joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
push edi
call fcn.100096f0
push eax
call fcn.10007f30
add esp, 4
xor ecx, ecx
nop dword [eax]
mov eax, ecx
test cl, 1
je 0x1000b3ca
xor eax, 2
shr eax, 1
test al, 1
je 0x1000b3d3
xor eax, 2
shr eax, 1
test al, 1
je 0x1000b3dc
xor eax, 2
shr eax, 1
test al, 1
je 0x1000b3e5
xor eax, 2
shr eax, 1
test al, 1
je 0x1000b3ee
xor eax, 2
shr eax, 1
test al, 1
je 0x1000b3f7
xor eax, 2
shr eax, 1
test al, 1
je 0x1000b400
xor eax, 2
shr eax, 1
test al, 1
je 0x1000b409
xor eax, 2
shr eax, 1
mov dword [ecx*4 + 0x1006c980], eax
inc ecx
cmp ecx, 0x100
jb 0x1000b3c0
mov esi, 0x10c
or ebx, 0xffffffff
cmp edi, esi
jbe 0x1000b458
mov eax, dword [ebp - 4]
movsx eax, byte [esi + eax]
push eax
call fcn.100096f0
push eax
call fcn.10007f30
mov eax, dword [ebp - 4]
add esp, 4
movzx ecx, bl
shr ebx, 8
movzx eax, byte [esi + eax]
inc esi
xor ecx, eax
xor ebx, dword [ecx*4 + 0x1006c980]
cmp esi, edi
jb 0x1000b427
pop edi
not ebx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ccf0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006b57c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10073b6c]
cmp eax, dword [ecx + 4]
jle 0x1000cd48
push 0x10073b6c
call fcn.1002ad4f
add esp, 4
cmp dword [0x10073b6c], 0xffffffff
jne 0x1000cd48
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x10073b6c
mov dword [0x10073b68], eax
call fcn.1002ad10
add esp, 4
mov edx, dword [0x10073b68]
push esi
lea esi, [edx + 0x1000]
cmp edx, esi
je 0x1000cd73
nop dword [eax]
lea ecx, [edx + 0x1c]
call fcn.1000cce0
test eax, eax
je 0x1000cd77
add edx, 0x20
cmp edx, esi
jne 0x1000cd60
xor eax, eax
pop esi
ret
mov eax, edx
pop esi
ret

Function at 0x1000cd80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov edi, ecx
call fcn.1000ccf0
mov ebx, eax
xor esi, esi
mov dword [ebp - 4], ebx
nop word [eax + eax]
lea ecx, [esi + edi]
call fcn.1000caa0
add esi, eax
cmp esi, 5
jl 0x1000cda0
test esi, esi
jle 0x1000cdd1
mov ecx, ebx
mov edx, esi
mov ebx, edi
sub ebx, ecx
nop dword [eax + eax]
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x1000cdc0
mov ebx, dword [ebp - 4]
lea ecx, [esi + ebx]
lea eax, [edi - 5]
mov byte [ecx], 0xe9
sub esi, ecx
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
mov eax, dword [ebp - 0xc]
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d690
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 1]
push eax
call fcn.1002df10
add esp, 0xc
xorps xmm0, xmm0
movq qword [esi + 0x44], xmm0
mov ecx, esi
movups xmmword [esi + 0x4c], xmm0
push dword [ebp + 0xc]
movups xmmword [esi + 0x5c], xmm0
mov byte [esi], 0
push dword [ebp + 8]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
call fcn.10011950
mov ecx, esi
call fcn.10011a00
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1000de10
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051e50
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x10069070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x28], 0x64005c
push 0x2800
push eax
push 0x10070de0
mov dword [ebp - 0x24], 0x650073
mov dword [ebp - 0x20], 0x750074
mov dword [ebp - 0x1c], 0x2e0070
mov dword [ebp - 0x18], 0x6c0064
mov dword [ebp - 0x14], 0x6c
call fcn.1002df10
add esp, 0xc
push 0x10070de0
call fcn.1000e660
test al, al
je 0x1000e088
mov ecx, 0x10070de0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000de91
sub ecx, edx
sar ecx, 1
je 0x1000e088
push 0x100715e0
call fcn.1000e220
test al, al
je 0x1000e088
mov ecx, 0x100715e0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000dec0
sub ecx, edx
sar ecx, 1
je 0x1000e088
push 0x10071de0
call fcn.1000e890
test al, al
je 0x1000e088
mov ecx, 0x10071de0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000def0
sub ecx, edx
sar ecx, 1
je 0x1000e088
push 0x100725e0
call fcn.1000e9e0
test al, al
je 0x1000e088
mov ecx, 0x100725e0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000df20
sub ecx, edx
sar ecx, 1
je 0x1000e088
push 0x10072de0
lea eax, [ebp - 0x28]
push eax
call fcn.1000dc70
test al, al
je 0x1000e088
mov eax, 0x10072de0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000df53
sub eax, edx
sar eax, 1
je 0x1000e088
push 0x10070de0
lea ecx, [ebp - 0x40]
call fcn.1000bcd0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000d780
push eax
mov ecx, 0x100735e0
call fcn.10002f00
lea ecx, [ebp - 0x58]
call fcn.10002e90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.1000bc90
push 0x100715e0
lea ecx, [ebp - 0x40]
call fcn.1000bcd0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000d780
push eax
mov ecx, 0x100735f8
call fcn.10002f00
lea ecx, [ebp - 0x58]
call fcn.10002e90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.1000bc90
push 0x10071de0
lea ecx, [ebp - 0x40]
call fcn.1000bcd0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000d780
push eax
mov ecx, 0x10073610
call fcn.10002f00
lea ecx, [ebp - 0x58]
call fcn.10002e90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.1000bc90
push 0x100725e0
lea ecx, [ebp - 0x70]
call fcn.1000bcd0
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 3
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.1000d780
push eax
mov ecx, 0x10073628
call fcn.10002f00
lea ecx, [ebp - 0x88]
call fcn.10002e90
lea ecx, [ebp - 0x70]
call fcn.1000bc90
push 0
push 0
push 0x1000dd90
call fcn.1003642b
add esp, 0xc
mov al, 1
jmp 0x1000e08a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ac23
mov esp, ebp
pop ebp
ret
Function at 0x100105c0
Capabilities:
Create thread
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
sub dword [ebp + 0xc], 1
jne 0x100106d9
push esi
mov esi, dword [ebp + 8]
mov dword [0x1006cd88], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x10010570
mov dword [ebp - 4], 1
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x10010613
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x10010613
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10010615
xor eax, eax
push esi
mov dword [0x1006cd8c], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
mov esi, eax
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
push 1
push str.D:P_D_OICI_GA___BG__D_OICI_GA___AN_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x1001066c
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
jne 0x10010674
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._GL2UseGameGuard__3HA
push str.core.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100106bb
lea eax, [ebp + 0xc]
push eax
push 4
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100106bb
lea eax, [ebp + 0xc]
mov byte [esi], 0
push eax
push dword [ebp + 0xc]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100106c3
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x100020a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100107f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x10069070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, str.Initializing_extender
mov ecx, 0x1006ada0
call fcn.10007a10
push eax
call fcn.10007f30
add esp, 4
cmp dword [0x1006cd84], 0
jne 0x10010a56
mov dword [0x1006cd84], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
call fcn.10011100
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 8
push str.dsetup.u
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10003100
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x60]
call fcn.10004a40
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
mov bl, al
call fcn.10002e90
test bl, bl
je 0x1001096d
push 9
push str.server_ip
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10003100
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x60]
call fcn.10005090
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.10002e90
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x68], 0xf
push eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x7c], 0
call fcn.10003200
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 5
push eax
mov ecx, 0x10073790
call fcn.10003200
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.10002e90
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.10011190
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 6
mov ecx, 0x1006ada0
call fcn.10007cc0
push eax
call fcn.10007f30
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.10002e90
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.10002e90
jmp 0x10010985
mov edx, str.Failed_to_load_configuration.
mov ecx, 0x1006ada0
call fcn.10007a10
push eax
call fcn.10007f30
add esp, 4
call fcn.10013a00
test al, al
je 0x10010a39
mov edx, str.PHX_created
mov ecx, 0x1006ada0
call fcn.10007a10
push eax
call fcn.10007f30
add esp, 4
call fcn.1000de10
test al, al
je 0x10010a39
mov edx, str.HWID_created
mov ecx, 0x1006ada0
call fcn.10007a10
push eax
call fcn.10007f30
add esp, 4
lea eax, [ebp - 0x40]
push eax
call fcn.100094b0
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 0x10
jb 0x100109e4
mov eax, dword [eax]
push eax
call dword [0x100736d8]
lea ecx, [ebp - 0x40]
mov dword [0x1006c97c], eax
mov byte [ebp - 4], 0
call fcn.10002e90
cmp dword [0x1006c97c], 0
je 0x10010a39
mov edx, str.ENGINE_created
mov ecx, 0x1006ada0
call fcn.10007a10
push eax
call fcn.10007f30
push 0
push 0
push 0x100106f0
call fcn.1003642b
push 0
push 0
push 0x10010aa0
call fcn.1003642b
add esp, 0x1c
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x60]
push eax
push dword [eax]
lea eax, [ebp - 0x64]
push eax
call fcn.10010bd0
push dword [ebp - 0x60]
call fcn.1002ac1e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ac23
mov esp, ebp
pop ebp
ret
Function at 0x10011e60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052058
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x10069070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x78]
push 9
push str.127.0.0.1
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x78], 0
call fcn.10003100
mov dword [ebp - 4], 0
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 0x10
cmovae eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10011f04
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x10011f04
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
push eax
lea eax, [ebp - 0x60]
push str._u._u._u._u
push eax
call fcn.10011df0
add esp, 0x18
lea edx, [ebp - 0x60]
jmp 0x10011f09
mov edx, 0x10061d58
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edx], 0
jne 0x10011f23
xor ecx, ecx
jmp 0x10011f31
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011f28
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.10003100
lea ecx, [ebp - 0x78]
call fcn.10002e90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ac23
mov esp, ebp
pop ebp
ret 4

Function at 0x10012cb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
jmp 0x10012ccc
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
push eax
push dword [ebp + 8]
lea ecx, [ebx + 0x100]
mov dword [ebx + 0x110], eax
push ecx
call fcn.1002d990
add esp, 0xc
xor eax, eax
nop dword [eax]
mov byte [eax + ebx], al
inc eax
cmp eax, 0x100
jl 0x10012cf0
xor edi, edi
mov dword [ebx + 0x114], 0
mov dword [ebx + 0x118], 0
xor esi, esi
mov dword [ebp + 0xc], edi
nop word [eax + eax]
mov dl, byte [esi + ebx]
movzx eax, byte [ebx + edi + 0x100]
add eax, dword [ebp + 0xc]
movzx ecx, dl
add ecx, eax
movzx ecx, cl
mov dword [ebp + 0xc], ecx
mov al, byte [ecx + ebx]
mov byte [esi + ebx], al
lea eax, [edi + 1]
mov byte [ecx + ebx], dl
inc esi
cdq
idiv dword [ebx + 0x110]
mov edi, edx
cmp esi, 0x100
jl 0x10012d20
jmp 0x10012d69
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1004126b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100410ea

Function at 0x1004747c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004713c
Function at 0x41e41e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41e466
call fcn.0041df75
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41e466
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41e4a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41e492
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41e492
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x41e4a6
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x427287
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x588c64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4272bc
xor eax, eax
jmp 0x42730f
lea eax, [ebp - 0x210]
push eax
call fcn.00511e2d
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x4272ed
push 0x53d324
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00514580
add esp, 0xc
test eax, eax
jne 0x4272b8
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00514580
add esp, 0xc
test eax, eax
jne 0x4272b8
lea eax, [ebp - 0x210]
push eax
call fcn.00415835
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00510aec
leave
ret

Function at 0x478dc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x478dda
call fcn.0041df75
mov esi, dword [eax + 0xc]
push dword [0x58e0e4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x478df8
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x478df0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x478e25
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x478df2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00478cee
mov esi, eax
jmp 0x478e17

Function at 0x4ede59
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00418881
call fcn.00412fa3
cmp eax, esi
pop esi
jne 0x4ede75
mov ecx, 0x58c770
jmp fcn.00427dfa
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403203
pop dword [ebp - 0x18]
mov eax, 0x2e1d4a6e
sub eax, 0x2ddd186b
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x74bd4b56
add dword [ebp - 0x28], 0xd994f9f5
mov dword [ebp - 0x24], 0x44d9835f
sub dword [ebp - 0x24], 0x12a6371a
mov dword [ebp - 0x20], 0x30586690
sub dword [ebp - 0x20], 0xe40c2262
mov dword [ebp - 0x1c], 0xd2ebdea8
sub dword [ebp - 0x1c], 0xd2ebdea8
lea eax, [ebp - 0x28]
push eax
mov eax, 0x8efbb8bd
add eax, 0x7144b7a7
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x94fb9510
add dword [ebp - 0x28], 0xdf76d446
mov dword [ebp - 0x24], 0x3ec9b1e5
add dword [ebp - 0x24], 0x2a2af90
mov dword [ebp - 0x20], 0x5eb74c05
add dword [ebp - 0x20], 0x4b82067
mov dword [ebp - 0x1c], 0xaf197250
add dword [ebp - 0x1c], 0x50e68db0
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x59b9df16
sub eax, 0x59796e6e
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x389d1
push 0
call eax
mov ecx, 0xb475b643
sub ecx, 0xb475662f
xor ebx, ebx
add ebx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x18]
mov edi, 0x7f2b682
sub edi, 0x3ac3b55a
sub dword [ebp - 0xc], ebx
mov edx, dword [esi]
xor dword [ebp - 0x10], 0x5681bab9
sub edx, edi
xor dword [ebp - 4], esi
mov dword [ebx], edx
xor dword [ebp - 4], ebx
add ebx, 4
add esi, 4
loop 0x403321
add eax, 0xf6a9ef1b
sub eax, 0xf6a8bbf8
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8bea8fa4
sub ecx, 0x8baa8fa4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40a1d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413718
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004122b0
mov edi, dword [sym.imp.ui.dll_public:_static_void___cdecl_uiSubsystem::s_registerWidget_char_const___class_uiWidget_____cdecl___void__]
xor ebx, ebx
push 0x40a320
push str.uiGameTime
mov dword [esp + 0x20], ebx
mov byte [esi + 4], bl
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], 0xff
mov byte [esi + 0x15], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], 7
mov byte [esi + 0x28], bl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x21c], ebx
mov dword [esi + 0x220], ebx
mov dword [esi + 0x224], ebx
mov dword [esi + 0x228], ebx
mov dword [esi + 0x22c], ebx
mov dword [esi + 0x230], ebx
mov dword [esi + 0x6bc], ebx
mov byte [esi + 0x6c0], bl
mov dword [esi], 0x414668
call edi
push 0x40a390
push str.uiHintBanner
call edi
push 0x40a400
push str.uiMadCapsDigitalBanner
call edi
push 0x40a470
push str.uiWordBonus
call edi
push 0x40a4e0
push str.uiMadCapsProgressBar
call edi
lea ecx, [esi + 0x234]
xor eax, eax
lea edi, [esi + 0x23c]
add esp, 0x28
mov dword [ecx], eax
xor edx, edx
mov dword [ecx + 4], eax
mov ecx, 0x23
rep stosd dword es:[edi], eax
mov ecx, 0x35
lea edi, [esi + 0x2c8]
rep stosd dword es:[edi], eax
mov ecx, 0xc
lea edi, [esi + 0x3b0]
rep stosd dword es:[edi], eax
lea eax, [esi + 0x39c]
lea ecx, [esi + 0x3e0]
pop edi
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
lea eax, [esi + 0x3e4]
mov dword [ecx], ebx
mov ecx, dword [esp + 0xc]
mov dword [eax], edx
mov dword [eax + 4], edx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40e220
Capabilities:
Check mutex on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexA]
push ebp
mov ebp, dword [sym.imp.core.dll_public:_void____thiscall_MemoryMgr::alloc_int__unsigned_int_]
push esi
push edi
xor edi, edi
mov eax, dword [sym.imp.core.dll_class_MemoryMgr__g_MemoryPtr]
push 8
push 0
mov ecx, dword [eax]
call ebp
mov esi, eax
test esi, esi
je 0x40e25d
mov eax, dword [edi + 0x419bbc]
mov dword [esi], 0x4146e0
push eax
push 0
push 0
call ebx
mov dword [esi + 4], eax
jmp 0x40e25f
xor esi, esi
test esi, esi
mov dword [edi + 0x41e444], esi
je 0x40e2b1
add edi, 4
cmp edi, 0x14
jl 0x40e232
mov eax, dword [0x41e44c]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [eax + 4]
test eax, eax
je 0x40e288
push 0
push eax
call esi
mov eax, dword [0x41e450]
mov eax, dword [eax + 4]
test eax, eax
je 0x40e299
push 0
push eax
call esi
mov eax, dword [0x41e454]
mov eax, dword [eax + 4]
test eax, eax
je 0x40e2aa
push 0
push eax
call esi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x411830
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
add eax, 4
push eax
push 0
push str.CustomCursor
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
setne al
ret