joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ad70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x43ad95
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x43adad
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x43addc
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x43ae1e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x43aef2
sub edx, 0x10000
js 0x43aef2
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x43ae04
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x43ae04
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x43ae75
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x43ae72
add edx, 8
jne 0x43ae59
jmp 0x43aee3
add edx, 4
test eax, 0xffff
jne 0x43ae82
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x43aee3
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x43aeb6
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x43ae04
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x43aef2
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x43ae04
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x43af03
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401dc0
Capabilities:
Write file on windows

Disassembly:
push ebx
test byte [esp + 0xc], 1
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
je 0x401e00
mov ebx, dword [esp + 0x14]
test ecx, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
jne 0x401df0
pop ebx
jmp fcn.00412180
pop ebx
jmp fcn.00412620
mov dword [esp + 0xc], 0x4c0728
pop ebx
jmp fcn.004ad76c

Function at 0x403220
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov dword [esp], edx
call sub.msvcrt.dll_fread
cmp ebx, eax
jne 0x403249
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], str._s:_read_of__lu_returned__lu
mov esi, eax
call fcn.004a5954
mov edx, dword [esp + 0x20]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00413de0
nop
Function at 0x410da0
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [0x4be004]
cmp ebx, 0xffffffff
je 0x410dd0
mov dword [0x4be004], 0xffffffff
mov eax, ebx
call fcn.00410cf0
add esp, 0x24
mov eax, ebx
pop ebx
pop esi
ret
lea esi, [esp + 0x1f]
mov eax, dword [0x50e5dc]
test eax, eax
je 0x410dba
test byte [eax + 0xc], 0x10
jne 0x410dba
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
cmp eax, 1
jne 0x410dba
movzx ebx, byte [esp + 0x1f]
test ebx, ebx
je 0x410dd4
cmp ebx, 0xd
je 0x410dd4
jmp 0x410dba

Function at 0x412180
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
test ebx, ebx
jne 0x4121cd
jmp 0x4121e2
movzx eax, word [edi]
sub ebx, 1
add edi, 2
test ax, 0xff80
je 0x4121f0
test ax, 0xff00
mov dword [esp + 8], eax
je 0x412222
mov dword [esp + 4], str.x_04x
mov dword [esp], esi
call fcn.004ad76c
test ebx, ebx
je 0x4121e2
test ebx, ebx
jg 0x4121a0
movzx eax, word [edi]
test ax, ax
jne 0x4121a6
mov edx, ebx
shr edx, 0x1f
test dl, dl
je 0x4121a6
add esp, 0x10
pop ebx
pop esi
pop edi
ret
cmp ax, 0x5c
je 0x412260
cmp ax, 0x22
je 0x412285
movzx ecx, ax
test byte [ecx + ecx + 0x4eb0a0], 0x10
je 0x412234
sub dword [esi + 4], 1
js 0x412331
mov edx, dword [esi]
lea ecx, [edx + 1]
mov dword [esi], ecx
mov byte [edx], al
jmp 0x4121c9
mov dword [esp + 4], 0x4c50fb
mov dword [esp], esi
call fcn.004ad76c
jmp 0x4121c9
sub eax, 7
cmp ax, 6
ja case.default.0x412258
movzx eax, ax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 1
jmp dword [eax*4 + 0x4c5108]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4c50e0
call sub.msvcrt.dll_fwrite
jmp 0x4121c9
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4c50e3
call sub.msvcrt.dll_fwrite
jmp 0x4121c9
mov dword [esp], 0x4c50ec
call sub.msvcrt.dll_fwrite
jmp 0x4121c9
mov dword [esp], 0x4c50f2
call sub.msvcrt.dll_fwrite
jmp 0x4121c9
mov dword [esp], 0x4c50e6
call sub.msvcrt.dll_fwrite
jmp 0x4121c9
mov dword [esp], 0x4c50e9
call sub.msvcrt.dll_fwrite
jmp 0x4121c9
mov dword [esp], 0x4c50f5
call sub.msvcrt.dll_fwrite
jmp 0x4121c9
mov dword [esp], 0x4c50ef
call sub.msvcrt.dll_fwrite
jmp 0x4121c9
mov dword [esp], 0x4c50f8
call sub.msvcrt.dll_fwrite
jmp 0x4121c9
mov dword [esp + 4], esi
mov dword [esp], ecx
call fcn.004bc6d0
jmp 0x4121c9
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x4c50fb
mov dword [esp], esi
call fcn.004ad76c
jmp 0x4121c9
Function at 0x412360
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
test ebx, ebx
jne 0x4123b4
jmp 0x4123e0
cmp al, 0x5c
je 0x412440
cmp al, 0x22
je 0x412465
movsx ecx, al
test byte [ecx + ecx + 0x4eb0a0], 0x10
je 0x412410
sub dword [esi + 4], 1
js 0x412511
mov edx, dword [esi]
lea ecx, [edx + 1]
mov dword [esi], ecx
mov byte [edx], al
test ebx, ebx
je 0x4123e0
test ebx, ebx
jle 0x4123f0
movzx eax, byte [edi]
sub ebx, 1
add edi, 1
test al, al
jns 0x412380
movzx eax, al
mov dword [esp + 4], 0x4c50fb
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.004ad76c
test ebx, ebx
jne 0x4123b4
add esp, 0x10
pop ebx
pop esi
pop edi
ret
movzx eax, byte [edi]
test al, al
jne 0x4123be
mov edx, ebx
shr edx, 0x1f
test dl, dl
je 0x4123be
add esp, 0x10
pop ebx
pop esi
pop edi
ret
sub eax, 7
cmp al, 6
ja case.default.0x412432
movzx eax, al
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 1
jmp dword [eax*4 + 0x4c5124]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4c50e0
call sub.msvcrt.dll_fwrite
jmp 0x4123b0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4c50e3
call sub.msvcrt.dll_fwrite
jmp 0x4123b0
mov dword [esp], 0x4c50ec
call sub.msvcrt.dll_fwrite
jmp 0x4123b0
mov dword [esp], 0x4c50f8
call sub.msvcrt.dll_fwrite
jmp 0x4123b0
mov dword [esp], 0x4c50ef
call sub.msvcrt.dll_fwrite
jmp 0x4123b0
mov dword [esp], 0x4c50f5
call sub.msvcrt.dll_fwrite
jmp 0x4123b0
mov dword [esp], 0x4c50e9
call sub.msvcrt.dll_fwrite
jmp 0x4123b0
mov dword [esp], 0x4c50e6
call sub.msvcrt.dll_fwrite
jmp 0x4123b0
mov dword [esp], 0x4c50f2
call sub.msvcrt.dll_fwrite
jmp 0x4123b0
mov dword [esp + 4], esi
mov dword [esp], ecx
call fcn.004bc6d0
jmp 0x4123b0
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x4c50fb
mov dword [esp], esi
call fcn.004ad76c
jmp 0x4123b0
Function at 0x417360
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
lea ebp, [edi + 1]
movzx edx, byte [edi]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
xor eax, eax
test edx, edx
je 0x4173ab
nop
mov ecx, edx
add ebp, 1
shl ecx, 0x11
add edx, ecx
add eax, edx
mov edx, eax
shr edx, 2
xor eax, edx
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x417390
sub ebp, edi
xor edx, edx
sub ebp, 1
mov ecx, ebp
add eax, ebp
shl ecx, 0x11
add ecx, eax
mov eax, ecx
mov ebx, ecx
mov ecx, dword [esp + 0x14]
shr eax, 2
xor ebx, eax
mov eax, ebx
div dword [ecx + 0xc]
mov eax, dword [ecx]
mov esi, dword [eax + edx*4]
test esi, esi
jne 0x4173e6
jmp 0x417410
mov esi, dword [esi]
test esi, esi
je 0x417410
cmp dword [esi + 8], ebx
jne 0x4173e0
mov dword [esp + 4], edi
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4173e0
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x18]
test edx, edx
je 0x4174a9
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x417466
mov eax, dword [esp + 0x14]
mov esi, ebp
add esi, 1
mov eax, dword [eax + 8]
jne 0x417482
mov edx, dword [eax + 4]
mov ebp, 8
cmp edx, ebp
mov dword [esp + 0x18], edx
jae 0x417495
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.004a22e0
mov ebp, eax
test ebp, ebp
je 0x4174b0
mov dword [esp + 4], edi
mov dword [esp + 8], esi
mov edi, ebp
mov dword [esp], ebp
call fcn.004bc590
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00417180
add ebp, 8
and ebp, 0xfffffff8
je 0x417442
mov edx, dword [eax + 4]
cmp edx, ebp
mov dword [esp + 0x18], edx
jb 0x417442
mov ecx, dword [eax]
lea edx, [ecx + ebp]
mov dword [eax], edx
mov edx, dword [esp + 0x18]
sub edx, ebp
mov ebp, ecx
mov dword [eax + 4], edx
jmp 0x417450
xor esi, esi
jmp 0x4173fe
mov dword [esp], 6
xor esi, esi
call fcn.00415490
jmp 0x4173fe

Function at 0x41d4e0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
test eax, eax
je 0x41d520
mov edi, str.default
mov ecx, 8
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41d530
test ebx, ebx
je 0x41d560
and byte [ebx + 0x2b], 0xfb
call fcn.0041d3e0
test eax, eax
je 0x41d569
mov dword [ebx + 4], eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], str.GNUTARGET
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x41d4f2
mov eax, dword [0x4be2e4]
test eax, eax
je 0x41d550
test ebx, ebx
je 0x41d516
mov dword [ebx + 4], eax
or byte [ebx + 0x2b], 4
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x4be2ec]
mov eax, dword [eax]
jmp 0x41d539
call fcn.0041d3e0
test eax, eax
jne 0x41d516
xor eax, eax
jmp 0x41d516
Function at 0x4a2100
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x50d700]
test eax, eax
je 0x4a2110
ret
push ebx
sub esp, 0x18
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
test eax, eax
mov ebx, eax
jne 0x4a2140
mov eax, dword [0x50d700]
test eax, eax
je 0x4a2177
add esp, 0x18
pop ebx
ret
mov dword [esp], eax
call fcn.004a4e90
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [0x50d700], eax
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
test eax, eax
jne 0x4a2131
mov eax, dword [0x50d700]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [0x50d700], 0
mov dword [esp], 0x4ea930
call fcn.004a4fc0
mov dword [0x50d700], eax
jmp 0x4a213a

Function at 0x4a3760
Capabilities:
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
jle 0x4a377d
mov edx, dword [ebx + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [edx + 0xc]
mov eax, dword [ebx + 0x18]
test eax, eax
jle 0x4a3791
mov edx, dword [ebx + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [edx + 0xc]
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x4a37a0
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x4a37af
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x4a3850
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x4a3840
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x3c]
test eax, eax
jle 0x4a381f
xor esi, esi
nop
lea esi, [esi]
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
add esi, 1
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp dword [ebx + 0x3c], esi
jg 0x4a37f0
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x4a382e
mov dword [esp], ebx
call eax
mov dword [esp + 0x30], ebx
add esp, 0x24
pop ebx
pop esi
jmp sub.msvcrt.dll_free
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x4a37c1
and dword [ebx], 0xfffffffe
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
mov edx, 1
mov dword [esp], eax
mov eax, ebx
call fcn.004a2ae0
jmp 0x4a37ba
Function at 0x4aa39c
Capabilities:
Get geographical location
Query environment variable

Disassembly:
movzx eax, word [esp + 4]
mov dword [esp + 4], eax
jmp fcn.004a8d18

Function at 0x4aa3b4
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov dword [esp], str.LC_ALL
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4aa3cc
cmp byte [eax], 0
jne 0x4aa3f6
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4aa3e1
cmp byte [eax], 0
jne 0x4aa3f6
mov dword [esp], str.LANG
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4aa3fc
cmp byte [eax], 0
je 0x4aa3fc
add esp, 0x1c
ret
xor eax, eax
jmp 0x4aa3f6

Function at 0x4aa468
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, eax
mov edi, ecx
dec dword [eax + 4]
js 0x4aa598
mov eax, dword [eax]
lea ecx, [eax + 1]
mov dword [ebx], ecx
mov byte [eax], 0x22
lea esi, [edx + 1]
cmp edx, edi
je 0x4aa518
movsx eax, byte [esi - 1]
cmp al, 0xa
je 0x4aa4cf
cmp al, 0x22
je 0x4aa530
cmp al, 0x5c
je 0x4aa530
mov ecx, dword [ebx + 4]
lea edx, [ecx - 1]
mov dword [ebx + 4], edx
test edx, edx
js 0x4aa554
mov edx, dword [ebx]
lea ecx, [edx + 1]
mov dword [ebx], ecx
mov byte [edx], al
cmp edi, esi
je 0x4aa518
inc esi
movsx eax, byte [esi - 1]
cmp al, 0xa
jne 0x4aa498
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x4ec52c
call sub.msvcrt.dll_fwrite
cmp edi, esi
je 0x4aa527
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x4ec530
call sub.msvcrt.dll_fwrite
inc esi
jmp 0x4aa4c7
dec dword [ebx + 4]
js 0x4aa581
mov eax, dword [ebx]
lea edx, [eax + 1]
mov dword [ebx], edx
mov byte [eax], 0x22
add esp, 0x20
pop ebx
pop esi
pop edi
ret
dec dword [ebx + 4]
js 0x4aa568
mov eax, dword [ebx]
lea edx, [eax + 1]
mov dword [ebx], edx
mov byte [eax], 0x5c
movsx eax, byte [esi - 1]
mov ecx, dword [ebx + 4]
lea edx, [ecx - 1]
mov dword [ebx + 4], edx
test edx, edx
jns 0x4aa4b9
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004bc6d0
jmp 0x4aa4c2
mov dword [esp + 4], ebx
mov dword [esp], 0x5c
call fcn.004bc6d0
movsx eax, byte [esi - 1]
jmp 0x4aa4a8
mov dword [esp + 4], ebx
mov dword [esp], 0x22
call fcn.004bc6d0
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x1c], edx
mov dword [esp + 4], eax
mov dword [esp], 0x22
call fcn.004bc6d0
mov edx, dword [esp + 0x1c]
jmp 0x4aa485
Function at 0x4ad6bc
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], 0x24
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
mov eax, dword [esp + 0x38]
je 0x4ad750
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004aa86c
mov ebx, eax
test eax, eax
je 0x4ad72f
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fwrite
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_free
cmp esi, dword [esp + 0x1c]
je 0x4ad73c
mov eax, 0xffffffff
add esp, 0x24
pop ebx
pop esi
ret
mov eax, esi
test esi, esi
jns 0x4ad734
call sub.msvcrt.dll__errno
mov dword [eax], 7
jmp 0x4ad72f
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.004b4100
add esp, 0x24
pop ebx
pop esi
ret
Function at 0x4b3500
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x50d99c
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x50d994]
sub esp, 4
test ebx, ebx
je 0x4b354b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4b3544
test esi, esi
je 0x4b3544
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4b3520
mov dword [esp], 0x50d99c
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4b5ae0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
lea edi, [esi + eax - 6]
cmp esi, edi
ja 0x4b5b80
movzx eax, byte [edi]
test al, al
je 0x4b5b80
cmp al, 0x58
jne 0x4b5b32
lea ebx, [edi + 1]
mov ebp, dword [0x50dbe4]
test ebp, ebp
je 0x4b5b90
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.ADVAPI32.DLL_CryptGenRandom
sub esp, 0xc
test eax, eax
jne 0x4b5b40
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx - 1]
cmp al, 0xfb
ja 0x4b5b0d
movzx ecx, al
lea edx, [ecx*8]
mov edi, ecx
sub edx, ecx
lea edx, [edi + edx*8]
shr dx, 0xb
lea ecx, [edx*8]
add edx, ecx
shl edx, 2
sub eax, edx
mov edx, eax
lea eax, [edx + 0x30]
cmp al, 0x39
ja 0x4b5bd0
mov byte [ebx - 1], al
mov edi, ebx
movzx eax, byte [edi]
test al, al
jne 0x4b5b06
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x50dbe4
call sub.ADVAPI32.DLL_CryptAcquireContextA
sub esp, 0x14
test eax, eax
je 0x4b5be0
mov ebp, dword [0x50dbe4]
jmp 0x4b5b17
add edx, 0x57
mov edi, ebx
mov byte [ebx - 1], dl
jmp 0x4b5b79
mov dword [0x50dbe4], 0
jmp 0x4b5b17
Function at 0x10001750
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x1c8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, esi
call fcn.10003960
mov ecx, esi
call fcn.10002830
mov ecx, esi
call fcn.10002e10
mov ecx, esi
call fcn.10001fd0
mov ecx, esi
call fcn.10002400
cmp byte [esi + 0x20], 0
jne 0x100017a5
mov ecx, esi
call fcn.100018b0
cmp byte [esi + 0x21], 0
jne 0x100017b2
mov ecx, esi
call fcn.10001c40
lea ebx, [esi + 0x3c]
lea edi, [esi + 0x6c]
cmp edi, ebx
je 0x100017c8
push 0xffffffffffffffff
push 0
push ebx
mov ecx, edi
call fcn.10004790
push 5
push str.Skin_
mov ecx, edi
call fcn.10004660
cmp dword [edi + 0x14], 8
jb 0x100017e0
mov eax, dword [edi]
jmp 0x100017e2
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100017fe
cmp dword [edi + 0x14], 8
jb 0x100017f5
mov edi, dword [edi]
push edi
call fcn.1000c920
add esp, 4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.10098090
add esp, 0xc
cmp dword [ebx + 0x14], 8
jb 0x10001824
mov ebx, dword [ebx]
push str.AllSkin
push ebx
lea eax, [ebp - 0x210]
push str._s_s_
push eax
call fcn.10091da4
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000185e
lea eax, [ebp - 0x210]
push eax
call fcn.1000c920
add esp, 4
mov ecx, esi
call fcn.10002d60
mov ecx, esi
call fcn.10002990
mov ecx, esi
call fcn.10002a60
mov ecx, esi
call fcn.10002b50
mov ecx, esi
call fcn.10002c40
mov ecx, esi
call fcn.10002cd0
mov ecx, esi
call fcn.100042c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.1009174c
mov esp, ebp
pop ebp
ret
Function at 0x10002830
Capabilities:
Check for time delay via queryperformancecounter
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x101bd92c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x38], esi
call fcn.10014110
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
mov dword [esi], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x30
call ebx
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
call fcn.10013e50
push 0
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x30
call ebx
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
push 0
push str.Shell_TrayWnd
call ebx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call edi
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x38]
push 0
mov dword [ecx + 0x10], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call ebx
mov esi, eax
call edi
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x38]
push 0
mov dword [ecx + 0x18], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call ebx
mov esi, eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
push eax
call ebx
lea eax, [ebp - 0x24]
push eax
push esi
call ebx
mov ebx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx]
mov dword [ebx + 4], eax
lea eax, [ebx + 0x170]
push eax
call esi
lea eax, [ebx + 0x188]
push eax
call esi
lea eax, [ebx + 0x178]
push eax
call esi
lea eax, [ebx + 0x1b8]
push eax
call esi
lea eax, [ebx + 0x198]
push eax
call esi
lea eax, [ebx + 0x1a8]
push eax
call esi
mov eax, dword [0x101e2ddc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [ebx + 0x15c], eax
xor ecx, ebp
pop ebx
call fcn.1009174c
mov esp, ebp
pop ebp
ret