joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469190
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0x52ee20
cmp dword [ebp + 0xc], 0
je 0x469249
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x469247
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 3], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov dl, byte [ebp - 3]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
cmp eax, 0x23
jne 0x469224
cmp dword [ebp + 0xc], 2
jb 0x469224
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x469224
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x469224
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
movzx edx, byte [ebp - 2]
xor ecx, edx
mov edx, dword [ebp - 0x10]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 0xc], eax
jmp 0x4691bb
jmp 0x4692be
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 4]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4692be
movzx edx, byte [ebp - 1]
cmp edx, 0x23
jne 0x46929f
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x46929f
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x46929f
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 8
mov eax, dword [ebp - 0xc]
and eax, 0xff
movzx ecx, byte [ebp - 1]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
xor edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
jmp 0x469249
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x4784a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a496
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x801aa8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.0045e780
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.0045e780
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.0045c360
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.0045c360
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.0045c360
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c], 0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x1c]
call fcn.0045b9b0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], edx
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x24]
call fcn.0045b9b0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], edx
mov dword [ebp - 0x14], 0
jmp 0x4785c6
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 1
jge 0x4785dc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [eax + edx*4 + 0x58], 0xffffffff
jmp 0x4785bd
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x48d8d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00468010
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x90]
call fcn.0048e150
movzx ecx, al
test ecx, ecx
je 0x48d906
mov edx, str.Font_atlas_not_built__It_is_generally_built_by_the_renderer_back_end._Missing_call_to_renderer__NewFrame___function__e.g._ImGui_ImplOpenGL3_NewFrame__.
test edx, edx
jne 0x48d91d
push 0x81
push str.D:projectsin_workmacro_sharedimguiimgui_impl_win32.cpp
push str.io.Fonts__IsBuilt_____Font_atlas_not_built__It_is_generally_built_by_the_renderer_back_end._Missing_call_to_renderer__NewFrame___function__e.g._ImGui_ImplOpenGL3_NewFrame__._
call fcn.00507981
add esp, 0xc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [0x802d40]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
cvtsi2ss xmm0, eax
push ecx
movss dword [esp], xmm0
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
cvtsi2ss xmm0, ecx
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x40]
call fcn.0045b9b0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [0x802d48]
mov edx, dword [ebp - 8]
sbb edx, dword [0x802d4c]
call fcn.004fc340
cvtsd2ss xmm0, xmm0
mov edx, dword [0x802d54]
mov ecx, dword [0x802d50]
movss dword [ebp - 0x38], xmm0
call fcn.004fc340
cvtsd2ss xmm0, xmm0
movss xmm1, dword [ebp - 0x38]
divss xmm1, xmm0
mov eax, dword [ebp - 0x20]
movss dword [eax + 0x10], xmm1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [0x802d48], ecx
mov dword [0x802d4c], edx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x48d9df
mov dword [ebp - 0x24], 1
jmp 0x48d9e6
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
mov dl, byte [ebp - 0x24]
mov byte [ecx + 0xf8], dl
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x48da0b
mov dword [ebp - 0x28], 1
jmp 0x48da12
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x20]
mov dl, byte [ebp - 0x28]
mov byte [ecx + 0xf9], dl
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x48da37
mov dword [ebp - 0x2c], 1
jmp 0x48da3e
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x20]
mov dl, byte [ebp - 0x2c]
mov byte [ecx + 0xfa], dl
mov eax, dword [ebp - 0x20]
mov byte [eax + 0xfb], 0
call fcn.0048dbb0
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + 0xa8]
test edx, edx
je 0x48da70
mov dword [ebp - 0x30], 0xffffffff
jmp 0x48da78
call fcn.004680f0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ecx, dword [0x5b1380]
cmp ecx, dword [ebp - 0x34]
je 0x48da97
mov edx, dword [ebp - 0x34]
mov dword [0x5b1380], edx
call fcn.0048dac0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret
Function at 0x4a2810
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004fdef0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x4a2879
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [ebp + eax - 0x108]
push ecx
call fcn.0050192e
add esp, 4
mov edx, 1
imul ecx, edx, 0
mov byte [ebp + ecx - 0x108], al
jmp 0x4a2885
mov edx, dword [0x5857a0]
mov dword [ebp - 0x108], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0x5857a4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4a28b5
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x110], ecx
jmp 0x4a28bf
mov dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret
Function at 0x4a7320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x4a734a
jl 0x4a7341
cmp dword [ebp + 0xc], 0
ja 0x4a734a
xor eax, eax
xor edx, edx
jmp 0x4a748b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x4a736c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004a74a0
jmp 0x4a748b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.004a4d00
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4a73db
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.00459cc0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004a5d60
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0045ae10
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004a5cb0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x4a747c
mov ecx, dword [ebp - 0x10]
call fcn.004a5300
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x4a744b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00508435
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x4a7449
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x4a748b
jmp 0x4a73f7
cmp dword [ebp - 8], 0
jbe 0x4a747c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00508435
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a7b20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x14], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x14], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 4], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 4], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], 0x10325476
mov ecx, dword [ebp + 8]
call fcn.0045b1f0
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
call fcn.0045ab20
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.004a8010
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4aafc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52ad8d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.004a5490
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.004ab0a0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x4aaf10
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.004a71f0
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
call fcn.00510b17
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x4ab04c
lea ecx, [ebp - 0x14]
call fcn.004ac390
jmp 0x4ab05d
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.004fb5a9
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004ab3e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret 4
Function at 0x4acbb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52aeb0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x48
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x58]
push edx
call dword [ebp - 0x28]
add esp, 8
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.0045ab20
mov dword [ebp - 0x30], eax
mov eax, dword [0x5b1398]
mov dword [ebp - 0x34], eax
push 0x802de8
push 0x10
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x58]
call fcn.0045a240
cmp dword [ebp - 0x38], 0
je 0x4acc6c
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], edx
lea eax, [ebp - 0x24]
push eax
call dword [ebp - 0x3c]
add esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x4acc6f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret

Function at 0x4acc90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52aee0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x48
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
lea ecx, [ebp - 0x58]
push ecx
call dword [ebp - 0x28]
add esp, 8
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.0045ab20
mov dword [ebp - 0x30], eax
mov edx, dword [0x5b1398]
mov dword [ebp - 0x34], edx
push 0x802de8
push 0x10
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x58]
call fcn.0045a240
cmp dword [ebp - 0x38], 0
je 0x4acd54
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], ecx
lea edx, [ebp - 0x24]
push edx
call dword [ebp - 0x3c]
add esp, 4
fstp dword [ebp - 0x40]
fld dword [ebp - 0x40]
jmp 0x4acd57
fld dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret
Function at 0x4add90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0x4ad6e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4addc8
push 0xf
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x4adf90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4adfba
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x4adfba
mov dword [ebp - 8], 1
jmp 0x4adfc1
mov dword [ebp - 8], 0
movzx eax, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4ae090
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x3e8
mov eax, dword [0x803398]
or eax, dword [0x80339c]
jne 0x4ae0fb
push 0x803398
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x803390
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x7fff
mov ecx, dword [0x80339c]
push ecx
mov edx, dword [0x803398]
push edx
call fcn.004fc5b0
add eax, dword [0x803390]
adc edx, dword [0x803394]
mov dword [0x803390], eax
mov dword [0x803394], edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [0x803390]
mov edx, dword [ebp - 8]
sbb edx, dword [0x803394]
push 0
push 0x3e8
push edx
push ecx
call fcn.004fc5b0
mov ecx, dword [0x80339c]
push ecx
mov ecx, dword [0x803398]
push ecx
push edx
push eax
call fcn.004fc5f0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret
Function at 0x4ae2d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movsx eax, word [ebp + 8]
test eax, eax
jle 0x4ae3a4
push 0x32
movsx ecx, word [ebp + 8]
push ecx
call fcn.004ad8c0
add esp, 8
movzx edx, al
test edx, edx
je 0x4ae3a4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jne 0x4ae316
mov dword [ebp - 8], 1
jmp 0x4ae31d
mov dword [ebp - 8], 0
mov cl, byte [ebp - 8]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
je 0x4ae385
push 6
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x803388], 0
je 0x4ae383
mov ecx, dword [0x803388]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x803388]
cmp edx, dword [ebp + 0x10]
jne 0x4ae361
mov dword [ebp - 0xc], 1
jmp 0x4ae368
mov dword [ebp - 0xc], 5
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [0x803388]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x803388], 0
jmp 0x4ae3a4
mov edx, dword [ebp - 0x10]
mov dword [0x803388], edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esp, ebp
pop ebp
ret
Function at 0x4b9870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], ecx
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call fcn.004adf90
add esp, 4
movzx eax, al
test eax, eax
je 0x4b98ee
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.004fdef0
add esp, 0xc
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
push str._sRustClient.exe
lea edx, [ebp - 0x108]
push edx
call fcn.0045b2e0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4b98ee
mov al, 1
jmp 0x4b98fd
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ecx]
mov eax, dword [edx]
mov byte [eax], 0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret

Function at 0x4ba2a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x120]
push eax
push 0xf013f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
push 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x118]
push ecx
push 0
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x124], 0
jmp 0x4ba321
mov edx, dword [ebp - 0x124]
add edx, 1
mov dword [ebp - 0x124], edx
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x10c]
jae 0x4ba38b
mov dword [ebp - 0x110], 0x104
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4ba389
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x128], edx
lea eax, [ebp - 0x108]
push eax
call dword [ebp - 0x128]
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x4ba389
jmp 0x4ba38b
jmp 0x4ba312
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret
Function at 0x4ba3d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x801aa8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x20119
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4ba443
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x104
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4ba439
mov al, 1
jmp 0x4ba445
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fbb88
mov esp, ebp
pop ebp
ret