joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468d00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x468d12
cmp dword [ebp + 0xc], 0
jne 0x468d29
push 0x642
push 0x5351e8
push str.filename__file_open_mode
call fcn.0050d6c1
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x468d38
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00468e50
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x468d58
xor eax, eax
jmp 0x468e45
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0050e552
add esp, 0xc
test eax, eax
jne 0x468d95
mov edx, dword [ebp - 4]
push edx
call fcn.0050ec76
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x468d95
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.0050e552
add esp, 0xc
test eax, eax
je 0x468da8
mov ecx, dword [ebp - 4]
push ecx
call fcn.0050dc09
add esp, 4
xor eax, eax
jmp 0x468e45
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x14]
push eax
call fcn.0046b990
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x468dd6
mov ecx, dword [ebp - 4]
push ecx
call fcn.0050dc09
add esp, 4
xor eax, eax
jmp 0x468e45
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0050e175
add esp, 0x10
cmp eax, dword [ebp - 8]
je 0x468e0d
mov edx, dword [ebp - 4]
push edx
call fcn.0050dc09
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.0046b9e0
add esp, 4
xor eax, eax
jmp 0x468e45
cmp dword [ebp + 0x14], 0
jle 0x468e28
mov ecx, dword [ebp + 0x14]
push ecx
push 0
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
push edx
call fcn.00503c30
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call fcn.0050dc09
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x468e42
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [ecx], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x469110
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x534de8
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x469171
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x46912b
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x469180
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0x534de8
cmp dword [ebp + 0xc], 0
je 0x469239
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x469237
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 3], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov dl, byte [ebp - 3]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
cmp eax, 0x23
jne 0x469214
cmp dword [ebp + 0xc], 2
jb 0x469214
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x469214
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x469214
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
movzx edx, byte [ebp - 2]
xor ecx, edx
mov edx, dword [ebp - 0x10]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 0xc], eax
jmp 0x4691ab
jmp 0x4692ae
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 4]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4692ae
movzx edx, byte [ebp - 1]
cmp edx, 0x23
jne 0x46928f
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x46928f
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x46928f
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 8
mov eax, dword [ebp - 0xc]
and eax, 0xff
movzx ecx, byte [ebp - 1]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
xor edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
jmp 0x469239
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x478490
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5301c6
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x814868]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.0045e770
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.0045e770
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.0045c350
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.0045c350
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.0045c350
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c], 0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x1c]
call fcn.0045b9a0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], edx
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x24]
call fcn.0045b9a0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], edx
mov dword [ebp - 0x14], 0
jmp 0x4785b6
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 1
jge 0x4785cc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [eax + edx*4 + 0x58], 0xffffffff
jmp 0x4785ad
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x48dab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00468000
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x90]
call fcn.0048e330
movzx ecx, al
test ecx, ecx
je 0x48dae6
mov edx, str.Font_atlas_not_built__It_is_generally_built_by_the_renderer_back_end._Missing_call_to_renderer__NewFrame___function__e.g._ImGui_ImplOpenGL3_NewFrame__.
test edx, edx
jne 0x48dafd
push 0x81
push str.D:projectsin_workmacro_sharedimguiimgui_impl_win32.cpp
push str.io.Fonts__IsBuilt_____Font_atlas_not_built__It_is_generally_built_by_the_renderer_back_end._Missing_call_to_renderer__NewFrame___function__e.g._ImGui_ImplOpenGL3_NewFrame__._
call fcn.0050d6c1
add esp, 0xc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [0x815af0]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
cvtsi2ss xmm0, eax
push ecx
movss dword [esp], xmm0
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
cvtsi2ss xmm0, ecx
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x40]
call fcn.0045b9a0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [0x815af8]
mov edx, dword [ebp - 8]
sbb edx, dword [0x815afc]
call fcn.00502080
cvtsd2ss xmm0, xmm0
mov edx, dword [0x815b04]
mov ecx, dword [0x815b00]
movss dword [ebp - 0x38], xmm0
call fcn.00502080
cvtsd2ss xmm0, xmm0
movss xmm1, dword [ebp - 0x38]
divss xmm1, xmm0
mov eax, dword [ebp - 0x20]
movss dword [eax + 0x10], xmm1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [0x815af8], ecx
mov dword [0x815afc], edx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x48dbbf
mov dword [ebp - 0x24], 1
jmp 0x48dbc6
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
mov dl, byte [ebp - 0x24]
mov byte [ecx + 0xf8], dl
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x48dbeb
mov dword [ebp - 0x28], 1
jmp 0x48dbf2
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x20]
mov dl, byte [ebp - 0x28]
mov byte [ecx + 0xf9], dl
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
je 0x48dc17
mov dword [ebp - 0x2c], 1
jmp 0x48dc1e
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x20]
mov dl, byte [ebp - 0x2c]
mov byte [ecx + 0xfa], dl
mov eax, dword [ebp - 0x20]
mov byte [eax + 0xfb], 0
call fcn.0048dd90
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + 0xa8]
test edx, edx
je 0x48dc50
mov dword [ebp - 0x30], 0xffffffff
jmp 0x48dc58
call fcn.004680e0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ecx, dword [0x575380]
cmp ecx, dword [ebp - 0x34]
je 0x48dc77
mov edx, dword [ebp - 0x34]
mov dword [0x575380], edx
call fcn.0048dca0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret
Function at 0x4a2a60
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00503c30
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x4a2ac9
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [ebp + eax - 0x108]
push ecx
call fcn.0050766e
add esp, 4
mov edx, 1
imul ecx, edx, 0
mov byte [ebp + ecx - 0x108], al
jmp 0x4a2ad5
mov edx, dword [0x5496d4]
mov dword [ebp - 0x108], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0x5496d8
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4a2b05
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x110], ecx
jmp 0x4a2b0f
mov dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret
Function at 0x4a7570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x4a759a
jl 0x4a7591
cmp dword [ebp + 0xc], 0
ja 0x4a759a
xor eax, eax
xor edx, edx
jmp 0x4a76db
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x4a75bc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004a76f0
jmp 0x4a76db
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.004a4f50
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x4a762b
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.00459cb0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004a5fb0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0045ae00
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004a5f00
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x4a76cc
mov ecx, dword [ebp - 0x10]
call fcn.004a5550
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x4a769b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0050e175
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x4a7699
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x4a76db
jmp 0x4a7647
cmp dword [ebp - 8], 0
jbe 0x4a76cc
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.0050e175
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a7d70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x14], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x14], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 4], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 4], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx + 4], 0x10325476
mov ecx, dword [ebp + 8]
call fcn.0045b1e0
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
call fcn.0045ab10
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.004a8260
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4ab200
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x530abd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 4
lea ecx, [ebp - 0x14]
call fcn.004a56e0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.004ab2e0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x4ab160
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.004a7440
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0
call fcn.00516857
add esp, 0x18
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0
je 0x4ab28c
lea ecx, [ebp - 0x14]
call fcn.004ac5c0
jmp 0x4ab29d
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
push 6
call fcn.00501419
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004ab620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret 4
Function at 0x4acde0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x530be0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x48
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x58]
push edx
call dword [ebp - 0x28]
add esp, 8
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.0045ab10
mov dword [ebp - 0x30], eax
mov eax, dword [0x5c4158]
mov dword [ebp - 0x34], eax
push 0x815b98
push 0x10
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x58]
call fcn.0045a230
cmp dword [ebp - 0x38], 0
je 0x4ace9c
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], edx
lea eax, [ebp - 0x24]
push eax
call dword [ebp - 0x3c]
add esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x4ace9f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret

Function at 0x4acec0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x530c10
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x48
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
lea ecx, [ebp - 0x58]
push ecx
call dword [ebp - 0x28]
add esp, 8
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.0045ab10
mov dword [ebp - 0x30], eax
mov edx, dword [0x5c4158]
mov dword [ebp - 0x34], edx
push 0x815b98
push 0x10
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x58]
call fcn.0045a230
cmp dword [ebp - 0x38], 0
je 0x4acf84
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], ecx
lea edx, [ebp - 0x24]
push edx
call dword [ebp - 0x3c]
add esp, 4
fstp dword [ebp - 0x40]
fld dword [ebp - 0x40]
jmp 0x4acf87
fld dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret
Function at 0x4adfc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0x4ad910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4adff8
push 0xf
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x4ae1c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4ae1ea
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x4ae1ea
mov dword [ebp - 8], 1
jmp 0x4ae1f1
mov dword [ebp - 8], 0
movzx eax, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4ae2c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x3e8
mov eax, dword [0x816148]
or eax, dword [0x81614c]
jne 0x4ae32b
push 0x816148
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x816140
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
push 0x7fff
mov ecx, dword [0x81614c]
push ecx
mov edx, dword [0x816148]
push edx
call fcn.005022f0
add eax, dword [0x816140]
adc edx, dword [0x816144]
mov dword [0x816140], eax
mov dword [0x816144], edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [0x816140]
mov edx, dword [ebp - 8]
sbb edx, dword [0x816144]
push 0
push 0x3e8
push edx
push ecx
call fcn.005022f0
mov ecx, dword [0x81614c]
push ecx
mov ecx, dword [0x816148]
push ecx
push edx
push eax
call fcn.00502330
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret
Function at 0x4ae500
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movsx eax, word [ebp + 8]
test eax, eax
jle 0x4ae5d4
push 0x32
movsx ecx, word [ebp + 8]
push ecx
call fcn.004adaf0
add esp, 8
movzx edx, al
test edx, edx
je 0x4ae5d4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jne 0x4ae546
mov dword [ebp - 8], 1
jmp 0x4ae54d
mov dword [ebp - 8], 0
mov cl, byte [ebp - 8]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
je 0x4ae5b5
push 6
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x816138], 0
je 0x4ae5b3
mov ecx, dword [0x816138]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x816138]
cmp edx, dword [ebp + 0x10]
jne 0x4ae591
mov dword [ebp - 0xc], 1
jmp 0x4ae598
mov dword [ebp - 0xc], 5
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [0x816138]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x816138], 0
jmp 0x4ae5d4
mov edx, dword [ebp - 0x10]
mov dword [0x816138], edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esp, ebp
pop ebp
ret
Function at 0x4b9a00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], ecx
mov eax, dword [ebp - 0x10c]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call fcn.004ae1c0
add esp, 4
movzx eax, al
test eax, eax
je 0x4b9a7e
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00503c30
add esp, 0xc
mov edx, dword [ebp - 0x10c]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
push str._sRustClient.exe
lea edx, [ebp - 0x108]
push edx
call fcn.0045b2d0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4b9a7e
mov al, 1
jmp 0x4b9a8d
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ecx]
mov eax, dword [edx]
mov byte [eax], 0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret

Function at 0x4ba430
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x814868]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x120]
push eax
push 0xf013f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
push 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x118]
push ecx
push 0
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x124], 0
jmp 0x4ba4b1
mov edx, dword [ebp - 0x124]
add edx, 1
mov dword [ebp - 0x124], edx
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x10c]
jae 0x4ba51b
mov dword [ebp - 0x110], 0x104
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4ba519
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x128], edx
lea eax, [ebp - 0x108]
push eax
call dword [ebp - 0x128]
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x4ba519
jmp 0x4ba51b
jmp 0x4ba4a2
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005019e1
mov esp, ebp
pop ebp
ret