joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402dac
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004045ac
test esi, esi
jne 0x402de3
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.0040469c
jmp 0x402e04
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402c48
mov dword [esp], eax
test esi, esi
je 0x402e04
cmp dword [ebx], 0
je 0x402e04
dec esi
jmp 0x402deb
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4032d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x425008], 0x8088405
inc edx
mov dword [ebx + 0x425008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4032ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x425008], 0x8088405
inc edx
mov dword [ebx + 0x425008], edx
fld qword [ebx + 0x42506c]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x403888
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x425024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403920
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403900
xor eax, eax
push ebp
push 0x4038f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40393c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403900
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x425024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x425024], ax
mov esp, ebp
pop ebp
ret

Function at 0x404384
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x426044], 0
je 0x4043e5
cmp word [0x426218], 0xd7b2
jne 0x4043ad
cmp dword [0x426220], 0
jbe 0x4043ad
mov eax, 0x426214
call dword [0x426230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x42507c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40440c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x425034], 0
jne 0x404401
push 0
push 0x425074
push 0x42507c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404560
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a14
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x426045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404528
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406454
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4064ba
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040481c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403314
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4064a4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064c1
lea eax, [ebp - 0x10]
call fcn.004045ac
ret

Function at 0x40824c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404a48
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x408265
test al, 0x10
jne 0x408269
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40ae7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aeb5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040469c
jmp 0x40aebe
mov eax, ebx
mov edx, esi
call fcn.00404600
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aec8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aee9
mov al, byte [esp]
jmp 0x40aeeb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c604
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c668
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040481c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00407f24
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c66f
lea eax, [ebp - 0xc]
call fcn.004045ac
ret

Function at 0x40d580
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.004045ac
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.00404a48
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x40d5c5
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.0040469c
jmp 0x40d5de
mov edx, ebx
dec edx
mov eax, esi
call fcn.00404b78
push ebx
mov eax, dword [esi]
call fcn.00404a48
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4192cc
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41931d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x419304
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4192f4
jmp 0x41931d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x419305
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d488
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
test dl, dl
je 0x41d496
add esp, 0xfffffff0
call fcn.00403c74
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.004039c4
mov byte [esi + 0x14], 1
lea eax, [esi + 0xc]
mov edx, 0x41d4d8
call fcn.00404600
mov eax, esi
test bl, bl
je 0x41d4c9
call fcn.00403ccc
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x41d938
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
cmp dword [0x4268e0], 0
jne 0x41da71
push 0x41db28
call sub.kernel32.dll_LoadLibraryA
mov dword [esp + 4], eax
push 0x41db34
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4268e0], eax
push 0x41db44
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4268e4], eax
push 0x41db58
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4268e8], eax
push 0x41db6c
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4268ec], eax
push 0x41db80
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4268f0], eax
push 0x41db94
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4268f4], eax
push 0x41dba8
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4268f8], eax
push 0x41dbbc
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4268fc], eax
push 0x41dbd8
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x426900], eax
push 0x41dbf0
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x426904], eax
push 0x41dc04
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x426908], eax
push 0x41dc18
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x42690c], eax
push 0x41dc2c
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x426910], eax
push 0x41dc3c
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x426914], eax
mov eax, dword [ebx + 0x2c]
call fcn.00404848
dec eax
jge 0x41da98
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0xc]
call fcn.00404a48
push eax
call dword [0x4268e0]
mov dword [esp], eax
jmp 0x41daef
push 0
push 0
mov eax, dword [ebx + 0x2c]
call fcn.00404a48
push eax
push 3
mov eax, dword [ebx + 0xc]
call fcn.00404a48
push eax
call dword [0x4268e0]
mov dword [esp], eax
mov eax, dword [ebx + 0x30]
call fcn.00404848
inc eax
push eax
lea eax, [ebx + 0x30]
push eax
push 0x2b
mov eax, dword [esp + 0xc]
push eax
call dword [0x4268ec]
mov eax, dword [ebx + 0x34]
call fcn.00404848
inc eax
push eax
lea eax, [ebx + 0x34]
push eax
push 0x2c
mov eax, dword [esp + 0xc]
push eax
call dword [0x4268ec]
mov dword [esp + 4], 0x927c0
push 4
lea eax, [esp + 8]
push eax
push 5
mov eax, dword [esp + 0xc]
push eax
call dword [0x4268ec]
push 4
lea eax, [esp + 8]
push eax
push 6
mov eax, dword [esp + 0xc]
push eax
call dword [0x4268ec]
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x41dd70
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1034], ebx
mov dword [ebp - 0x102c], ebx
mov dword [ebp - 0x1030], ebx
mov dword [ebp - 0x1024], ebx
mov dword [ebp - 0x1028], ebx
mov dword [ebp - 0x1020], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x41dffe
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x1020]
mov ecx, dword [ebp - 4]
mov edx, 0x41e01c
call fcn.00404894
mov edx, dword [ebp - 0x1020]
mov eax, esi
call fcn.0041d63c
mov eax, esi
call fcn.0041d938
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41dfd8
xor eax, eax
push ebp
push 0x41dfd1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4002500
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4268e4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41de3a
call fcn.00403fec
jmp 0x41dfd8
mov dword [ebp - 0x14], 4
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x20000013
mov eax, dword [ebp - 0x10]
push eax
call dword [0x426914]
test eax, eax
jne 0x41de74
call fcn.00403fec
jmp 0x41dfd8
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1028]
call fcn.00407e98
mov ecx, dword [ebp - 0x1028]
lea eax, [ebp - 0x1024]
mov edx, 0x41e02c
call fcn.00404894
mov edx, dword [ebp - 0x1024]
mov eax, esi
call fcn.0041d63c
cmp dword [ebp - 0x1c], 0xc8
je 0x41dec5
cmp dword [ebp - 0x1c], 0x12e
je 0x41dec5
call fcn.00403fec
jmp 0x41dfd8
xor eax, eax
push ebp
push 0x41dfb2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x101c]
xor ecx, ecx
mov edx, 0x1000
call fcn.004032b0
lea eax, [ebp - 0x1c]
push eax
push 0x1000
lea eax, [ebp - 0x101c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4268f0]
test ebx, ebx
je 0x41df15
lea edx, [ebp - 0x101c]
mov ecx, dword [ebp - 0x1c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
jmp 0x41df56
lea eax, [ebp - 0x102c]
push eax
lea eax, [ebp - 0x1030]
lea edx, [ebp - 0x101c]
mov ecx, 0x1000
call fcn.0040481c
mov eax, dword [ebp - 0x1030]
mov ecx, dword [ebp - 0x1c]
mov edx, 1
call fcn.00404aa8
mov edx, dword [ebp - 0x102c]
mov eax, dword [ebp + 8]
call fcn.00404850
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x1c], 0
jne 0x41ded3
mov byte [ebp - 5], 1
test ebx, ebx
je 0x41df78
mov ecx, ebx
mov edx, 0x41e040
mov eax, esi
call fcn.0041d53c
jmp 0x41df9a
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
lea eax, [ebp - 0x1034]
mov edx, 0x41e040
call fcn.00404894
mov edx, dword [ebp - 0x1034]
mov eax, esi
call fcn.0041d63c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dfb9
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4268f8]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e005
lea eax, [ebp - 0x1034]
mov edx, 6
call fcn.004045d0
lea eax, [ebp - 4]
call fcn.004045ac
ret
Function at 0x421c10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404f64
xor eax, eax
push ebp
push 0x421ccf
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov eax, dword [ebp - 4]
call fcn.00404dd8
cmp eax, 0xff
jl 0x421c55
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x421ce4
call fcn.00404de4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404dc8
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x421cb9
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x421cb3
mov eax, dword [ebp - 8]
call fcn.00421b30
mov dword [esi], eax
cmp dword [esi], 0
je 0x421cb3
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [esi]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x421cb3
mov edi, dword [ebp - 8]
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421cd6
lea eax, [ebp - 4]
call fcn.00404c48
ret

Function at 0x421cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.00404f64
xor eax, eax
push ebp
push 0x421db2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
call fcn.00404dd8
cmp eax, 0xff
jl 0x421d3d
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x421dcc
call fcn.00404de4
push 0
push 0
push 4
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00404dc8
push eax
call sub.kernel32.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x421d9c
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0x10]
push eax
push edi
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x421d89
cmp edi, dword [ebp - 0x10]
sete byte [ebp - 9]
test esi, esi
je 0x421d96
push esi
push esi
push esi
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421db9
lea eax, [ebp - 4]
call fcn.00404c48
ret

Function at 0x421ff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov ecx, edx
dec ecx
test ecx, ecx
jl 0x422011
inc ecx
xor esi, esi
lea eax, [esi + 0x21]
mov edi, 0xeb
cdq
idiv edi
xor byte [ebx], dl
inc ebx
inc esi
dec ecx
jne 0x421fff
pop edi
pop esi
pop ebx
ret
Function at 0x422504
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
add esp, 0xffffff68
mov esi, eax
xor ebx, ebx
lea eax, [esi + 0xa]
call fcn.00422408
test al, al
je 0x42257f
mov dword [esp + 4], 0x94
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x42257f
mov eax, dword [esp + 8]
mov dword [esi + 0x4b], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x4f], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x53], eax
call sub.kernel32.dll_GetACP
mov dword [esi + 0x57], eax
mov dword [esp], 0x11
push esp
lea eax, [esi + 0x25]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x42257f
push 0x15
mov eax, dword [0x4257a4]
add eax, 0x15
push eax
lea eax, [esi + 0x36]
push eax
call sub.kernel32.dll_lstrcpynA_1
mov word [esi], 0x3344
mov bl, 1
mov eax, ebx
add esp, 0x98
pop esi
pop ebx
ret
Function at 0x6d15d7ee
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.J2D_TRACE_LEVEL
call esi
and dword [0x6d206ec8], 0
pop ecx
test eax, eax
je 0x6d15d834
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 4]
push ecx
push 0x6d1c71a4
push eax
call dword [sym.imp.MSVCR100.dll_sscanf]
add esp, 0xc
test eax, eax
jle 0x6d15d834
mov eax, dword [ebp - 4]
cmp eax, 5
ja 0x6d15d834
mov dword [0x6d206ec8], eax
push str.J2D_TRACE_FILE
call esi
mov esi, eax
pop ecx
test esi, esi
je 0x6d15d867
push 0x6d1c7190
push esi
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [0x6d209534], eax
test eax, eax
jne 0x6d15d87e
push esi
push str._E_:_Error_opening_trace_file__s_n
call dword [sym.imp.MSVCR100.dll_printf]
pop ecx
pop ecx
cmp dword [0x6d209534], 0
jne 0x6d15d87e
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
mov dword [0x6d209534], eax
pop esi
leave
ret

Function at 0x6d1606c0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.IMLIB_DEBUG
call esi
add esp, 4
mov ebx, 1
test eax, eax
je 0x6d160702
call sym.awt.dll_awt_setMlibStartTimer
mov dword [0x6d209578], eax
call sym.awt.dll_awt_setMlibStartTimer
cmp dword [0x6d209578], 0
mov dword [0x6d20957c], eax
je 0x6d160702
test eax, eax
je 0x6d160702
mov dword [0x6d209568], ebx
push str.IMLIB_PRINT
call esi
add esp, 4
test eax, eax
je 0x6d160716
mov dword [0x6d20956c], ebx
push str.IMLIB_START
call esi
add esp, 4
test eax, eax
je 0x6d160738
push 0x6d209570
push 0x6d1c71a4
push eax
call dword [sym.imp.MSVCR100.dll_sscanf]
add esp, 0xc
push str.IMLIB_NOMLIB
call esi
add esp, 4
test eax, eax
je 0x6d160753
pop esi
mov dword [0x6d209574], ebx
xor al, al
pop ebx
ret 8
mov eax, dword [esp + 0xc]
push 0x6d20955c
push 0x6d206ecc
push eax
call fcn.6d180d61
add esp, 0xc
test eax, eax
jne 0x6d160746
pop esi
mov al, bl
pop ebx
ret 8
Function at 0x6d163110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, ecx
xor ecx, ecx
push esi
mov esi, eax
mov eax, dword [esp + 0x18]
push edi
mov dword [esp + 0x10], ecx
cmp ebp, ecx
jge 0x6d16312f
xor ebp, ebp
jmp 0x6d16313c
cmp ebp, 0xff
jle 0x6d163140
mov ebp, 0xff
mov dword [esp + 0x18], ebp
cmp ebx, ecx
jge 0x6d163148
xor ebx, ebx
jmp 0x6d163155
cmp ebx, 0xff
jle 0x6d163155
mov ebx, 0xff
cmp eax, ecx
jge 0x6d16315d
xor eax, eax
jmp 0x6d163169
cmp eax, 0xff
jle 0x6d16316d
mov eax, 0xff
mov dword [esp + 0x1c], eax
cmp ebp, ebx
jne 0x6d1631ce
cmp ebx, eax
jne 0x6d1631ce
mov ebx, dword [esp + 0x20]
mov edi, 0x100
cmp ebx, ecx
jle 0x6d163224
add esi, 2
lea esp, [esp]
mov al, byte [esi - 1]
mov dl, byte [esi]
cmp al, dl
jne 0x6d1631b4
cmp dl, byte [esi + 1]
jne 0x6d1631b4
movzx eax, al
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
je 0x6d1631c6
cmp eax, edi
jge 0x6d1631b4
mov dword [esp + 0x10], ecx
mov edi, eax
inc ecx
add esi, 4
cmp ecx, ebx
jl 0x6d163190
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
pop ecx
ret
xor eax, eax
mov edi, 0x1000000
cmp dword [esp + 0x20], ecx
jle 0x6d163224
add esi, 2
mov edi, edi
movzx ecx, byte [esi - 1]
sub ecx, ebp
imul ecx, ecx
cmp ecx, edi
jge 0x6d16321a
movzx edx, byte [esi]
sub edx, ebx
imul edx, edx
add ecx, edx
cmp ecx, edi
jge 0x6d163216
movzx edx, byte [esi + 1]
sub edx, dword [esp + 0x1c]
imul edx, edx
add ecx, edx
cmp ecx, edi
jge 0x6d163216
test ecx, ecx
je 0x6d163228
mov dword [esp + 0x10], eax
mov edi, ecx
mov ebp, dword [esp + 0x18]
inc eax
add esi, 4
cmp eax, dword [esp + 0x20]
jl 0x6d1631e0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6d16a4e7
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
push str.OGLFuncs_InitPlatformFuncs
inc ebx
push ebx
push 3
call fcn.6d180d61
mov eax, dword [0x6d2095e0]
add esp, 0xc
test eax, eax
jne 0x6d16a517
push str.OGLFuncs_InitPlatformFuncs:_library_not_yet_initialized
push ebx
push ebx
call fcn.6d180d61
add esp, 0xc
xor al, al
pop ebx
ret
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push edi
mov edi, str.wglCreateContext
push edi
push eax
call esi
mov dword [0x6d20bd20], eax
test eax, eax
je 0x6d16a5bf
mov edi, str.wglDeleteContext
push edi
push dword [0x6d2095e0]
call esi
mov dword [0x6d20bcc0], eax
test eax, eax
je 0x6d16a5bf
mov edi, str.wglMakeCurrent
push edi
push dword [0x6d2095e0]
call esi
mov dword [0x6d20bdf0], eax
test eax, eax
je 0x6d16a5bf
mov edi, str.wglGetCurrentContext
push edi
push dword [0x6d2095e0]
call esi
mov dword [0x6d20be18], eax
test eax, eax
je 0x6d16a5bf
mov edi, str.wglGetCurrentDC
push edi
push dword [0x6d2095e0]
call esi
mov dword [0x6d20be14], eax
test eax, eax
je 0x6d16a5bf
mov edi, str.wglGetProcAddress
push edi
push dword [0x6d2095e0]
call esi
mov dword [0x6d20be2c], eax
test eax, eax
je 0x6d16a5bf
mov edi, str.wglShareLists
push edi
push dword [0x6d2095e0]
call esi
mov dword [0x6d20bca4], eax
test eax, eax
jne 0x6d16a5ce
push edi
push ebx
push ebx
call fcn.6d180d61
add esp, 0xc
xor al, al
jmp 0x6d16a5d0
mov al, bl
pop edi
pop esi
pop ebx
ret