joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2740
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x594
xor edx, edx
mov al, byte [ecx]
test al, al
je 0x4a2766
cmp al, 0x2c
je 0x4a2766
mov byte [esp + edx + 0x194], al
mov al, byte [ecx + 1]
inc edx
inc ecx
test al, al
jne 0x4a2752
mov al, byte [ecx]
push esi
mov esi, dword [esp + 0x5b0]
cmp al, 0x2c
mov byte [esp + edx + 0x198], 0
jne 0x4a278e
push esi
inc ecx
push 0x5192f0
push ecx
call fcn.004ede83
add esp, 0xc
jmp 0x4a2794
mov dword [esi], 0
lea eax, [esp + 8]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x4a27e9
mov ecx, dword [esp + 0x5ac]
mov edx, dword [esp + 0x5a8]
mov eax, dword [esp + 0x5a4]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [esp + 0x5a0]
mov dword [edx], 0
mov dword [eax], 0
mov dword [ecx], 0
pop esi
add esp, 0x594
ret
lea edx, [esp + 0x198]
push edx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x4a2876
mov eax, dword [esi + 0xc]
mov ecx, dword [0x9f42f8]
cmp dword [eax + ecx*4], 0
jne 0x4a2815
mov dword [0x9f42f8], 0
call sub.WSOCK32.dll_WSACleanup
mov edx, dword [esi + 0xc]
mov eax, dword [0x9f42f8]
mov ecx, dword [edx + eax*4]
mov edx, dword [ecx]
push edx
call sub.WSOCK32.dll_ntohl
mov esi, dword [0x9f42f8]
mov edx, dword [esp + 0x5a0]
mov ecx, eax
inc esi
shr ecx, 0x18
mov dword [0x9f42f8], esi
mov dword [edx], ecx
mov edx, dword [esp + 0x5a4]
mov dword [esp + 4], eax
xor ecx, ecx
mov cl, byte [esp + 6]
mov dword [edx], ecx
mov edx, dword [esp + 0x5a8]
xor ecx, ecx
mov cl, ah
and eax, 0xff
mov dword [edx], ecx
mov ecx, dword [esp + 0x5ac]
mov dword [ecx], eax
pop esi
add esp, 0x594
ret
Function at 0x4a6af0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, 0x400
push edi
push esi
call fcn.004ed8ee
mov dword [0xbf2488], eax
add esp, 4
mov byte [eax], 0
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREOrigin_Worlds_OnlineUltima_Online1.0
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a6b9a
mov ecx, dword [0xbf2488]
lea edx, [esp + 8]
push edx
mov byte [ecx], al
mov eax, dword [0xbf2488]
mov ecx, dword [esp + 0x10]
push eax
push 0
push 0
push str.InstCDPath
push ecx
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a6b9a
cmp dword [esp + 8], esi
jb 0x4a6b6c
push str.FileManager::setCDPath:_temp___MAX_CD_PATH_LENGTH._n
call fcn.004de150
add esp, 4
jmp 0x4a6b9a
mov edi, str.client_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0xbf2488]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0xbf2488]
test eax, eax
je 0x4a6c85
cmp byte [eax], 0
je 0x4a6c85
push eax
push str.FileManager::setCDPath:_set_CDPath_to__s_n
call fcn.004de220
mov esi, dword [0xbf2488]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x200
jb 0x4a6be5
push str.FileManager::addSearchPath:_strlen_new_path____SearchPathInfo::MAX_PATH_LENGTH._UO_startup_code_needs_to_be_re_designed_so_we_can_allocate_memory_here__n
call fcn.004de150
add esp, 4
push ebx
mov ebx, dword [0xbf2480]
mov edx, ebx
mov edi, esi
shl edx, 8
add edx, ebx
or ecx, 0xffffffff
xor eax, eax
push ebp
shl edx, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebp, [edx + 0xbef068]
mov eax, ecx
mov esi, edi
mov edi, ebp
pop ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov byte [edx + 0xbef268], 1
mov dword [0xbf2480], ebx
cmp ebx, 0xa
mov byte [edx + 0xbef269], 0
pop ebx
jl 0x4a6c44
push str.FileManager::addSearchPath:_numSearchPaths___MAX_SEARCH_PATHS._UO_startup_code_needs_to_be_re_designed_so_we_can_allocate_memory_here__n
call fcn.004de150
add esp, 4
push str.FileManager::addSearchPath:_search_paths_are:_n
call fcn.004de220
mov eax, dword [0xbf2480]
add esp, 4
xor esi, esi
test eax, eax
jle 0x4a6c92
mov edi, 0xbef068
push edi
push str.__s_n
call fcn.004de220
mov eax, dword [0xbf2480]
add esp, 8
inc esi
add edi, 0x202
cmp esi, eax
jl 0x4a6c61
pop edi
pop esi
add esp, 8
ret
push str.FileManager::setCDPath:_CDPath_not_set_n
call fcn.004de190
add esp, 4
pop edi
pop esi
add esp, 8
ret
Function at 0x4a6ca0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
push eax
push 1
push 0
push str.SOFTWAREOrigin_Worlds_OnlineUltima_Online1.0
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4a6cd3
push str.Ultima_Online_does_not_appear_to_be_installed_correctly_on_your_system._Please_re_install_UO_by_running_the_setup.exe_program_located_on_your_UO_CD_ROM_n
call fcn.004de150
add esp, 4
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 4]
mov dword [esp + 4], 0
push ecx
push 0
push 0
push 0
push str.ExePath
push edx
call esi
test eax, eax
je 0x4a6d0e
push str.Ultima_Online_does_not_appear_to_be_installed_correctly_on_your_system._Please_re_install_UO_by_running_the_setup.exe_program_located_on_your_UO_CD_ROM._n
call fcn.004de150
add esp, 4
pop esi
add esp, 8
ret
mov eax, dword [esp + 4]
inc eax
push eax
call fcn.004ed8ee
mov edx, dword [esp + 0xc]
add esp, 4
lea ecx, [esp + 4]
mov dword [0xbf2484], eax
push ecx
push eax
push 0
push 0
push str.ExePath
push edx
call esi
test eax, eax
je 0x4a6d4d
push str.Ultima_Online_does_not_appear_to_be_installed_correctly_on_your_system._Please_re_install_UO_by_running_the_setup.exe_program_located_on_your_UO_CD_ROM._n
call fcn.004de150
add esp, 4
pop esi
add esp, 8
ret
mov esi, dword [0xbf2484]
push 0x5c
push esi
call fcn.004f00e0
add esp, 8
test eax, eax
je 0x4a6d7c
push 0x5c
push esi
call fcn.004f00e0
inc eax
push 0x5c
mov esi, eax
push esi
call fcn.004f00e0
add esp, 0x10
test eax, eax
jne 0x4a6d62
mov byte [esi], 0
pop esi
add esp, 8
ret
Function at 0x4ab9d0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push esi
push edi
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x636af0
push 0
push str.SOFTWAREOrigin_Worlds_OnlineUltima_Online1.0HWProfile
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4aba0b
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
lea edx, [esi + 1]
push edx
push 3
push 0
push str.processorType
push eax
call edi
test eax, eax
je 0x4aba37
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
lea ecx, [esi + 2]
push 2
push ecx
push 3
push 0
push str.processorClock
push edx
call edi
test eax, eax
je 0x4aba59
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
lea eax, [esi + 4]
push 1
push eax
push 3
push 0
push str.nProcessors
push ecx
call edi
test eax, eax
je 0x4aba7b
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
lea edx, [esi + 5]
push 0x20
push edx
push 1
push 0
push str.szVideoCardDescrip1
push eax
call edi
test eax, eax
je 0x4aba9d
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
lea ecx, [esi + 0x25]
push 0x20
push ecx
push 1
push 0
push str.szVideoCardDescrip2
push edx
call edi
test eax, eax
je 0x4ababf
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
lea eax, [esi + 0x45]
push 0x20
push eax
push 1
push 0
push str.szModemManufacturer
push ecx
call edi
test eax, eax
je 0x4abae1
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
lea edx, [esi + 0x65]
push 0x20
push edx
push 1
push 0
push str.szModemDescrip
push eax
call edi
test eax, eax
je 0x4abb03
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
lea ecx, [esi + 0x86]
push 2
push ecx
push 3
push 0
push str.totalRAMInMB
push edx
call edi
test eax, eax
je 0x4abb28
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
lea eax, [esi + 0x88]
push 2
push eax
push 3
push 0
push str.largestPartitionInMB
push ecx
call edi
test eax, eax
je 0x4abb4d
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 8]
add esi, 0x8c
push 4
push esi
push 3
push 0
push str.timeZoneBias
push edx
call edi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 8
ret
Function at 0x4b0610
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
mov ebx, ecx
push 0x11
call esi
xor ecx, ecx
push 0x10
test ax, ax
setl cl
mov edi, ecx
call esi
push 0x12
call esi
test ax, ax
mov eax, dword [esp + 0x10]
jge 0x4b064c
cmp eax, 0x73
je case.0x4b0677.42
cmp eax, 9
jne 0x4b064c
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov ecx, dword [0xcecac8]
test ecx, ecx
je 0x4b068d
mov ecx, dword [0x80c348]
test ecx, ecx
jne 0x4b068d
mov ecx, dword [ebx + 8]
test ecx, ecx
jne 0x4b068d
add eax, 0xffffffdf
cmp eax, 0x30
ja case.0x4b0677.42
xor edx, edx
mov dl, byte [eax + 0x4b0804]
jmp dword [edx*4 + 0x4b07dc]
mov eax, dword [esp + 0x14]
push eax
push 0
call fcn.004bec40
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov ecx, dword [esp + 0x14]
push ecx
push 1
call fcn.004bec40
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov edx, dword [esp + 0x14]
push edx
push 2
call fcn.004bec40
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esp + 0x14]
push eax
push 3
call fcn.004bec40
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esp + 0x14]
push ecx
push 4
call fcn.004bec40
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov edx, dword [esp + 0x14]
push edx
push 5
call fcn.004bec40
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esp + 0x14]
push eax
push 6
call fcn.004bec40
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esp + 0x14]
push ecx
push 7
call fcn.004bec40
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
ret 8
test edi, edi
je 0x4b068d
mov al, byte [0xcf7e67]
test al, al
je 0x4b077d
lea edx, [ebx + 0x120]
lea esi, [ebx + 0xc]
push edx
push esi
call fcn.004d9a60
push esi
call fcn.004d9930
add esp, 0xc
mov dword [ebx + 8], eax
jmp 0x4b07b2
lea edi, [ebx + 0x120]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebx + 8], ecx
mov ecx, dword [ebx + 0x228]
mov dword [ebx + 0x114], ecx
mov ecx, ebx
call fcn.004b1720
pop edi
pop esi
mov dword [0xcecadc], 1
mov eax, 1
pop ebx
ret 8
Function at 0x4b5310
Capabilities:
Terminate process

Disassembly:
mov al, byte [0xcecafc]
push ebx
xor ebx, ebx
cmp al, bl
je 0x4b5365
cmp byte [0xcecafe], bl
je 0x4b5341
mov eax, dword [0xcecb00]
cmp eax, ebx
je 0x4b5341
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0xcecb00], ebx
mov byte [0xcecafe], bl
mov eax, dword [0xcecb10]
cmp eax, ebx
je 0x4b5353
push eax
call fcn.004ed4d0
add esp, 4
mov dword [0xcecb10], ebx
mov byte [0xcecb04], bl
mov byte [0xcecafc], bl
pop ebx
ret
Function at 0x4b9410
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4c3040
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40
push ebx
push esi
push edi
push str.Switching_server_
push 3
push 0
call fcn.004d6120
add esp, 0xc
push str.Switching_Server__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, dword [esp + 0x50]
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
mov dword [0xcf38a8], edx
mov eax, dword [ebx]
mov edx, dword [0xcf3ea4]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x2c]
mov dword [0xcf37a0], eax
mov dword [edx + 0x80], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
mov dl, byte [ecx + 0x5c]
mov ecx, dword [0xcf3ea4]
push edx
call fcn.004c9420
mov eax, dword [ebx]
mov ecx, dword [0xcf3ea4]
mov esi, dword [eax + 8]
lea edi, [ecx + 0x22c]
add esi, 0x48
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 0x38]
mov dword [0x518268], ecx
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov cl, byte [eax + 0x36]
mov byte [0xcf38c8], cl
mov edx, dword [ebx]
mov eax, dword [edx + 8]
movsx ecx, word [eax + 0x34]
movsx edx, word [eax + 0x32]
movsx eax, word [eax + 0x30]
push ecx
push edx
push eax
push str.tp___d__d__d_
lea ecx, [esp + 0x1c]
push 0xff
push ecx
call fcn.004ee435
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.004d5a50
mov eax, dword [ebx]
add esp, 0x24
mov ecx, dword [eax + 8]
lea eax, [esp + 0xc]
mov edx, dword [ecx]
push edx
push 0xcf14e0
push str._s___s_
push 0x3f
push eax
call fcn.004ee435
lea ecx, [esp + 0x20]
push ecx
call fcn.004e4aa0
add esp, 0x18
pop edi
pop esi
pop ebx
add esp, 0x40
ret
Function at 0x4ce8e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x5005d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0046b880
xor ebx, ebx
mov ebp, 1
push str.OptScrollBar_framedata
push 8
mov dword [esp + 0x28], ebx
mov dword [esi], 0x50c714
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
call fcn.004b9f50
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x40], edi
push str.OptScrollBar_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x24]
imul eax, dword [esi + 0x20]
lea ecx, [eax + eax + 4]
push ecx
call fcn.004b9f50
mov edx, dword [esi + 0x40]
push 0xf0
mov dword [edx + 4], eax
mov ecx, dword [esi + 0x24]
imul ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x40]
xor eax, eax
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x20]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x40]
mov dx, word [esi + 0x24]
mov ecx, dword [eax + 4]
mov word [ecx + 2], dx
mov dword [esi + 0xa8], ebx
mov byte [esi + 0xb0], bl
call fcn.004ed8ee
add esp, 0x14
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 1
je 0x4cea01
push ebx
push 0xfb
push 0xfa
push fcn.004a1490
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.0043ba10
jmp 0x4cea03
xor eax, eax
mov dword [esi + 0xa0], eax
mov dword [eax + 0xa8], ebx
mov eax, dword [esi + 0xa0]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [eax + 0xc4], ebp
mov ecx, dword [esi + 0xa0]
call fcn.0046af30
push 0xf0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 2
je 0x4cea65
push ebx
push 0xfd
push 0xfc
push fcn.004a1490
push ebx
push 2
push esi
push ebx
push ebx
mov ecx, eax
call fcn.0043ba10
jmp 0x4cea67
xor eax, eax
mov dword [esi + 0xa4], eax
mov dword [eax + 0xa8], ebp
mov ecx, dword [esi + 0xa4]
push ebp
push esi
mov byte [esp + 0x28], bl
mov dword [ecx + 0xc4], ebp
mov ecx, dword [esi + 0xa4]
call fcn.0046af30
push 0xc0
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x20], 3
je 0x4ceabd
push 0xfe
push esi
push ebx
push ebp
push ebx
push ebx
mov ecx, eax
call fcn.0043c280
jmp 0x4ceabf
xor eax, eax
push ebp
push esi
mov ecx, eax
mov byte [esp + 0x28], bl
mov dword [esi + 0xac], eax
call fcn.0046af30
mov edx, dword [esp + 0x28]
push ebp
push edx
mov ecx, esi
call fcn.0046af30
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x4d0930
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push 0xb2c
push 1
call fcn.004f07c5
mov esi, eax
xor ebx, ebx
add esp, 8
cmp esi, ebx
je 0x4d0ada
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [esi], edi
mov dword [edi + 0x90], eax
mov ecx, dword [esi]
mov dword [ecx + 0x18], ebx
mov edx, dword [esi]
mov dword [edx + 0x1c], ebx
mov eax, dword [esi]
mov dword [eax + 0x84], ebx
mov ecx, dword [esp + 0x14]
push esi
push ecx
call fcn.004d0af0
add esp, 8
test eax, eax
jne 0x4d0ad1
push esi
mov dword [edi + 4], esi
call fcn.0049c620
push esi
call fcn.004e01d0
mov edx, dword [esi]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
add esp, 8
add edx, 0x8c
push ebx
push edx
call ebp
cmp edi, ebx
je 0x4d0ada
mov eax, dword [edi + 4]
mov dword [eax + 0x3a4], 1
mov eax, dword [edi]
test eax, 0x10000
je 0x4d0a17
push edi
push ebx
push 0x4d0630
call fcn.004f0902
add esp, 0xc
cmp eax, 0xffffffff
mov dword [edi + 0x9c], eax
je 0x4d0ada
lea esi, [edi + 0x8c]
push 1
push esi
call ebp
cmp eax, 2
je 0x4d0a0b
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
call ebx
push 1
push esi
call ebp
cmp eax, 2
jne 0x4d09fd
push 2
push esi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [edi + 4]
push edi
call fcn.004d0cd0
mov eax, dword [esi + 0x3a4]
add esp, 4
cmp eax, ebx
je 0x4d0ada
mov esi, dword [edi + 4]
mov ecx, dword [esi + 0x3e4]
mov edx, dword [esi + 0x3e0]
sub ecx, edx
mov edx, dword [esi]
mov dword [edx + 0x80], ecx
mov eax, dword [esi]
test dword [eax], 0x80000
jne 0x4d0a66
mov eax, dword [eax + 0x94]
cmp eax, ebx
je 0x4d0a66
push ebx
push eax
call dword [sym.imp.WINMM.dll_mmioClose]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4d0a76
push eax
call fcn.004eda9c
add esp, 4
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x4d0a86
push eax
call fcn.004eda9c
add esp, 4
lea eax, [esi + 0x1bc]
mov ecx, 0x18
mov dword [eax], ebx
add eax, 0x10
dec ecx
jne 0x4d0a91
mov eax, dword [esi]
cmp dword [eax + 0x70], ebx
je 0x4d0ab0
lea eax, [esi + 0x3c]
mov ecx, 0x18
mov dword [eax], ebx
add eax, 0x10
dec ecx
jne 0x4d0aa8
push esi
call fcn.0049c730
push esi
call fcn.004e03c0
mov ecx, dword [esi]
add esp, 8
add ecx, 0x8c
push 6
push ecx
call ebp
mov edx, dword [esi]
mov dword [edx + 4], ebx
push esi
call fcn.004eda9c
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4d57d0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push esi
test ecx, ecx
je 0x4d58a2
xor eax, eax
mov esi, dword [esp + 0x14]
mov ax, word [ecx + 6]
lea edx, [ecx + eax*2 + 8]
add ecx, 8
mov dword [esp + 4], edx
mov edx, dword [0xd413c4]
imul edx, dword [esp + 0x18]
add edx, esi
mov esi, dword [0xd413c8]
test eax, eax
lea edx, [esi + edx*2]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edx
jle 0x4d58a2
push ebx
push ebp
push edi
mov dword [esp + 0x20], eax
xor eax, eax
mov ax, word [ecx]
mov ecx, dword [esp + 0x10]
mov bp, word [ecx + eax*2]
lea esi, [ecx + eax*2]
add esi, 2
mov di, word [esi]
add esi, 2
test di, di
je 0x4d5879
mov eax, dword [esp + 0x1c]
mov edx, ebp
mov ebx, edi
and edx, 0xffff
and ebx, 0xffff
push ebx
lea ecx, [eax + edx*2]
push esi
push ecx
call dword [esp + 0x24]
lea esi, [esi + ebx*2]
xor eax, eax
add esp, 0xc
mov ax, word [esi]
add esi, 2
add eax, edi
mov di, word [esi]
add ebp, eax
add esi, 2
test di, di
jne 0x4d583e
mov edx, dword [esp + 0x1c]
mov eax, dword [0xd413c4]
lea ecx, [edx + eax*2]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x24]
add ecx, 2
dec eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
jne 0x4d5820
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret

Function at 0x4d5920
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d59ce
push esi
lea ecx, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
push str.MHz
push eax
mov dword [esp + 0x28], 4
call edi
mov esi, eax
test esi, esi
je 0x4d59b5
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push str.Mhz
push eax
call edi
mov esi, eax
test esi, esi
je 0x4d59b5
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push 0x5612e4
push eax
call edi
mov esi, eax
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
test esi, esi
pop esi
jne 0x4d59ce
mov eax, dword [esp + 4]
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x4ddf30
Capabilities:
Check mutex on windows

Disassembly:
mov al, byte [0xd82de0]
sub esp, 0x100
test al, al
mov al, byte [0xd82de1]
je 0x4ddfe3
test al, al
je 0x4ddfd4
mov al, byte [0xd82de2]
test al, al
jne 0x4de0c4
mov eax, dword [0xd82ddc]
lea ecx, [esp]
push eax
push str.UOErrata_d.log
push ecx
mov byte [0xd82de2], 1
call fcn.004ee486
add esp, 0xc
lea edx, [esp]
push edx
push str.UOReport::start:_already_started__stopped__look_in_file__s_for_further_information._n
call fcn.004de1c0
lea eax, [esp + 8]
push 0x522088
push eax
call fcn.004ee0e7
add esp, 0x10
mov dword [0xd835e4], eax
test eax, eax
jne 0x4ddfbd
lea ecx, [esp]
push ecx
push str.UOReport:_cannot_open_file__s_for_writing._n
call fcn.004de1c0
add esp, 8
jmp 0x4de0c4
lea edx, [esp]
push edx
push str.UOReport:_created_file__s_for_writing._n
call fcn.004de1f0
add esp, 8
jmp 0x4de0c4
push str.UOReport::start:_already_started__n
call fcn.004de1c0
jmp 0x4de0c1
test al, al
jne 0x4de0b7
mov eax, dword [0xd82ddc]
lea ecx, [esp]
push eax
push str.UOReport_d.log
push ecx
mov byte [0xd82de0], 1
call fcn.004ee486
lea edx, [esp + 0xc]
push 0x522088
push edx
call fcn.004ee0e7
add esp, 0x14
mov dword [0xd835e4], eax
test eax, eax
jne 0x4de033
lea eax, [esp]
push eax
push str.UOReport:_cannot_open_file__s_for_writing._n
call fcn.004de1c0
jmp 0x4de042
lea ecx, [esp]
push ecx
push str.UOReport:_created_file__s_for_writing._n
call fcn.004de1f0
add esp, 8
push str.UOReport:_starting_up..._n
call fcn.004de1f0
add esp, 4
push str.UOReport::startup
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4de06d
inc dword [0xd82ddc]
jmp 0x4de0c4
push str.UOReport::startup
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x4de0a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4de095
inc dword [0xd82ddc]
jmp 0x4de0c4
mov dword [0xd82ddc], 0
jmp 0x4de0c4
push 0
push str.UOReport::startup:
push str.Cannot_CreateMutex.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4de0c4
push str.UOReport::start:__started__stopped___freak_occurance__n
call fcn.004de150
add esp, 4
call fcn.004bb0e0
push str.UOReport:_started._n
call fcn.004de1f0
add esp, 0x104
ret

Function at 0x4de150
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push str.UOReport::fatal:
mov dword [0x5619a0], 0x3f
call fcn.004de250
mov al, byte [0x5619a0]
add esp, 0xc
test al, 1
je 0x4de185
test al, 0x20
je 0x4de18c
push 0
call fcn.004edfc3
push 0
call fcn.004edfc3
ret

Function at 0x4ded00
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x100
push eax
push ecx
push edx
push str._s__d_:__s_n
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
call fcn.004ee435
add esp, 0x18
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x100
ret