joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x616489
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov ebp, dword [esp + 0x2c]
mov ecx, ebp
call fcn.004019e0
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x30]
mov edx, dword [eax]
mov eax, dword [ebp]
mov esi, dword [edx - 0xc]
sub eax, 0x10
mov ecx, 1
mov dword [esp + 0x18], ecx
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [esp + 0x14], esi
lea esi, [esi + esi*2 + 1]
sub eax, esi
or eax, ecx
jge 0x468c06
push esi
mov ecx, ebp
call fcn.00401990
test esi, esi
mov edi, dword [ebp]
jl 0x468ce7
cmp esi, dword [edi - 8]
jg 0x468ce7
mov dword [edi - 0xc], esi
mov eax, dword [ebp]
mov byte [esi + eax], 0
xor esi, esi
xor ebp, ebp
cmp dword [esp + 0x14], esi
jle 0x468cd5
test ebp, ebp
jl 0x468ce7
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
cmp ebp, dword [eax - 0xc]
jg 0x468ce7
mov al, byte [eax + ebp]
cmp al, 0x30
jb 0x468c54
cmp al, 0x39
jbe 0x468cc2
cmp al, 0x61
jb 0x468c5c
cmp al, 0x7a
jbe 0x468cc2
cmp al, 0x41
jb 0x468c64
cmp al, 0x5a
jbe 0x468cc2
cmp al, 0x24
je 0x468cc2
cmp al, 0x2d
je 0x468cc2
cmp al, 0x5f
je 0x468cc2
cmp al, 0x2e
je 0x468cc2
cmp al, 0x2b
je 0x468cc2
cmp al, 0x21
je 0x468cc2
cmp al, 0x2a
je 0x468cc2
cmp al, 0x27
je 0x468cc2
cmp al, 0x2f
je 0x468cc2
cmp al, 0x5b
je 0x468cc2
cmp al, 0x5d
je 0x468cc2
cmp al, 0x28
je 0x468cc2
cmp al, 0x29
je 0x468cc2
cmp al, 0x2c
je 0x468cc2
movzx edx, al
mov eax, edx
shr eax, 4
mov byte [edi + esi], 0x25
push eax
mov ecx, ebx
add esi, 1
call fcn.00462ef0
and edx, 0xf
mov byte [edi + esi], al
push edx
add esi, 1
call fcn.00462ef0
mov byte [edi + esi], al
add ebp, 1
add esi, 1
cmp ebp, dword [esp + 0x14]
jl 0x468c32
mov byte [edi + esi], 0
mov edi, dword [esp + 0x2c]
mov ecx, dword [edi]
test ecx, ecx
jne 0x468cf1
xor eax, eax
jmp 0x468d03
push 0x80070057
call fcn.00401470
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x468cf6
sub eax, esi
js 0x468ce7
cmp eax, dword [ecx - 8]
jg 0x468ce7
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
mov byte [eax + ecx], 0
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x469060
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x616509
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov ebp, dword [esp + 0x2c]
mov ecx, ebp
call fcn.004019e0
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x30]
mov edx, dword [eax]
mov eax, dword [ebp]
mov esi, dword [edx - 0xc]
sub eax, 0x10
mov ecx, 1
mov dword [esp + 0x18], ecx
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [esp + 0x14], esi
lea esi, [esi + esi*2 + 1]
sub eax, esi
or eax, ecx
jge 0x4690d6
push esi
mov ecx, ebp
call fcn.00401990
test esi, esi
mov edi, dword [ebp]
jl 0x4691bb
cmp esi, dword [edi - 8]
jg 0x4691bb
mov dword [edi - 0xc], esi
mov eax, dword [ebp]
mov byte [esi + eax], 0
xor esi, esi
xor ebp, ebp
cmp dword [esp + 0x14], esi
jle 0x4691a9
test ebp, ebp
jl 0x4691bb
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx]
cmp ebp, dword [eax - 0xc]
jg 0x4691bb
mov al, byte [eax + ebp]
cmp al, 0x30
jb 0x469124
cmp al, 0x39
jbe 0x469196
cmp al, 0x61
jb 0x46912c
cmp al, 0x7a
jbe 0x469196
cmp al, 0x41
jb 0x469134
cmp al, 0x5a
jbe 0x469196
cmp al, 0x24
je 0x469196
cmp al, 0x2d
je 0x469196
cmp al, 0x5f
je 0x469196
cmp al, 0x2e
je 0x469196
cmp al, 0x2b
je 0x469196
cmp al, 0x21
je 0x469196
cmp al, 0x2a
je 0x469196
cmp al, 0x27
je 0x469196
cmp al, 0x2f
je 0x469196
cmp al, 0x5b
je 0x469196
cmp al, 0x5d
je 0x469196
cmp al, 0x28
je 0x469196
cmp al, 0x29
je 0x469196
cmp al, 0x3f
je 0x469196
cmp al, 0x2c
je 0x469196
movzx edx, al
mov eax, edx
shr eax, 4
mov byte [edi + esi], 0x25
push eax
mov ecx, ebx
add esi, 1
call fcn.00462ef0
and edx, 0xf
mov byte [edi + esi], al
push edx
add esi, 1
call fcn.00462ef0
mov byte [edi + esi], al
add ebp, 1
add esi, 1
cmp ebp, dword [esp + 0x14]
jl 0x469102
mov byte [edi + esi], 0
mov edi, dword [esp + 0x2c]
mov ecx, dword [edi]
test ecx, ecx
jne 0x4691c5
xor eax, eax
jmp 0x4691dd
push 0x80070057
call fcn.00401470
mov eax, ecx
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4691d0
sub eax, esi
js 0x4691bb
cmp eax, dword [ecx - 8]
jg 0x4691bb
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
mov byte [eax + ecx], 0
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x46d230
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x6174d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x25c]
cmp eax, 3
je 0x46d3a4
xor ebx, ebx
xor edi, edi
cmp eax, 1
jne 0x46d2e7
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x46d280
mov eax, dword [esi + 0xec]
cmp eax, ebx
mov byte [esi + 0x2b0], 1
je 0x46d299
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push eax
call edx
cmp edi, 0x1388
jle 0x46d2a9
cmp dword [esi + 0x274], ebx
jne 0x46d2bb
push 0x32
call ebp
add edi, 0x32
cmp dword [esi + 0x25c], 1
je 0x46d280
jmp 0x46d2e7
mov eax, dword [esi + 0x274]
mov ecx, dword [eax + 0x2c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
push ebx
push ebx
push ebx
push 0x63c37c
call fcn.005c1981
mov dword [esi + 0x274], eax
mov dword [0x71dc14], ebx
lea ecx, [esi + 0x1dc]
mov byte [esi + 0x2b0], bl
call fcn.00401930
cmp dword [esi + 0x274], ebx
mov dword [esi + 0x25c], 3
je 0x46d35b
cmp dword [0x71dc14], ebx
je 0x46d35b
push ebx
lea ecx, [esp + 0x18]
call fcn.004923b0
mov dword [esp + 0x20], ebx
mov eax, dword [esi + 0x274]
mov eax, dword [eax + 0x30]
lea edx, [esp + 0x14]
push edx
push ebx
push 0x8002
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004923d0
jmp 0x46d362
mov ecx, esi
call fcn.0046cd50
mov ecx, dword [0x71dc0c]
cmp ecx, ebx
je 0x46d37a
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x71dc0c], ebx
mov ecx, dword [0x71dc10]
cmp ecx, ebx
je 0x46d392
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [0x71dc10], ebx
mov ecx, esi
call fcn.00462880
call fcn.00497dd0
mov dword [esi + 0x1968], ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4757e0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x210]
test eax, eax
push edi
je 0x47580f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x210], 0
mov edi, dword [esp + 0x10]
test edi, edi
lea ecx, [esi + 0x214]
jne 0x475821
xor eax, eax
jmp 0x475833
mov eax, edi
push ebp
lea ebp, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x475827
sub eax, ebp
pop ebp
push eax
push edi
call fcn.00401bb0
lea ecx, [esp + 8]
push ecx
push 0
push esi
push 0x4757c0
push 0
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
test eax, eax
setne dl
mov dword [esi + 0x210], eax
pop edi
pop esi
mov eax, edx
pop ecx
ret 4
Function at 0x477fc3
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x28
push esi
mov esi, ecx
mov dword [esp + 4], 0x3e8
call fcn.005bc35c
mov eax, dword [eax + 4]
add eax, 0xc8
cmp byte [eax + 0x80f], 0
je 0x478079
mov eax, dword [eax + 0x810]
fldz
push 0x400
fstp qword [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], 0
call fcn.00464720
push 0
call fcn.005da743
fldz
add esp, 4
fstp qword [esp + 0x20]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x2c], 0
call fcn.004632b0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.00463310
fldz
fld qword [esp + 8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jp 0x478067
fld qword [0x63c438]
jmp 0x47806d
fld qword [0x63aeb8]
faddp st(1)
call fcn.005dc8a0
cmp eax, 7
jl 0x4780ac
lea ecx, [esp + 4]
push ecx
push 4
push esi
push 0x474ff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push eax
mov dword [esi + 0x1a2c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x1a2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
add esp, 0x28
ret

Function at 0x4786b0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1950]
call fcn.004069a0
test eax, eax
je 0x4786db
mov ecx, dword [esi + 0x1950]
push 0
call fcn.00406080
mov ecx, dword [esi + 0x1950]
call fcn.00406600
push 0
push 0x63d218
lea ecx, [esi + 0xaf0]
call fcn.0047e590
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x208], eax
mov eax, dword [esi + 0x200]
test eax, eax
mov dword [esi + 0x20c], ecx
je 0x47872b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi + 0x200]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x200], 0
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x478540
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x200], eax
pop esi
pop ecx
ret 8
Function at 0x47cce0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x210
mov eax, dword [0x7161c0]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x21c]
push ebx
mov ebx, dword [esp + 0x224]
push esi
mov esi, dword [esp + 0x21c]
mov ecx, eax
shr ecx, 0x10
push edi
mov edi, dword [esp + 0x224]
movzx edx, cl
push edx
movzx ecx, ah
movzx edx, al
push ecx
push edx
lea eax, [esp + 0x120]
push 0x63d750
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push ebx
push 0x104
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x120]
push edx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [esp + eax + 0x10], 0
lea eax, [esp + 0x10]
push eax
call fcn.005dc226
mov byte [esp + 0x13], al
mov al, byte [esp + 0x14]
add esp, 4
cmp al, 0x20
lea esi, [esp + 0x10]
je 0x47cd85
test al, al
je 0x47cd85
mov al, byte [esi + 1]
add esi, 1
cmp al, 0x20
jne 0x47cd77
add esi, 1
push esi
call fcn.005dc226
mov bl, al
mov al, byte [esi]
add esp, 4
cmp al, 0x20
je 0x47cdae
lea esp, [esp]
test al, al
je 0x47cdae
mov al, byte [esi + 1]
add esi, 1
cmp al, 0x20
jne 0x47cda0
add esi, 1
push esi
call fcn.005dc226
movzx edx, byte [esp + 0x13]
xor ecx, ecx
mov ch, al
add esp, 4
pop edi
pop esi
mov cl, bl
pop ebx
shl ecx, 8
or ecx, edx
mov eax, ecx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.005d8d34
add esp, 0x210
ret

Function at 0x47ce70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x7161c0]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x21c]
push ebx
mov ebx, dword [esp + 0x228]
push ebp
mov ebp, dword [esp + 0x218]
push esi
mov esi, dword [esp + 0x220]
push edi
mov edi, dword [esp + 0x228]
push eax
push ecx
lea edx, [esp + 0x11c]
push 0x63d748
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push ebx
push 0x104
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x120]
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x10]
push edx
mov byte [esp + eax + 0x14], 0
call fcn.005dc226
mov cl, byte [esp + 0x14]
add esp, 4
cmp cl, 0x20
mov dword [ebp], eax
lea eax, [esp + 0x10]
je 0x47cf16
test cl, cl
je 0x47cf16
mov cl, byte [eax + 1]
add eax, 1
cmp cl, 0x20
jne 0x47cf07
push eax
call fcn.005dc226
mov ecx, dword [esp + 0x21c]
add esp, 4
pop edi
mov dword [ebp + 4], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.005d8d34
add esp, 0x20c
ret
Function at 0x47d920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x619648
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
call fcn.005bcf00
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x47d962
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0xc]
call fcn.005bd4b9
test eax, eax
jne 0x47d99e
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 8]
call fcn.005bd533
or eax, 0xffffffff
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0xc
lea eax, [esi + 4]
test eax, eax
je 0x47d9a8
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.005bd805
test eax, eax
je 0x47d977
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov esi, eax
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 8]
call fcn.005bd533
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0xc

Function at 0x47dee3
Capabilities:
Read .ini file

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi - 0x18]
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x10]
lea edx, [edx + esi + 5]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x47def4
push str.skin.ini
xor ecx, ecx
push ecx
xor eax, eax
push eax
mov eax, dword [esi - 0x18]
mov ecx, dword [eax + 4]
push 0x63d7cc
lea edx, [ecx + esi + 5]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0047ce70
mov ecx, dword [esi - 0x18]
mov eax, dword [ecx + 4]
mov edx, dword [esp + 0x1c]
mov dword [eax + esi + 0x70], edx
mov ecx, dword [esp + 0x20]
mov dword [eax + esi + 0x74], ecx
mov edx, dword [esi - 0x18]
mov eax, dword [edx + 4]
push str.skin.ini
lea eax, [eax + esi + 4]
push 0
add eax, 1
push str.Bkgrn
push eax
call fcn.0047cce0
mov ecx, dword [esi - 0x18]
mov dword [esi - 0x14], eax
mov edx, dword [ecx + 4]
push str.skin.ini
lea eax, [edx + esi + 4]
push 0xff00
add eax, 1
push str.TextClr
push eax
call fcn.0047cce0
push str.skin.ini
mov dword [esi - 0x10], eax
mov ecx, 0xa
push ecx
mov eax, 0x32
push eax
mov eax, dword [esi - 0x18]
mov ecx, dword [eax + 4]
push str.Size
lea edx, [ecx + esi + 5]
push edx
lea eax, [esp + 0x50]
push eax
call fcn.0047ce70
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov eax, dword [esi - 0x18]
add esp, 0x50
push str.skin.ini
mov dword [esi - 0xc], ecx
mov dword [esi - 8], edx
mov ecx, dword [eax + 4]
push 0
lea eax, [ecx + esi + 4]
push str.Transparent
add eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esi - 4], eax
pop esi
add esp, 8
ret 4
Function at 0x47f0c0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x6199c9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, ecx
xor esi, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x28]
mov ecx, edi
call fcn.004019e0
mov dword [esp + 0x20], esi
mov eax, dword [edi]
mov ebx, dword [esp + 0x34]
sub eax, 0x10
mov ecx, 1
mov dword [esp + 0x14], ecx
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
lea esi, [ebx + 1]
sub eax, esi
or eax, ecx
jge 0x47f129
push esi
mov ecx, edi
call fcn.00401990
test esi, esi
mov eax, dword [edi]
jl 0x47f19a
cmp esi, dword [eax - 8]
jg 0x47f19a
mov edx, dword [esp + 0x30]
push str.skin.ini
push ebx
push eax
mov dword [eax - 0xc], esi
mov eax, dword [esp + 0x38]
mov ecx, dword [edi]
push edx
push eax
add ebp, 1
push ebp
mov byte [esi + ecx], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [edi]
test ecx, ecx
jne 0x47f162
xor eax, eax
jmp 0x47f174
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x47f167
sub eax, esi
js 0x47f19a
cmp eax, dword [ecx - 8]
jg 0x47f19a
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
mov byte [eax + ecx], 0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
push 0x80070057
call fcn.00401470
int3
Function at 0x47fc90
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x619bc1
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x7161c0]
xor eax, esp
mov dword [esp + 0x110], eax
push ebp
push esi
push edi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0x124]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
call fcn.004019e0
mov dword [esp + 0x12c], 0
xor eax, eax
mov cl, byte [eax + 0x71dc68]
mov byte [esp + eax + 0x1c], cl
add eax, 1
test cl, cl
jne 0x47fce2
mov eax, dword [esp + 0x134]
lea ebp, [esi + 0x1d]
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x47fd01
push str.skin.ini
xor ecx, ecx
push ecx
xor eax, eax
push eax
push 0x63d7cc
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.0047ce70
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push str.skin.ini
mov dword [esi + 0x88], ecx
xor ecx, ecx
push ecx
xor eax, eax
push eax
push 0x63db84
lea eax, [esp + 0x3c]
push ebp
push eax
mov dword [esi + 0x8c], edx
call fcn.0047ce70
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
add esp, 0x30
push 0x104
push str.notfound.bmp
push 0x63d9e8
lea eax, [esp + 0x20]
mov dword [esi + 0x90], ecx
push eax
lea ecx, [esi + 0x1c]
mov dword [esi + 0x94], edx
call fcn.0047f0c0
mov byte [esp + 0x12c], 1
push eax
lea ecx, [esp + 0x14]
call fcn.00403020
mov byte [esp + 0x12c], 0
lea ecx, [esp + 0x14]
call fcn.00401a50
lea edi, [esp + 0x1c]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x47fdb4
mov cx, word [0x630bfc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
mov word [edi], cx
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0042f4c0
add esp, 0xc
mov byte [esp + 0x12c], 2
push eax
lea ecx, [esp + 0x14]
call fcn.00403020
mov byte [esp + 0x12c], 0
lea ecx, [esp + 0x14]
call fcn.00401a50
mov edx, dword [esp + 0x10]
push edx
mov ecx, esi
call fcn.0047cf40
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str.skin.ini
push 1
push str.hdiv
push ebp
call edi
push str.skin.ini
push 3
push str.vdiv
push ebp
mov dword [esi + 0x9c], eax
call edi
push str.skin.ini
push 0
push str.pushed
push ebp
mov dword [esi + 0xa0], eax
call edi
push str.skin.ini
push 3
test eax, eax
push 0x63db88
setne al
push ebp
mov byte [esi + 0x98], al
call edi
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x84], eax
mov dword [esp + 0x12c], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00401a50
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.005d8d34
add esp, 0x120
ret 4
Function at 0x483870
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push DirectSoundCreate
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
cmp eax, 2
je 0x4838b9
call edi
cmp eax, 0x6e
je 0x4838b9
cmp esi, 0xffffffff
je 0x4838b9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x483900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x483971
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x483971
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x48395a
jmp 0x483971
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x484d20
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x100
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xc]
push str.QTMLInitTermMutex_lx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
je 0x484d60
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x71dd88]
test eax, eax
jle 0x484d74
inc eax
mov dword [0x71dd88], eax
jmp 0x484e41
push str.QuickTime.qts
call fcn.00485040
add esp, 4
mov dword [0x71dd8c], eax
test eax, eax
jne 0x484d97
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xfffff7d3
jmp 0x484e09
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._CallComponentFunctionWithStorage
push eax
call esi
test eax, eax
mov dword [0x6e6e54], eax
je 0x484e04
mov edx, dword [0x71dd8c]
push str._CallComponent
push edx
call esi
test eax, eax
mov dword [0x6e6e50], eax
je 0x484e04
mov eax, dword [0x71dd8c]
push str.theQuickTimeDispatcher
push eax
call esi
test eax, eax
mov dword [0x6e6e4c], eax
je 0x484e04
mov ecx, dword [esp + 0x10c]
mov dword [0x6e6e48], 0
push ecx
call fcn.00484c50
mov esi, eax
add esp, 4
test si, si
jne 0x484e09
inc dword [0x71dd88]
jmp 0x484e41
mov esi, 0xfffff7d2
mov eax, dword [0x71dd8c]
test eax, eax
je 0x484e23
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x71dd8c], 0
mov eax, 0x484c70
mov dword [0x6e6e48], 0x484e60
mov dword [0x6e6e50], eax
mov dword [0x6e6e54], eax
mov dword [0x6e6e4c], eax
test edi, edi
je 0x484e53
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, si
pop edi
pop esi
add esp, 0x100
ret

Function at 0x484ed0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x100
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 8]
push str.QTMLInitTermMutex_lx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x484f0f
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x71dd88]
test eax, eax
jg 0x484f24
mov dword [0x71dd88], 0
jmp 0x484f5e
dec eax
test eax, eax
mov dword [0x71dd88], eax
jg 0x484f5e
call fcn.00484c60
mov edx, dword [0x71dd8c]
mov eax, 0x484c70
push edx
mov dword [0x6e6e48], 0x484e60
mov dword [0x6e6e50], eax
mov dword [0x6e6e54], eax
mov dword [0x6e6e4c], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x484f70
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x100
ret