joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af7f0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0x100
cmp dword [eax - 8], 1
jge 0x4af80a
xor eax, eax
add esp, 0x100
ret 8
mov edx, dword [esp + 0x104]
add ecx, 0xc
push esi
push ecx
lea ecx, [esp + 8]
push 0xff
push ecx
push str.0_0_0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [esp + 0x10c]
lea eax, [esp + 4]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [esi]
xor eax, eax
pop esi
cmp dword [ecx - 8], 1
setge al
add esp, 0x100
ret 8

Function at 0x4af860
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
push ebp
push esi
mov esi, ecx
test ebx, ebx
mov dword [esp + 0xc], esi
jne 0x4af888
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret 0xc
mov ebp, dword [esi + 4]
cmp dword [ebp - 8], 1
jge 0x4af89f
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret 0xc
mov ax, word [0x52b3bc]
mov edx, dword [esp + 0x220]
push edi
mov word [esp + 0x18], ax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
test edx, edx
stosw word es:[edi], ax
je 0x4af8fd
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jbe 0x4af8fd
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea esi, [esp + 0x18]
not ecx
sub edi, ecx
mov eax, esi
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x21c]
add esi, 0xc
push esi
lea ecx, [esp + 0x11c]
push 0xff
lea edx, [esp + 0x20]
push ecx
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 1
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x208
ret 0xc
Function at 0x4af970
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50218b
push eax
mov dword fs:[0], esp
sub esp, 0x110
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax - 8], 1
jl 0x4afa4b
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x124]
add esi, 0xc
lea ecx, [esp + 0x14]
push esi
push 0xff
push ecx
push str.0_0_0
push edx
push eax
mov dword [esp + 0x134], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x14]
lea ecx, [esp + 4]
push eax
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push str._d__d__d
push ecx
call dword [sym.imp.MSVCRT.dll_sscanf]
mov eax, dword [esp + 0x13c]
add esp, 0x14
test eax, eax
je 0x4afa15
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0x12c]
test eax, eax
je 0x4afa26
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov eax, dword [esp + 0x130]
test eax, eax
je 0x4afa37
mov edx, dword [esp + 0x10]
mov dword [eax], edx
lea ecx, [esp + 4]
mov dword [esp + 0x11c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x114]
pop esi
mov dword fs:[0], ecx
add esp, 0x11c
ret 0x10

Function at 0x4b0e90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x24]
mov dword [esi + 0x54], ebx
cmp eax, ebx
mov dword [esi + 0x2c], ebx
jl 0x4b0f2e
push ebp
call sub.KERNEL32.dll_GetTickCount
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ebp
mov ecx, esi
call dword [eax + 0xc]
mov edi, eax
cmp edi, 0xffffff9e
jne 0x4b0efc
cmp dword [esp + 0x1c], 0xffffffff
je 0x4b0ee0
call sub.KERNEL32.dll_GetTickCount
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
sub eax, edx
cmp eax, ecx
jge 0x4b0efc
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x78]
mov ebx, eax
test ebx, ebx
jl 0x4b0efc
mov eax, dword [esi]
push ebp
mov ecx, esi
call dword [eax + 0xc]
mov edi, eax
cmp edi, 0xffffff9e
je 0x4b0ec6
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x10]
pop ebp
sub eax, ecx
test ebx, ebx
mov dword [esi + 0x54], eax
jge 0x4b0f18
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret 8
test edi, edi
jge 0x4b0f25
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 8
mov dword [esi + 0x2c], 1
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x4b0ff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x24]
mov dword [esp + 0x10], ebx
cmp eax, ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x2c], ebx
jl 0x4b10c8
push ebp
call sub.KERNEL32.dll_GetTickCount
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ebx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ebx, eax
test ebx, ebx
je 0x4b1025
movsx ecx, byte [esp + 0x28]
push ecx
push ebx
call fcn.004b0c10
add esp, 8
test eax, eax
jne 0x4b1025
test ebx, ebx
jle 0x4b1068
mov al, byte [esp + 0x28]
test al, al
je 0x4b1055
cmp bl, al
je 0x4b1098
mov eax, dword [esp + 0x1c]
mov byte [edi], bl
inc eax
dec ebp
inc edi
mov dword [esp + 0x1c], eax
test ebp, ebp
je 0x4b109d
jmp 0x4b1025
cmp ebx, 0xffffff9e
jne 0x4b109d
cmp dword [esp + 0x24], 0xffffffff
je 0x4b1087
call sub.KERNEL32.dll_GetTickCount
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
sub eax, edx
cmp eax, ecx
jge 0x4b109d
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x78]
test eax, eax
mov dword [esp + 0x14], eax
jl 0x4b109d
jmp 0x4b1025
mov ebx, 0xfffffffe
mov byte [edi], 0
call sub.KERNEL32.dll_GetTickCount
mov edx, dword [esp + 0x10]
pop ebp
sub eax, edx
mov dword [esi + 0x54], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x4b10c8
xor eax, eax
test ebx, ebx
setge al
dec eax
and eax, ebx
pop edi
pop esi
pop ebx
add esp, 8
ret 0x10
Function at 0x4ceee0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x32
je 0x4cf000
cmp eax, 0x46
jl 0x4ceefb
cmp eax, 0x4c
jle 0x4cf000
test eax, eax
jl 0x4cef08
cmp eax, 3
jle 0x4ceffa
cmp eax, 5
je 0x4ceffa
cmp eax, 0x49
je 0x4ceffa
cmp eax, 0x11
jl 0x4cef2a
cmp eax, 0x13
jg 0x4cef2a
mov eax, 3
ret
cmp eax, 0x16
je 0x4ceff4
cmp eax, 0x17
je 0x4ceff4
cmp eax, 0x5e
je 0x4cefee
cmp eax, 0x5f
je 0x4cefee
cmp eax, 0x46
je 0x4cefe8
cmp eax, 0x47
je 0x4cefe8
cmp eax, 0x28
jl 0x4cef70
cmp eax, 0x2a
jg 0x4cef70
mov eax, 8
ret
cmp eax, 0x48
jne 0x4cef7b
mov eax, 0xc
ret
cmp eax, 0x60
je 0x4cefe2
cmp eax, 0x61
je 0x4cefe2
cmp eax, 0x3d
jl 0x4cef95
cmp eax, 0x40
jg 0x4cef95
mov eax, 0x10
ret
cmp eax, 0x44
je 0x4cefdc
cmp eax, 0x45
je 0x4cefdc
cmp eax, 0xf
je 0x4cefd6
cmp eax, 0x10
je 0x4cefd6
cmp eax, 0x21
jl 0x4cefb3
cmp eax, 0x27
jle 0x4cefbd
cmp eax, 0x42
jl 0x4cefc3
cmp eax, 0x44
jg 0x4cefc3
mov eax, 0xa
ret
cmp eax, 0x5a
je 0x4cefd0
cmp eax, 0x5b
je 0x4cefd0
xor eax, eax
ret
mov eax, 4
ret
mov eax, 0x12
ret
mov eax, 0x11
ret
mov eax, 0xe
ret
mov eax, 7
ret
mov eax, 5
ret
mov eax, 6
ret
mov eax, 2
ret
mov eax, 1
ret

Function at 0x4cf010
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [0x53aa00]
test eax, eax
mov eax, dword [esp + 4]
jne 0x4cf027
push eax
call fcn.004ceee0
add esp, 4
ret
cmp eax, 0x32
je 0x4cf160
cmp eax, 0x46
jl 0x4cf03e
cmp eax, 0x4c
jle 0x4cf160
test eax, eax
jl 0x4cf04b
cmp eax, 3
jle 0x4cf15a
cmp eax, 0x20
je 0x4cf15a
cmp eax, 0x5a
je 0x4cf15a
cmp eax, 0x5c
je 0x4cf15a
cmp eax, 0x5e
je 0x4cf15a
cmp eax, 0x11
jl 0x4cf07f
cmp eax, 0x13
jg 0x4cf07f
mov eax, 3
ret
cmp eax, 0x16
je 0x4cf154
cmp eax, 0x17
je 0x4cf154
cmp eax, 0x62
je 0x4cf14e
cmp eax, 0x63
je 0x4cf14e
cmp eax, 0x14
je 0x4cf148
cmp eax, 0x15
je 0x4cf148
cmp eax, 0x28
jl 0x4cf0c5
cmp eax, 0x2a
jg 0x4cf0c5
mov eax, 8
ret
cmp eax, 0x2b
je 0x4cf142
cmp eax, 0x2c
je 0x4cf142
cmp eax, 0x31
je 0x4cf142
cmp eax, 0x33
je 0x4cf13c
cmp eax, 0x42
je 0x4cf136
cmp eax, 0x43
je 0x4cf136
cmp eax, 0x60
je 0x4cf130
cmp eax, 0x61
je 0x4cf130
cmp eax, 0x36
jl 0x4cf0fd
cmp eax, 0x3b
jg 0x4cf0fd
mov eax, 0xf
ret
cmp eax, 0x3d
jl 0x4cf10d
cmp eax, 0x40
jg 0x4cf10d
mov eax, 0x10
ret
cmp eax, 0x44
je 0x4cf12a
cmp eax, 0x45
je 0x4cf12a
cmp eax, 0xf
je 0x4cf124
cmp eax, 0x10
je 0x4cf124
xor eax, eax
ret
mov eax, 0x12
ret
mov eax, 0x11
ret
mov eax, 0xe
ret
mov eax, 0xd
ret
mov eax, 0xc
ret
mov eax, 9
ret
mov eax, 7
ret
mov eax, 5
ret
mov eax, 6
ret
mov eax, 2
ret
mov eax, 1
ret
Function at 0x4d5190
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
push edi
push 0x78
xor esi, esi
call ebx
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
test ax, ax
je 0x4d5203
mov eax, dword [0x53aa00]
test eax, eax
jne 0x4d51d0
mov eax, dword [0x53aa34]
test eax, eax
jne 0x4d51c4
push eax
push 0x62d
jmp 0x4d51f6
mov eax, dword [eax + 0x20]
push 0
push 0x62d
jmp 0x4d51f6
cmp eax, 2
jne 0x4d51e0
mov eax, dword [0x53aa1c]
test eax, eax
jne 0x4d51ec
jmp 0x4d51ef
cmp eax, 1
mov eax, dword [0x53aa28]
test eax, eax
je 0x4d51ef
mov eax, dword [eax + 0x20]
push 0
push 0x437
push 0x111
push eax
call edi
mov esi, 1
push 0x79
call ebx
test ax, ax
je 0x4d5265
mov eax, dword [0x53aa00]
test eax, eax
jne 0x4d5232
mov eax, dword [0x53aa34]
test eax, eax
jne 0x4d5226
push eax
push 0x62f
jmp 0x4d5258
mov eax, dword [eax + 0x20]
push 0
push 0x62f
jmp 0x4d5258
cmp eax, 2
jne 0x4d5242
mov eax, dword [0x53aa1c]
test eax, eax
jne 0x4d524e
jmp 0x4d5251
cmp eax, 1
mov eax, dword [0x53aa28]
test eax, eax
je 0x4d5251
mov eax, dword [eax + 0x20]
push 0
push 0x43e
push 0x111
push eax
call edi
mov esi, 1
push 0x1b
call ebx
test ax, ax
je 0x4d5322
mov eax, dword [0x53aa00]
test eax, eax
jne 0x4d52a4
mov eax, dword [0x53aa34]
test eax, eax
jne 0x4d52fe
push eax
push 0x43f
push 0x111
push eax
call edi
mov eax, dword [0x53b020]
push 0
push 0
push 0xf
push eax
call edi
pop edi
pop esi
pop ebx
ret
cmp eax, 2
jne 0x4d52d2
mov eax, dword [0x53aa1c]
test eax, eax
jne 0x4d52fe
push eax
push 0x43f
push 0x111
push eax
call edi
mov eax, dword [0x53b020]
push 0
push 0
push 0xf
push eax
call edi
pop edi
pop esi
pop ebx
ret
cmp eax, 1
mov eax, dword [0x53aa28]
test eax, eax
jne 0x4d52fe
push eax
push 0x43f
push 0x111
push eax
call edi
mov eax, dword [0x53b020]
push 0
push 0
push 0xf
push eax
call edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [eax + 0x20]
push 0
push 0x43f
push 0x111
push eax
call edi
mov eax, dword [0x53b020]
push 0
push 0
push 0xf
push eax
call edi
pop edi
pop esi
pop ebx
ret
test esi, esi
je 0x4d5334
mov eax, dword [0x53b020]
push 0
push 0
push 0xf
push eax
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x4d5340
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push 0x12c
push 0x53ab1c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x53ab1c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
js 0x4d5379
mov al, 0x5c
cmp byte [ecx + 0x53ab1c], al
je 0x4d5379
mov byte [ecx + 0x53ab1c], 0
dec ecx
jns 0x4d5367
mov edi, 0x53ab1c
or ecx, 0xffffffff
xor eax, eax
push 0x53a7dc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x53a7dc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
ret
Function at 0x4d6720
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0
push esi
push 0x456e90
push 0
push 0
mov dword [esi + 0xa4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4d674c
pop esi
pop ecx
ret
mov ecx, dword [esp + 4]
push 0xffffffffffffffff
push eax
mov dword [esi + 0x98], ecx
mov dword [esi + 0x90], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x90]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0x60]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x4d7770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x503ca4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf4
push ebx
mov dword [esp + 0x28], ecx
push esi
lea eax, [ebp + 0x24]
push edi
lea ecx, [esp + 0xa0]
push eax
push ecx
lea ecx, [ebp + 0xc]
call fcn.004d5cc0
mov ecx, eax
call fcn.004d5f30
fld qword [0x538f18]
fchs
fcomp st(1)
fnstsw ax
test ah, 1
je 0x4d77ea
fcomp qword [0x538f18]
fnstsw ax
test ah, 1
je 0x4d77ec
xor eax, eax
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c
fstp st(0)
mov eax, dword [esp + 0x30]
mov ecx, 6
lea esi, [ebp + 0xc]
lea edi, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
lea esi, [ebp + 0x24]
lea edi, [esp + 0x3c]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x20]
mov ecx, 6
lea esi, [ebp + 0xc]
mov dword [0x53b060], ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 8]
mov ecx, 6
lea esi, [ebp + 0x24]
push 0x40
rep movsd dword es:[edi], dword [esi]
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
cmp esi, ebx
mov dword [esp + 0x108], ebx
je 0x4d7899
push ebx
push ebx
push 0x46293e59
lea edi, [esi + 0x10]
push 0x39a08cea
push 0x46293e59
push 0x39a08cea
mov ecx, edi
call fcn.004d5c00
push ebx
push ebx
push 0xc6293e59
push 0x39a08cea
push 0xc6293e59
push 0x39a08cea
lea ecx, [edi + 0x18]
call fcn.004d5c00
jecxz 0x4d7885
inc edi
push es
cld
test dword [eax], edx
mov dword [esp + 0x14], ebx
Function at 0x4d98a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc8
lea ecx, [esp + 0x80]
call fcn.004d5be0
lea ecx, [esp + 0x98]
call fcn.004d5be0
lea ecx, [esp + 0x50]
call fcn.004d5be0
lea ecx, [esp + 0x38]
call fcn.004d5be0
lea ecx, [esp + 0xb0]
call fcn.004d5be0
lea ecx, [esp + 0x68]
call fcn.004d5be0
mov eax, dword [0x53b9c8]
mov ecx, dword [eax + 0x78]
fld dword [eax + 0x7c]
mov dword [esp + 4], ecx
fld dword [esp + 4]
fchs
fstp dword [esp]
fadd dword [esp + 4]
fstp dword [esp + 0xc]
fld dword [esp]
fcomp dword [esp + 0xc]
fnstsw ax
test ah, 1
je 0x4d9ac6
fld dword [esp + 4]
fadd qword [0x508290]
mov edx, dword [esp + 0xd0]
push ebx
push ebp
push esi
lea ecx, [edx - 1]
push edi
fstp qword [esp + 0x28]
mov dword [esp + 0x24], ecx
jmp 0x4d993f
mov ecx, dword [esp + 0x24]
fld dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
fstp qword [esp + 0x60]
fld dword [esp + 0x10]
fadd dword [esp + 0x14]
xor ebp, ebp
mov dword [esp + 0x6c], 0xbff00000
cmp ecx, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x50], eax
fstp qword [esp + 0x48]
mov dword [esp + 0x54], edx
jle 0x4d9aa5
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x20], ecx
mov ecx, 6
mov esi, eax
lea edi, [esp + 0x90]
lea ebx, [eax + 0x18]
rep movsd dword es:[edi], dword [esi]
mov eax, ebp
mov ecx, 6
mov esi, ebx
lea edi, [esp + 0xa8]
sub eax, 0
rep movsd dword es:[edi], dword [esi]
je 0x4d9a18
dec eax
je 0x4d99c9
dec eax
jne 0x4d9a6b
mov dword [esp + 0x18], 1
jmp 0x4d9a6b
lea eax, [esp + 0x78]
push 0
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0xb4]
push edx
lea ecx, [esp + 0xa0]
push eax
push ecx
call fcn.00465110
add esp, 0x18
test eax, eax
je 0x4d9a6b
fld qword [esp + 0x78]
mov dword [esp + 0x44], 0x3f800000
mov ebp, 2
fstp dword [esp + 0x3c]
fld qword [esp + 0x80]
fstp dword [esp + 0x40]
jmp 0x4d9a6b
lea edx, [esp + 0xc0]
push 0
lea eax, [esp + 0x4c]
push edx
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0xb4]
push ecx
lea eax, [esp + 0xa0]
push edx
push eax
call fcn.00465110
add esp, 0x18
test eax, eax
je 0x4d9a6b
fld qword [esp + 0xc0]
mov dword [esp + 0x38], 0x3f800000
mov ebp, 1
fstp dword [esp + 0x30]
fld qword [esp + 0xc8]
fstp dword [esp + 0x34]
mov ecx, dword [esp + 0x20]
mov eax, ebx
dec ecx
mov dword [esp + 0x20], ecx
jne 0x4d9988
cmp dword [esp + 0x18], 1
jne 0x4d9aa5
push 1
call dword [sym.imp.OPENGL32.dll_glBegin]
mov esi, dword [sym.imp.OPENGL32.dll_glVertex3fv]
lea ecx, [esp + 0x30]
push ecx
call esi
lea edx, [esp + 0x3c]
push edx
call esi
call dword [sym.imp.OPENGL32.dll_glEnd]
fld dword [esp + 0x10]
fadd qword [0x508af8]
fst dword [esp + 0x10]
fcomp dword [esp + 0x1c]
fnstsw ax
test ah, 1
jne 0x4d993b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc8
ret
Function at 0x4db5e0
Capabilities:
Terminate process

Disassembly:
mov ax, word [esp + 4]
push esi
mov esi, ecx
mov word [esi + 2], ax
mov word [esi + 4], 1
movsx eax, ax
mov word [esi], 1
lea ecx, [eax + eax + 2]
push ecx
call sub.MFC42.DLL_operatornew
movsx edx, word [esi + 2]
mov dword [esi + 0xc], eax
lea eax, [edx*4 + 4]
push eax
call sub.MFC42.DLL_operatornew
mov ecx, dword [esi + 0xc]
add esp, 8
test ecx, ecx
mov dword [esi + 0x10], eax
je 0x4db62f
test eax, eax
je 0x4db62f
mov eax, esi
pop esi
ret 4
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push str.Not_enough_space_for_parser_stacks
add ecx, 0x40
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop

Function at 0x4db680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
mov eax, dword [0x53b010]
push str.yyYACCTBL
push str.UD_RES_yyYACC
mov dword [esp + 8], ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [0x53b010]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4db6b9
mov ax, 1
add esp, 0x10
ret 4
mov edx, dword [0x53b9e4]
mov ecx, dword [0x53b9ec]
push ebx
mov ebx, dword [0x53b9d8]
push ebp
mov ebp, dword [0x53b9dc]
push esi
mov esi, dword [0x53b9e0]
mov dword [esp + 0x10], edx
mov edx, dword [0x53b9f0]
push edi
mov edi, dword [0x53b9e8]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x53b9e0], eax
add eax, 4
mov dword [0x53b9e8], eax
add eax, 8
mov dword [0x53b9d8], eax
add eax, 0x13e
mov dword [0x53b9dc], eax
add eax, 0x24
mov dword [0x53b9e4], eax
add eax, 0x2e
mov ecx, dword [esp + 0x10]
mov dword [0x53b9ec], eax
add eax, 0x7c
mov dword [0x53b9f0], eax
mov eax, dword [esp + 0x24]
push eax
call fcn.004db780
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [0x53b9e8], edi
mov dword [0x53b9e0], esi
mov dword [0x53b9e4], ecx
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [0x53b9dc], ebp
pop esi
mov dword [0x53b9d8], ebx
pop ebp
mov dword [0x53b9ec], edx
mov dword [0x53b9f0], ecx
pop ebx
add esp, 0x10
ret 4
Function at 0x4de830
Capabilities:
Suspend thread

Disassembly:
push esi
mov ecx, 0x537698
call fcn.004ccd20
test eax, eax
jne 0x4de85b
mov ecx, 0x537698
call fcn.004ccd70
test eax, eax
jne 0x4de85b
mov ecx, 0x537698
call fcn.004ccd40
test eax, eax
je 0x4de8d4
mov ecx, dword [0x53ab18]
mov dword [0x5377ac], 1
mov eax, dword [ecx]
call dword [eax + 0x104]
mov eax, dword [0x538e7c]
mov dword [0x536258], 0
sub eax, 0
je 0x4de8c1
sub eax, 2
jne 0x4de8d4
mov eax, dword [0x538e54]
mov esi, dword [sym.imp.KERNEL32.dll_SuspendThread]
test eax, eax
je 0x4de8a1
mov ecx, dword [eax + 0x2c]
push ecx
call esi
mov eax, dword [0x538e5c]
test eax, eax
je 0x4de8d4
mov edx, dword [0x53ab18]
cmp dword [edx + 0x170], 2
jne 0x4de8d4
mov eax, dword [eax + 0x2c]
push eax
call esi
pop esi
ret
mov eax, dword [0x538e5c]
test eax, eax
je 0x4de8d4
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop esi
ret
Function at 0x4eb07b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4eb0d3
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x5323f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4eb0c6
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4eb0d5
xor eax, eax
pop esi
leave
ret 4

Function at 0x4eb128
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x53bd24], eax
mov ecx, dword [ebp + 8]
push ecx
push str._02x
lea edx, [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
push 0x53bd2c
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5316e8
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004eb0e0
add esp, 8
push eax
push 0x53be2c
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 4]
push eax
push 0x5316f0
push str.windir
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
push eax
call fcn.004eb0e0
add esp, 8
push eax
push str._s_s._s
push 0x53bf2c
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
fld dword [ebp + 0xc]
fmul dword [0x50f46c]
call sub.MSVCRT.dll__ftol
mov dword [0x53bd28], eax
mov esp, ebp
pop ebp
ret

Function at 0x4ebb72
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x4ebb8c
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jne 0x4ebba1
push str.License_directory_is_not_defined._Check_configuration._n
call fcn.004ec743
add esp, 4
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004eb128
add esp, 0x10
push 0x53c030
call fcn.004eb3d0
add esp, 4
and eax, 0xff
test eax, eax
jne 0x4ebbdb
call fcn.004ebb2a
xor al, al
jmp 0x4ebd88
mov edx, dword [ebp + 8]
push edx
call fcn.004ecf28
add esp, 4
mov word [0x53c5b4], ax
movsx eax, byte [0x531ad0]
cmp eax, 0x36
jne 0x4ebc0b
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ed000
add esp, 4
mov word [0x53c5b6], ax
call fcn.004eeb29
and eax, 0xff
test eax, eax
je 0x4ebc19
mov al, 1
jmp 0x4ebd88
mov esp, ebp
pop ebp
ret