joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418a80
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x38
push esi
push edi
push 0x4c5ec0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x418aa4
pop edi
pop esi
add esp, 0x38
ret
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea ecx, [esp + 0x10]
push 0xe
push ecx
call edi
add esp, 0x10
cmp eax, 1
push esi
je 0x418ad0
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x38
ret
push 1
lea edx, [esp + 0x20]
push 0x28
push edx
call edi
add esp, 0x10
cmp eax, 1
push esi
je 0x418af5
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x38
ret
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x20]
add esp, 4
test eax, eax
je 0x418b0c
mov dword [eax], esi
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x20]
test eax, eax
je 0x418b1a
mov dword [eax], ecx
mov eax, dword [esp + 0x50]
test eax, eax
je 0x418b2e
mov edx, dword [esp + 0x26]
and edx, 0xffff
mov dword [eax], edx
cmp ecx, esi
jle 0x418b46
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x418b46
mov eax, ecx
pop edi
cdq
idiv esi
pop esi
add esp, 0x38
ret
pop edi
mov eax, 1
pop esi
add esp, 0x38
ret
Function at 0x418e20
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push edi
push 0x4c5ec0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x418f13
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push ebx
push 1
lea ecx, [esp + 0x14]
push 0xe
push ecx
call edi
push 0x428
call dword [sym.imp.MSVCRT.dll_malloc]
push ebx
mov esi, eax
push 1
push 0x28
push esi
call edi
mov eax, dword [esi + 0x10]
add esp, 0x24
test eax, eax
jne 0x418f02
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x418e88
xor edx, edx
mov dx, word [esi + 0xe]
mov dword [eax], edx
mov ax, word [esi + 0xe]
cmp ax, 1
jne 0x418ee0
push ebx
push 2
lea eax, [esi + 0x28]
push 4
push eax
call edi
add esp, 0x10
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 4]
mov dword [ecx], edx
mov edx, dword [esp + 0x28]
mov eax, dword [esi + 8]
mov dword [edx], eax
mov edi, dword [esi + 0x14]
test edi, edi
jne 0x418f35
mov dx, word [esi + 0xe]
mov ecx, dword [ecx]
cmp dx, 1
jne 0x418f1c
test cl, 0xf
je 0x418ed0
inc ecx
test cl, 0xf
jne 0x418eca
imul eax, ecx
cdq
and edx, 7
add eax, edx
mov edi, eax
sar edi, 3
jmp 0x418f35
cmp ax, 8
jne 0x418efc
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x418ef2
mov eax, 0x100
push ebx
push eax
lea ecx, [esi + 0x28]
push 4
push ecx
jmp 0x418e9b
cmp ax, 0x18
je 0x418ea0
push esi
call dword [sym.imp.MSVCRT.dll_free]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
test cl, 3
je 0x418f27
inc ecx
test cl, 3
jne 0x418f21
imul eax, ecx
cmp dx, 0x18
mov edi, eax
jne 0x418f35
lea edi, [edi + edi*2]
push ebp
push 0
lea eax, [esp + 0x28]
push 0
push eax
push 0
push esi
push 0
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ecx, dword [esp + 0x24]
push ebx
push edi
push 1
push ecx
mov ebp, eax
call dword [sym.imp.MSVCRT.dll_fread]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x18
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x41c300
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4e0fe8]
test eax, eax
je case.0x41c326.1156
mov ecx, dword [esp + 4]
and ecx, 0xffff
add ecx, 0xfffffb82
cmp ecx, 9
ja case.0x41c326.1156
jmp dword [ecx*4 + 0x41c3d0]
mov eax, dword [0x4e114c]
test eax, eax
je case.0x41c326.1156
push 0
push 0
push 0x468
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x4e115c], eax
je case.0x41c326.1156
mov edx, dword [0x4e0fe8]
push edx
call fcn.00453310
add esp, 4
mov eax, 1
ret
push eax
call fcn.00453310
add esp, 4
jmp 0x41c400
push esi
push 0x481
call fcn.0041c4c0
add esp, 4
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
neg eax
sbb eax, eax
neg eax
push eax
mov eax, dword [0x4e100c]
push eax
call esi
push 0x481
call fcn.0041c4c0
mov ecx, dword [0x4e101c]
add esp, 4
neg eax
sbb eax, eax
neg eax
push eax
push ecx
call esi
mov eax, dword [0x4e0fe8]
pop esi
push eax
call fcn.00453310
add esp, 4
mov eax, 1
ret
xor eax, eax
ret
mov eax, dword [0x510ae0]
sub esp, 0x14c
test eax, eax
je 0x41c41c
push str.chat:_handle_browse
call fcn.0043bb00
add esp, 4
push edi
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4e100c]
lea eax, [esp + 0x50]
push 0x100
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [0x4e0fe8]
lea eax, [esp + 0x50]
push 0x102
mov dword [esp + 8], 0x4c
mov dword [esp + 0xc], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x100
call fcn.004411b0
add esp, 4
lea ecx, [esp + 4]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0x2000c
push ecx
mov dword [esp + 0x14], str.Text_File__._
call dword [sym.imp.comdlg32.dll_GetSaveFileNameA]
test eax, eax
pop edi
je 0x41c4a5
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4e100c]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x14c
ret
Function at 0x41c4f0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 8]
cmp eax, 0xffffff35
je 0x41c510
cmp eax, 0xffffff36
je 0x41c50b
mov eax, 1
ret
jmp 0x41c540
jmp 0x41c520
xor eax, eax
mov dword [0x4e0fe8], eax
mov dword [0x4e114c], eax
mov dword [0x4e100c], eax
mov dword [0x4e101c], eax
mov eax, 1
ret
mov eax, dword [0x4e0fe8]
sub esp, 0x100
test eax, eax
jne 0x41c55b
mov eax, 1
add esp, 0x100
ret
mov eax, dword [0x4e114c]
push 0
push 0
push 0x468
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, eax
shr ecx, 0x10
jne 0x41c58f
push eax
push str.near
push str.chat
mov dword [0x4e115c], eax
call fcn.0044cf00
add esp, 0xc
push 0x47f
call fcn.0041c4c0
push eax
push str.balloons
push str.chat
mov dword [0x4e1158], eax
call fcn.0044cf00
push 0x480
call fcn.0041c4c0
push eax
push str.scrollback
push str.chat
mov dword [0x4e1008], eax
call fcn.0044cf00
push 0x47e
call fcn.0041c4c0
push eax
push str.comic_style
push str.chat
mov dword [0x4e1150], eax
call fcn.0044cf00
push 0x481
call fcn.0041c4c0
push eax
push str.logging
push str.chat
mov dword [0x4e0ff0], eax
call fcn.0044cf00
mov eax, dword [0x4e100c]
add esp, 0x40
lea edx, [esp]
push 0x100
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [0x4e1004]
test eax, eax
je 0x41c637
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp]
push ecx
call fcn.0046ade0
push eax
push str.logfile
push str.chat
mov dword [0x4e1004], eax
call fcn.0044cfe0
add esp, 0x10
call fcn.0041c670
call 0x41c520
add esp, 0x100
ret

Function at 0x41db00
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4e12a8]
test eax, eax
jne 0x41db0e
call fcn.0041de50
mov eax, dword [esp + 4]
mov ecx, dword [0x4e12b0]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp fcn.0041db30

Function at 0x41db30
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e12b0]
sub esp, 0x100
lea eax, [esp]
push 0x100
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x41dbc0
push 5
call fcn.0040d490
lea edx, [esp + 8]
push edx
call fcn.0040e2c0
add esp, 0xc
test eax, eax
je 0x41db81
push eax
push 0x222
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x4e13c4]
push eax
jmp 0x41db96
push 0x223
call fcn.004411b0
mov ecx, dword [0x4e13c4]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [0x4e12ac], 3
mov eax, 1
add esp, 0x100
ret
Function at 0x41e280
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e13cc]
sub esp, 0x100
lea eax, [esp]
push esi
push 0x100
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
mov esi, eax
add esp, 4
test esi, esi
je 0x41e325
push 0x41dbc0
push 5
call fcn.0040d490
push esi
call fcn.0040e340
add esp, 0xc
test eax, eax
je 0x41e2f3
push eax
push 0x222
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x4e13c4]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
pop esi
add esp, 0x100
ret
push 0x223
call fcn.004411b0
mov ecx, dword [0x4e13c4]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [0x4e12ac], 3
mov eax, 1
pop esi
add esp, 0x100
ret
push 0x28b
call fcn.004411b0
mov edx, dword [0x4e13c4]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
pop esi
add esp, 0x100
ret

Function at 0x41e350
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e13cc]
sub esp, 0x100
lea eax, [esp]
push 0x100
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
test eax, eax
je 0x41e3d1
push eax
push 0x1a
call fcn.0040d1b0
push 0x41dbc0
push 5
call fcn.0040d490
add esp, 0x10
call fcn.0040e6b0
test eax, eax
je 0x41e3b6
push eax
push 0x222
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x4e13c4]
push eax
jmp 0x41e3cb
push 0x223
call fcn.004411b0
mov ecx, dword [0x4e13c4]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [0x4e12ac], 3
mov eax, 1
add esp, 0x100
ret

Function at 0x41e3f0
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e13cc]
sub esp, 0x100
lea eax, [esp]
push 0x100
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
push eax
push 0x1a
call fcn.0040d1b0
push 0x41dbc0
push 5
call fcn.0040d490
add esp, 0x14
call fcn.0040e640
test eax, eax
je 0x41e44f
push eax
push 0x222
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x4e13c4]
push eax
jmp 0x41e464
push 0x223
call fcn.004411b0
mov ecx, dword [0x4e13c4]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [0x4e12ac], 3
mov eax, 1
add esp, 0x100
ret
Function at 0x41e480
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e13cc]
sub esp, 0x100
lea eax, [esp]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
push eax
push 0x1a
call fcn.0040d1b0
mov ecx, dword [0x4e12b0]
add esp, 0xc
lea eax, [esp + 4]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 4]
push edx
push 0x1b
call fcn.0040d240
mov ecx, dword [0x4e12bc]
add esp, 8
lea eax, [esp + 4]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 4]
push edx
push 0x1c
call fcn.0040d240
mov ecx, dword [0x4e12a0]
add esp, 8
lea eax, [esp + 4]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 4]
push edx
push 0x1d
call fcn.0040d240
mov eax, dword [0x4e12a8]
add esp, 8
push 0x181
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
pop esi
jne 0x41e536
push eax
jmp 0x41e538
push 0
push 0x22
call fcn.0040d2d0
add esp, 8
push 0x41e5c0
push 6
call fcn.0040d490
add esp, 8
call fcn.0040e3a0
test eax, eax
je 0x41e582
push eax
push 0x227
call fcn.004411f0
mov ecx, dword [0x4e13c4]
add esp, 8
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x100
ret
push 0x228
call fcn.004411b0
mov edx, dword [0x4e13c4]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [0x4e12ac], 0
mov eax, 1
add esp, 0x100
ret
Function at 0x41e860
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e13cc]
sub esp, 0x100
lea eax, [esp]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push edi
push 0x100
push eax
push ecx
call esi
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
lea edx, [esp + 8]
push edx
call edi
push eax
push 0x1a
call fcn.0040d1b0
mov ecx, dword [0x4e12b0]
add esp, 0xc
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
push 0x1b
call fcn.0040d240
mov ecx, dword [0x4e12bc]
add esp, 8
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
push 0x1c
call fcn.0040d240
mov ecx, dword [0x4e12a0]
add esp, 8
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
push 0x1d
call fcn.0040d240
mov ecx, dword [0x4e13c8]
add esp, 8
lea eax, [esp + 8]
push 0x100
push eax
push ecx
call esi
lea edx, [esp + 8]
push edx
push 0x1f
call fcn.0040d240
mov eax, dword [0x4e12b4]
push eax
push 0x21
call fcn.0040d1b0
mov edx, dword [0x4e12b8]
add esp, 0x10
lea ecx, [esp + 8]
push 0x100
push ecx
push edx
call esi
lea eax, [esp + 8]
push eax
call edi
push eax
push 0x24
call fcn.0040d1b0
mov ecx, dword [0x4e12a8]
add esp, 0xc
push 0x181
mov edi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push ecx
call edi
cmp eax, 1
jne 0x41e96f
push eax
jmp 0x41e971
push 0
push 0x22
call fcn.0040d2d0
add esp, 8
push 0xe
call fcn.0040d180
add esp, 4
cmp eax, 0x1c
jl 0x41e9ee
mov eax, dword [0x4e13c0]
lea edx, [esp + 8]
push 0x100
push edx
push eax
call esi
lea ecx, [esp + 8]
push ecx
push 0x27
call fcn.0040d240
mov eax, dword [0x4e12a4]
add esp, 8
lea edx, [esp + 8]
push 0x100
push edx
push eax
call esi
lea ecx, [esp + 8]
push ecx
push 0x28
call fcn.0040d240
mov edx, dword [0x4e12a8]
add esp, 8
push 0x188
push edx
call edi
cmp eax, 1
jne 0x41e9e2
push eax
jmp 0x41e9e4
push 0
push 0x26
call fcn.0040d2d0
add esp, 8
push 0x41e5c0
push 6
call fcn.0040d490
add esp, 8
call fcn.0040e470
pop edi
pop esi
test eax, eax
je 0x41ea2f
push eax
push 0x22d
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x4e13c4]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
add esp, 0x100
ret
push 0x22f
call fcn.004411b0
mov ecx, dword [0x4e13c4]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [0x4e12ac], 1
mov eax, 1
add esp, 0x100
ret

Function at 0x41ea60
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [0x4e13cc]
sub esp, 0x100
lea eax, [esp]
push esi
push 0x100
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
mov esi, eax
add esp, 4
test esi, esi
je 0x41eaf8
push 0x41e5c0
push 6
call fcn.0040d490
push esi
call fcn.0040e5e0
add esp, 0xc
test eax, eax
je 0x41ead3
push eax
push 0x229
call fcn.004411f0
add esp, 8
push eax
mov eax, dword [0x4e13c4]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
pop esi
add esp, 0x100
ret
push 0x22a
call fcn.004411b0
mov ecx, dword [0x4e13c4]
add esp, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [0x4e12ac], 2
mov eax, 1
pop esi
add esp, 0x100
ret
Function at 0x423a70
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x510b18]
sub esp, 0x100
test eax, eax
je 0x423a8c
push str.connection:_handle_okay
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4e1490]
push esi
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x3b8
push eax
call esi
test eax, eax
je 0x423bb1
cmp dword [0x4e148c], 1
jge 0x423abb
mov dword [0x4e148c], 2
mov ecx, dword [0x4e1490]
push 0x3bb
push ecx
call esi
test eax, eax
jne 0x423b91
mov edx, dword [0x4e15b0]
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x100
push 0x4e14b0
push edx
call esi
mov al, byte [0x4e14b0]
test al, al
jne 0x423afa
push 0x36b
jmp 0x423b1a
mov ecx, dword [0x4e1484]
lea eax, [esp + 4]
push 0x100
push eax
push ecx
call esi
mov al, byte [esp + 4]
test al, al
jne 0x423b32
push 0x36c
call fcn.004411b0
push eax
call fcn.00442110
add esp, 8
xor eax, eax
pop esi
add esp, 0x100
ret
lea edx, [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
push 0
push str.proxy_auto_detect
push str.connection
mov word [0x4e14a8], ax
mov dword [0x4e15b4], 0
call fcn.0044cf00
push 0x4e14b0
push str.host
push str.connection
call fcn.0044cfe0
mov eax, dword [0x4e14a8]
and eax, 0xffff
push eax
push str.port
push str.connection
call fcn.0044cf00
add esp, 0x28
jmp 0x423bbb
push 1
push str.proxy_auto_detect
push str.connection
mov dword [0x4e15b4], 1
call fcn.0044cf00
add esp, 0xc
jmp 0x423bbb
mov dword [0x4e148c], 0
mov ecx, dword [0x4e1490]
push 1
push ecx
call dword [sym.imp.USER32.dll_EndDialog]
pop esi
add esp, 0x100
ret
Function at 0x425e50
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x425e66
push str.contacts_hide
call fcn.0043bb00
add esp, 4
mov eax, dword [0x4e17c8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x4e17ec], 0
ret

Function at 0x426940
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call fcn.00410b10
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
push str._s__default__controls.ini
push 0x510b40
call ebp
mov ebx, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
mov edi, dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add esp, 0xc
mov esi, 0x4c7100
mov eax, dword [esi - 4]
push 0x510b40
push 0xc
push esi
push esi
push eax
push str.Colors
call ebx
mov ecx, dword [esi - 4]
push 0x510b40
push esi
push ecx
push str.Colors
call edi
add esi, 0x14
cmp esi, 0x4c713c
jb 0x426973
mov ebx, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov esi, 0x4c7088
mov edx, dword [esi - 4]
push 0x510b40
push 0xffffffffffffffff
push edx
push str.Elements
call ebx
test eax, eax
mov dword [esi], eax
je 0x4269cc
mov dword [esi], 1
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push eax
push 0x4c417c
push ecx
call ebp
mov eax, dword [esi - 4]
add esp, 0xc
lea edx, [esp + 0x10]
push 0x510b40
push edx
push eax
push str.Elements
call edi
add esi, 0xc
cmp esi, 0x4c7100
jb 0x4269ae
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4270d0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov edx, dword [0x4e1804]
mov eax, dword [esp + 4]
mov ecx, edx
push esi
xor ecx, eax
and ecx, 0xff
shr edx, 8
mov ecx, dword [ecx*4 + 0x4c7228]
xor ecx, edx
mov edx, dword [0x4e1808]
mov dword [0x4e1804], ecx
and ecx, 0xff
add ecx, edx
mov edx, dword [0x4e180c]
imul ecx, ecx, 0x8088405
inc ecx
mov esi, edx
mov dword [0x4e1808], ecx
and esi, 0xff
shr ecx, 0x18
xor ecx, esi
pop esi
shr edx, 8
mov ecx, dword [ecx*4 + 0x4c7228]
xor ecx, edx
mov dword [0x4e180c], ecx
ret

Function at 0x4271e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x510ae0]
test eax, eax
je 0x4271f6
push 0x4c7628
call fcn.0043bb00
add esp, 4
mov eax, dword [esp + 4]
push esi
test eax, eax
je 0x42722f
push eax
call fcn.00427240
mov esi, eax
add esp, 4
test esi, esi
je 0x42722f
push 0x44
call fcn.004411b0
push eax
push esi
push 0x55
call fcn.004411f0
push eax
call fcn.00442110
add esp, 0x14
push 0
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
ret

Function at 0x4278c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call fcn.00427240
mov esi, eax
add esp, 4
test esi, esi
je 0x4278f5
push 0x44
call fcn.004411b0
push eax
push esi
push 0x55
call fcn.004411f0
push eax
call fcn.00442110
add esp, 0x14
push 0
call dword [sym.imp.MSVCRT.dll_exit]
xor eax, eax
pop esi
ret
Function at 0x428280
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
push esi
push eax
push ecx
call fcn.00427180
mov ebx, dword [esp + 0x20]
add esp, 8
xor esi, esi
test ebx, ebx
jle 0x4282c2
push edi
mov edi, dword [esp + 0x18]
call fcn.00427140
mov cl, byte [esi + edi]
xor cl, al
movsx edx, cl
push edx
mov byte [esi + edi], cl
call fcn.004270d0
add esp, 4
inc esi
cmp esi, ebx
jl 0x4282a3
pop edi
pop esi
pop ebx
ret

Function at 0x4282d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
push edi
je 0x428342
mov eax, dword [esp + 0x10]
test eax, eax
je 0x428342
push eax
push ecx
call fcn.00427180
mov edi, dword [esp + 0x1c]
add esp, 8
xor esi, esi
call fcn.00427140
movsx ecx, byte [esi + edi]
xor eax, ecx
push eax
call fcn.004270d0
add esp, 4
inc esi
cmp esi, 0xc
jl 0x4282f2
cmp al, byte [esp + 0x1c]
jne 0x428342
push ebx
mov ebx, dword [esp + 0x1c]
cmp esi, ebx
jge 0x428339
call fcn.00427140
mov cl, byte [esi + edi]
xor cl, al
movsx edx, cl
push edx
mov byte [esi + edi], cl
call fcn.004270d0
add esp, 4
inc esi
cmp esi, ebx
jl 0x42831b
pop ebx
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x428790
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x4e38b8]
test eax, eax
jne 0x4287cb
mov eax, dword [0x510ae0]
test eax, eax
je 0x4287af
push str.GetVolumeInformation
call fcn.0043bb00
add esp, 4
push 0
push 0
push 0
push 0
push 0x4e38b8
push 0
push 0
push 0x4c791c
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
mov eax, 0x4e38b8
ret
Function at 0x42a740
Capabilities:
Create directory

Disassembly:
mov eax, dword [0x510af4]
sub esp, 0x1a0
test eax, eax
je 0x42a75c
push str.download:_open_misc_db
call fcn.0043bb00
add esp, 4
push ebx
push esi
push edi
call fcn.00410b10
push eax
lea eax, [esp + 0xb0]
push str._scache_artmisc
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0xb8]
push ecx
call dword [sym.imp.MSVCRT.dll__mkdir]
mov edi, 0x4c7d50
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xbc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xbc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
push esi
push esi
push 0x1000
push 0x1000
push 0x32
push 0x96
push eax
call fcn.004273e0
mov ecx, dword [str.CacheVersion]
mov edx, eax
mov eax, dword [0x4c64f0]
mov dword [esp + 0x40], ecx
mov ecx, dword [0x4c64f4]
mov dword [esp + 0x44], eax
mov al, byte [0x4c64f8]
mov dword [esp + 0x48], ecx
mov byte [esp + 0x4c], al
mov ecx, 0x22
mov eax, 0x20202020
lea edi, [esp + 0x4d]
rep stosd dword es:[edi], eax
push edx
mov dword [0x4e3910], edx
stosb byte es:[edi], al
call fcn.00427e00
add esp, 0x30
test eax, eax
jne 0x42a85f
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [0x4e3910]
lea eax, [esp + 0x18]
push edx
push eax
push ecx
call fcn.00427900
add esp, 0x10
test eax, eax
je 0x42a850
cmp dword [esp + 0xc], esi
je 0x42a85f
mov edx, dword [0x4e3910]
push edx
call fcn.004271e0
add esp, 4
mov edx, dword [0x4e3910]
lea eax, [esp + 0xc]
push 4
lea ecx, [esp + 0x18]
push eax
push ecx
push edx
mov dword [esp + 0x1c], esi
call fcn.00427b00
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x1a0
ret