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001aa0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1001830c], 0
je 0x10001ab9
mov eax, dword [0x1001830c]
jmp 0x10001b59
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10001acb
xor eax, eax
jmp 0x10001b59
push 8
call fcn.100053da
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001b21
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x10001b0a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10004d64
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x1001830c], eax
mov dword [0x10018310], 0
mov eax, dword [ebp - 4]
jmp 0x10001b59
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001b3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10001aeb
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x10018314]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x10018314], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10002380
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10002450
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000243c
cmp dword [ebp - 4], 0x50000000
jb 0x100023bc
cmp dword [ebp - 4], 0x80000000
ja 0x100023bc
mov dword [ebp - 4], 0x80010000
jmp 0x10002395
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.100043c0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100023e2
jmp 0x1000243c
cmp dword [ebp - 0x10], 0x10000
jne 0x10002425
cmp dword [ebp - 0x14], 0x10000
jb 0x10002425
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10002418
mov eax, dword [ebp - 0x24]
jmp 0x1000243e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10002437
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10002450
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10002395
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10002480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10002550
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10002544
cmp dword [ebp - 4], 0x50000000
jb 0x100024c1
cmp dword [ebp - 4], 0x80000000
ja 0x100024c1
mov dword [ebp - 4], 0x4fff0000
jmp 0x1000249a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.100043c0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100024e7
jmp 0x10002544
cmp dword [ebp - 0x10], 0x10000
jne 0x1000252a
cmp dword [ebp - 0x14], 0x10000
jb 0x1000252a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000251d
mov eax, dword [ebp - 0x24]
jmp 0x10002546
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000253f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10002550
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000249a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002580
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10018308], eax
je 0x100025a5
mov eax, 0x10dd
jmp 0x1000273d
cmp dword [0x1001830c], 0
je 0x100025b8
mov eax, dword [0x1001830c]
jmp 0x1000273d
cmp dword [ebp + 8], 0
jne 0x100025c8
mov eax, 6
jmp 0x1000273d
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x100025f1
mov dword [ebp - 0xc], 6
mov ecx, dword [ebp - 0xc]
mov dword [0x1001830c], ecx
mov edx, dword [ebp + 8]
mov dword [0x10018310], edx
mov eax, dword [ebp - 0xc]
jmp 0x1000273d
push 0x18
call fcn.100053da
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1000264a
mov dword [ebp - 0xc], 8
mov ecx, dword [ebp - 0xc]
mov dword [0x1001830c], ecx
cmp dword [ebp - 0x18], 0
je 0x10002639
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.10004d64
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [0x10018310], ecx
mov eax, dword [ebp - 0xc]
jmp 0x1000273d
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10001000
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10001000
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
je 0x1000268a
cmp dword [ebp - 8], 0x1e
jbe 0x100026a6
mov dword [ebp - 0xc], 9
cmp dword [0x10018300], 0
je 0x100026a1
jmp 0x1000261a
jmp 0x10002611
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x100026cd
mov dword [ebp - 0xc], 9
cmp dword [0x10018300], 0
je 0x100026c8
jmp 0x1000261a
jmp 0x10002611
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x40
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100026fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x10002611
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x10018318]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x10018318], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10002f80
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x10017020]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100043c0
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.100043c0
push 0x104
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.100043c0
push 0x104
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.100043c0
push 0x104
lea eax, [ebp - 0x518]
push 0
push eax
call fcn.100043c0
push 0x104
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.100043c0
add esp, 0x48
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.100040e2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
add esp, 0xc
push str.Config.ini
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x108]
push eax
push 1
push str.USEOVERLAY
push str.CONFIG
call esi
mov dword [0x10017004], eax
lea eax, [ebp - 0x108]
push eax
push 1
push str.VSYNCOFF
push str.CONFIG
call esi
mov dword [section..data], eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.BORDERLESS
push str.CONFIG
call esi
mov dword [0x1001824c], eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.WINMODE
push str.CONFIG
call esi
mov dword [0x10018250], eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.NO_TIMER_CHANGE
push str.CONFIG
call esi
mov dword [0x10018258], eax
lea eax, [ebp - 0x108]
push eax
push 2
push str.FPSTYPE
push str.CONFIG
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x10018254], eax
lea eax, [ebp - 0x310]
push 0x104
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
lea eax, [ebp - 0x310]
push str.clientd.exe
push eax
call fcn.10004140
mov ecx, dword [0x10017004]
xor edx, edx
add esp, 8
test eax, eax
cmovne ecx, edx
mov dword [0x10017004], ecx
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x100182a8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10017004], 1
mov dword [0x10018244], eax
jne 0x1000333f
jmp fcn.100ae555
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100043a3
mov esp, ebp
pop ebp
ret