joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc7f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
mov eax, dword [0x703a9c]
cmp eax, 5
ja case.0x4fc81f.1
jmp dword [eax*4 + 0x4fc9f4]
mov eax, dword [str.INTERFACE_800X600]
mov ecx, dword [0x6abc2c]
mov edx, dword [0x6abc30]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abc34]
mov dword [esp + 0x14], ecx
mov cx, word [0x6abc38]
mov word [esp + 0x20], cx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4fc970
mov eax, dword [0x6abc18]
mov edx, dword [str.INTERFACE_1280X1024]
mov ecx, dword [0x6abc1c]
mov dword [esp + 0x14], eax
mov eax, dword [0x6abc24]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abc20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
jmp 0x4fc96c
mov ecx, dword [str.INTERFACE_1360X768]
mov edx, dword [0x6abc04]
mov eax, dword [0x6abc08]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abc0c]
mov dword [esp + 0x14], edx
mov dx, word [0x6abc10]
mov dword [esp + 0x18], eax
mov al, byte [0x6abc12]
mov dword [esp + 0x1c], ecx
mov word [esp + 0x20], dx
mov byte [esp + 0x22], al
jmp 0x4fc970
mov ecx, dword [str.INTERFACE_1920X1200]
mov edx, dword [0x6abbf0]
mov eax, dword [0x6abbf4]
mov dword [esp + 0x10], ecx
mov ecx, dword [0x6abbf8]
mov dword [esp + 0x14], edx
mov edx, dword [0x6abbfc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
jmp 0x4fc970
mov eax, dword [str.INTERFACE_1680X1050]
mov ecx, dword [0x6abbdc]
mov edx, dword [0x6abbe0]
mov dword [esp + 0x10], eax
mov eax, dword [0x6abbe4]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x6abbe8]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x4fc970
mov eax, dword [0x6abbc8]
mov ecx, dword [0x6abbcc]
mov edx, dword [str.INTERFACE_1024X768]
mov dword [esp + 0x14], eax
mov ax, word [0x6abbd4]
mov dword [esp + 0x18], ecx
mov cl, byte [0x6abbd6]
mov dword [esp + 0x10], edx
mov edx, dword [0x6abbd0]
mov word [esp + 0x20], ax
mov byte [esp + 0x22], cl
mov dword [esp + 0x1c], edx
mov esi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.PARTYMINIBAR_POS_X
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4fc9b0
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 4], eax
push 0x7034e0
push 0x104
lea edx, [esp + 0x120]
push edx
push 0x6a75d5
push str.PARTYMINIBAR_POS_Y
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x4fc9ea
lea ecx, [esp + 0x118]
push ecx
call fcn.005b8a6a
add esp, 4
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fed40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69d8fa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, 1
mov dword [esp + 0xc], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6afb64
mov dword [esp + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
lea ecx, [esi + 0x78]
mov byte [esp + 0x18], 5
call fcn.005167e0
lea ecx, [esi + 0x54c]
mov byte [esp + 0x18], 6
call fcn.00421bb0
mov dword [esi + 0x824], edi
mov byte [0x856d4e], bl
cmp dword [esi + 0x824], ebx
mov byte [esi + 0x600], 1
mov byte [esi + 0x601], 0xff
mov byte [esi + 0x602], bl
mov dword [esi + 0x604], ebx
mov dword [esi + 0x718], edi
mov dword [esi + 0x5fc], ebx
mov dword [esi + 0x71c], ebx
je 0x4fee34
mov dword [esi + 0xc], 0x14d
mov dword [esi + 0x10], 0x17c
jmp 0x4fee42
mov dword [esi + 0xc], 0xfb
mov dword [esi + 0x10], 0x152
xor eax, eax
lea edi, [esi + 0x724]
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea edi, [esi + 0x7a4]
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x500ca0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69d9e5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6afb88
mov dword [esp + 0x14], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
push fcn.00516950
push fcn.005167e0
push 3
push 0x4d4
lea eax, [esi + 0x54]
push eax
mov byte [esp + 0x28], 2
call fcn.005b9dbb
lea ecx, [esi + 0xed0]
mov byte [esp + 0x14], 3
call fcn.0051c930
lea ecx, [esi + 0xf40]
mov byte [esp + 0x14], 4
call fcn.0051a260
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x30], bl
mov dword [esi + 0x1e94], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x501c30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69dacc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], ebx
call fcn.005167e0
lea ecx, [esi + 0x508]
mov byte [esp + 0x14], 1
call fcn.005167e0
lea ecx, [esi + 0x9dc]
mov byte [esp + 0x14], 2
call fcn.005167e0
lea ecx, [esi + 0xeb0]
mov byte [esp + 0x14], 3
call fcn.005167e0
lea ecx, [esi + 0x1384]
mov byte [esp + 0x14], 4
call fcn.005167e0
lea ecx, [esi + 0x1858]
mov byte [esp + 0x14], 5
call fcn.005167e0
mov ecx, esi
mov byte [esp + 0x14], 6
call fcn.00501810
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xffffffe0
mov dword [esi + 0x14], ebx
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x1d2c], eax
mov byte [esi + 0x18], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x1a], bl
mov byte [esi + 0x1b], bl
mov byte [esi + 0x1c], bl
mov dword [esi + 0x20], ebx
mov byte [esi + 0x19], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x503c50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69db8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov eax, 1
mov dword [esp + 8], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov dword [esi], 0x6afc40
mov dword [esp + 0x14], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], al
call fcn.00421bb0
lea ecx, [esi + 0xf4]
mov byte [esp + 0x14], 2
call fcn.005167e0
lea ecx, [esi + 0x5c8]
mov byte [esp + 0x14], 3
call fcn.005167e0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xaa0], ebx
mov dword [esi + 0xa9c], ebx
mov dword [esi + 0xaa4], ebx
mov dword [esi + 0xaa8], ebx
mov dword [esi + 0xec], ebx
mov byte [esi + 0xf0], bl
mov byte [esi + 0xf1], bl
mov byte [esi + 0xf2], bl
mov dword [esi + 0xaac], ebx
mov dword [esi + 0xab0], ebx
mov byte [esi + 0xe8], 0xff
mov dword [esi + 0xc], 0xc7
mov dword [esi + 0x10], 0x1e9
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x503fe0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push esi
push edi
push 0x7034e0
mov esi, ecx
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x6a75d5
push str.ALPAH_VALUE
push 0x6afc64
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x504041
lea ecx, [esp + 8]
push ecx
call fcn.005ba67b
fmul qword [0x6acef8]
add esp, 4
fstp dword [esi + 0x50]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x64
lea edx, [esp + 0xc]
push 0x6a8770
push edx
mov dword [esi + 0x50], 0x3f800000
call fcn.005b8b8d
add esp, 0xc
push 0x7034e0
lea eax, [esp + 0xc]
push eax
push str.ALPAH_VALUE
push 0x6afc64
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x509ab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x69df1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], edi
mov dword [esi], 0x6afdbc
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
push fcn.00516950
push fcn.005167e0
push 2
push 0x4d4
lea eax, [esi + 0x58]
push eax
mov byte [esp + 0x28], 3
call fcn.005b9dbb
lea ecx, [esi + 0xa00]
mov byte [esp + 0x14], 4
call fcn.0051c930
lea ecx, [esi + 0xa70]
mov byte [esp + 0x14], 5
call fcn.0051a260
lea ecx, [esi + 0x19cc]
mov byte [esp + 0x14], 6
call fcn.005167e0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x19c4], edi
mov dword [esi + 0x1fa8], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x50c860
Capabilities:
Access peb ldr_data
Get ntdll base address
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x69e546
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x6aff7c
lea ebp, [esi + 0x40]
mov ecx, ebp
mov dword [esp + 0x18], 1
call fcn.005168d0
mov eax, dword [esi + 0x30]
xor ebx, ebx
cmp eax, ebx
je 0x50c8a9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x50c8b9
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x34], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
push edi
mov edi, dword [sym.imp.user32.dll_DestroyWindow]
je 0x50c8ca
push eax
call edi
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x50c8d4
push eax
call edi
mov ecx, ebp
mov dword [esi + 0x514], 0x67452301
mov dword [esi + 0x518], 0xefcdab89
mov dword [esi + 0x51c], 0x98badcfe
mov dword [esi + 0x520], 0x10325476
mov dword [esi + 0x524], 0xc3d2e1f0
mov dword [esi + 0x528], ebx
mov dword [esi + 0x52c], ebx
mov byte [esp + 0x1c], bl
call fcn.00516950
mov eax, dword [esi + 0x30]
cmp eax, ebx
mov dword [esp + 0x1c], 0xffffffff
pop edi
je 0x50c936
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x50c946
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x34], ebx
mov ecx, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x50c878
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x69e546
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], 0x6aff7c
lea ebp, [esi + 0x40]
mov ecx, ebp
mov dword [esp + 0x18], 1
call fcn.005168d0
mov eax, dword [esi + 0x30]
xor ebx, ebx
cmp eax, ebx
je 0x50c8a9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x50c8b9
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x34], ebx
mov eax, dword [esi + 4]
cmp eax, ebx
push edi
mov edi, dword [sym.imp.user32.dll_DestroyWindow]
je 0x50c8ca
push eax
call edi
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x50c8d4
push eax
call edi
mov ecx, ebp
mov dword [esi + 0x514], 0x67452301
mov dword [esi + 0x518], 0xefcdab89
mov dword [esi + 0x51c], 0x98badcfe
mov dword [esi + 0x520], 0x10325476
mov dword [esi + 0x524], 0xc3d2e1f0
mov dword [esi + 0x528], ebx
mov dword [esi + 0x52c], ebx
mov byte [esp + 0x1c], bl
call fcn.00516950
mov eax, dword [esi + 0x30]
cmp eax, ebx
mov dword [esp + 0x1c], 0xffffffff
pop edi
je 0x50c936
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x50c946
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x34], ebx
mov ecx, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x514050
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov edx, dword [esp + 0x118]
push ebp
push esi
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x10]
push ecx
push 0x2001f
push 0
push edx
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x51415a
lea ecx, [esp + 8]
call fcn.00513f60
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
jne 0x51415e
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x34]
push ecx
push esi
mov esi, dword [sym.imp.advapi32.dll_RegEnumKeyExA]
push eax
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
jne 0x514114
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x10]
call fcn.00514050
mov edi, eax
test edi, edi
jne 0x514176
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push edi
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push eax
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
je 0x5140d6
mov eax, dword [esp + 0xc]
test eax, eax
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x51412d
push eax
call edi
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x124]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.advapi32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x51414c
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 8]
test eax, eax
je 0x514169
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
add esp, 0x114
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x514185
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x114
ret 4
Function at 0x5145f0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.kernel32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x514602
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x516590
Capabilities:
Access peb ldr_data
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x69e546
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi], 0x6aff7c
mov dword [esp + 8], esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.005167e0
mov ecx, esi
mov byte [esp + 0x14], 1
call fcn.0050aa30
mov eax, dword [0x6f355c]
cdq
sub eax, edx
sar eax, 1
sub eax, 0x190
mov dword [esi + 0xc], eax
mov eax, dword [0x6f3560]
cdq
sub eax, edx
sar eax, 1
add eax, 0xfffffecd
mov dword [esi + 0x10], eax
cmp dword [0x6f355c], 0x320
jne 0x51661c
cmp dword [0x6f3560], 0x258
jne 0x51661c
add eax, 0x1e
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
add ecx, 0x1a
add eax, 0xa
mov dword [esi + 0x1c], ecx
mov byte [esi + 0x14], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x18], eax
mov edx, dword [0x703c00]
push ebx
push edx
push 0x21ebdf4
mov ecx, 0x21ebe18
call fcn.0050a790
lea eax, [esi + 0x594]
mov dword [esi + 0x5d4], eax
mov dword [esi + 0x514], 0x67452301
mov dword [esi + 0x518], 0xefcdab89
mov dword [esi + 0x51c], 0x98badcfe
mov dword [esi + 0x520], 0x10325476
mov dword [esi + 0x524], 0xc3d2e1f0
mov dword [esi + 0x528], ebx
mov dword [esi + 0x52c], ebx
mov eax, dword [0x21f1c70]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x50]
test eax, eax
jne 0x5166b0
mov ecx, esi
call fcn.00516020
mov edx, dword [0x703bfc]
push edx
call dword [sym.imp.user32.dll_SetFocus]
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x15], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x51f490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x80]
test al, al
je 0x51f50a
fld dword [esi + 0x60]
fcomp dword [0x6a75fc]
fnstsw ax
test ah, 0x41
jnp 0x51f51c
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, dword [esi + 0x74]
mov ecx, dword [esi + 0x7c]
sub eax, edx
cmp eax, ecx
jbe 0x51f4cf
fld dword [esp + 0xc]
fadd st(0), st(0)
fsubr dword [esi + 0x60]
fstp dword [esi + 0x60]
pop esi
ret 8
fld dword [esi + 0x60]
fcomp dword [0x6a8210]
fnstsw ax
test ah, 5
jp 0x51f4ef
fld dword [esp + 0xc]
fmul dword [0x6a8690]
fadd dword [esi + 0x60]
fstp dword [esi + 0x60]
fld dword [esi + 0x60]
fcomp dword [0x6a8210]
fnstsw ax
test ah, 1
jne 0x51f520
mov dword [esi + 0x60], 0x3f800000
pop esi
ret 8
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, dword [esi + 0x74]
mov ecx, dword [esi + 0x7c]
sub eax, edx
cmp eax, ecx
jbe 0x51f520
mov byte [esi + 0x78], 1
pop esi
ret 8
Function at 0x520fa0
Capabilities:
Get common file path

Disassembly:
mov ecx, 0x21ef994
jmp 0x5252f0
sub esp, 0x108
push esi
push 0x105
lea eax, [esp + 8]
push eax
mov esi, ecx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x525391
push edi
lea edi, [esp + 8]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x525317
mov ecx, dword [0x6b0af4]
mov edx, dword [0x6b0af8]
mov ax, word [0x6b0afc]
mov dword [edi], ecx
mov cl, byte [0x6b0afe]
mov dword [edi + 4], edx
lea edx, [esp + 8]
mov word [edi + 8], ax
push edx
mov byte [edi + 0xa], cl
call dword [sym.imp.kernel32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 4], eax
je 0x525390
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.ImmLockIMC
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
push str.ImmUnlockIMC
push eax
call edi
mov ecx, dword [esi + 4]
push str.ImmLockIMCC
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi + 4]
push str.ImmUnlockIMCC
push edx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x14], eax
pop edi
pop esi
add esp, 0x108
ret
Function at 0x521000
Capabilities:
Get file version info

Disassembly:
sub esp, 0x40c
push edi
mov edi, ecx
mov eax, dword [edi + 0x3614]
cmp eax, 0xe0080404
mov dword [edi + 0x362c], 0
mov dword [edi + 0x3628], 0
je 0x52103c
cmp eax, 0xe0090404
je 0x52103c
cmp eax, 0xe00e0804
jne 0x5211ea
push 0x3ff
lea ecx, [esp + 0x14]
push ecx
push eax
call sub.imm32.dll_ImmGetIMEFileNameA
test eax, eax
je 0x5211ea
mov eax, dword [edi + 0x3638]
test eax, eax
push esi
jne 0x5210f9
mov esi, dword [sym.imp.kernel32.dll_CompareStringA]
push 0xffffffffffffffff
push str.TINTLGNT.IME
push 0xffffffffffffffff
lea edx, [esp + 0x20]
push edx
push 1
push 0x409
call esi
cmp eax, 2
je 0x5210f9
push 0xffffffffffffffff
push str.CINTLGNT.IME
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 1
push 0x409
call esi
cmp eax, 2
je 0x5210f9
push 0xffffffffffffffff
push str.MSTCIPHA.IME
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
push ecx
push 1
push 0x409
call esi
cmp eax, 2
je 0x5210f9
push 0xffffffffffffffff
push str.PINTLGNT.IME
push 0xffffffffffffffff
lea edx, [esp + 0x20]
push edx
push 1
push 0x409
call esi
cmp eax, 2
je 0x5210f9
push 0xffffffffffffffff
push str.MSSCIPYA.IME
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 1
push 0x409
call esi
cmp eax, 2
jne 0x5211e9
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x5211e9
push ebx
push esi
call fcn.005ba845
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x10]
push ebx
push esi
push eax
lea ecx, [esp + 0x24]
push ecx
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x5211e8
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x6a7608
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x5211e8
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 8]
xor ecx, ecx
mov ch, al
and eax, 0xffff0000
or ecx, eax
shl ecx, 8
mov eax, ecx
mov ecx, dword [edi + 0x3638]
test ecx, ecx
jne 0x5211d0
mov cx, word [edi + 0x3618]
cmp cx, 0x404
jne 0x5211b4
cmp eax, 0x4020000
je 0x5211d0
cmp eax, 0x4030000
je 0x5211d0
cmp eax, 0x4040000
je 0x5211d0
cmp eax, 0x5000000
je 0x5211d0
cmp eax, 0x5010000
je 0x5211d0
cmp eax, 0x5020000
je 0x5211d0
cmp eax, 0x6000000
je 0x5211d0
cmp cx, 0x804
jne 0x5211e8
cmp eax, 0x4010000
je 0x5211d0
cmp eax, 0x4020000
je 0x5211d0
cmp eax, 0x5030000
jne 0x5211e8
movzx ecx, word [edi + 0x3618]
or ecx, eax
mov dword [edi + 0x3628], ecx
mov edx, dword [edx + 0xc]
mov dword [edi + 0x362c], edx
pop ebx
pop esi
pop edi
add esp, 0x40c
ret