joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418586
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x43de9b
call fcn.0041ff30
sub esp, 0x114
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x418799
push ebx
lea ecx, [ebp - 0x120]
call fcn.0040120a
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [0x493960], ebx
je 0x41878d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x4f08dc]
cmp dword [0x493960], eax
jae 0x41878c
mov ax, word [ebp + 0x10]
mov ecx, 0xffff
cmp ax, cx
je 0x4186ff
movzx eax, ax
imul ecx, eax, 0x153
cmp dword [ecx + 0x4939a0], ebx
je 0x41878c
cmp dword [0x493948], ebx
jne 0x41878c
cmp dword [0x49394c], ebx
jne 0x41878c
mov ax, word [ecx + 0x4939ce]
mov word [esi], ax
mov ax, word [ecx + 0x4939d0]
mov word [esi + 2], ax
mov ax, word [ecx + 0x4939d2]
mov word [esi + 4], ax
movss xmm1, dword [ecx + 0x4939d4]
addss xmm1, dword [0x4f1461]
movss dword [esi + 6], xmm1
movss xmm0, dword [ecx + 0x4939d8]
addss xmm0, dword [0x4f1465]
movss dword [esi + 0xa], xmm0
movss xmm0, dword [ecx + 0x4939dc]
addss xmm0, dword [0x4f1469]
movss dword [esi + 0xe], xmm0
mov eax, dword [ecx + 0x4939e0]
mov dword [esi + 0x12], eax
mov eax, dword [ecx + 0x4939e4]
mov dword [esi + 0x16], eax
mov eax, dword [ecx + 0x4939e8]
mov dword [esi + 0x1a], eax
mov eax, dword [ecx + 0x4939ec]
mov dword [esi + 0x1e], eax
cmp byte [0x4f1481], bl
jne 0x4186b6
mov al, byte [ecx + 0x4939f0]
mov byte [esi + 0x22], al
mov al, byte [ecx + 0x4939f1]
mov byte [esi + 0x23], al
mov al, byte [0x4f149f]
test al, al
jne 0x4186c5
mov al, byte [ecx + 0x4939f2]
mov byte [esi + 0x24], al
mov al, byte [ecx + 0x4939f3]
mov byte [esi + 0x25], al
mov eax, dword [ecx + 0x4939f4]
mov dword [esi + 0x26], eax
mov eax, dword [ecx + 0x4939f8]
mov dword [esi + 0x2a], eax
mov eax, dword [ecx + 0x4939fc]
mov dword [esi + 0x2e], eax
mov eax, dword [ecx + 0x493a0e]
mov dword [esi + 0x40], eax
movss dword [0x4f1493], xmm1
jmp 0x418718
mov al, byte [0x4f149f]
test al, al
je 0x41870b
mov byte [esi + 0x24], al
movss xmm0, dword [esi + 6]
movss dword [0x4f1493], xmm0
movss xmm0, dword [esi + 0xa]
lea eax, [ebp + 8]
push 1
movss dword [0x4f1497], xmm0
lea ecx, [ebp - 0x120]
movss xmm0, dword [esi + 0xe]
push 8
push eax
movss dword [0x4f149b], xmm0
mov byte [ebp + 8], 0xcf
call fcn.0040169e
push 0x44
push esi
lea ecx, [ebp - 0x120]
call fcn.00401632
mov ecx, dword [0x4e6b24]
lea edx, [ebp - 0x120]
push ebx
push 7
push 1
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
cmp dword [ebp + 0xc], ebx
je 0x418785
cmp byte [esi + 0x22], bl
jne 0x418785
push 0xffff
push ebx
call fcn.00418929
pop ecx
pop ecx
call edi
mov dword [0x493960], eax
pop edi
lea ecx, [ebp - 0x120]
call fcn.00401225
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4187a6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x43e291
call fcn.0041ff30
sub esp, 0x12c
push ebx
mov bx, word [ebp + 8]
movzx eax, bx
push esi
imul esi, eax, 0x14
cmp dword [esi + 0x4e6b28], 0
je 0x4188a6
cmp dword [0x493958], 0
je 0x4188a6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4f08e0]
cmp dword [0x493958], eax
jae 0x4188a6
push edi
lea ecx, [ebp - 0x138]
call fcn.0040120a
movss xmm0, dword [esi + 0x4e6b2c]
lea edi, [ebp - 0x24]
push 6
and dword [ebp - 4], 0
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
cvttss2si eax, dword [0x4f148a]
lea ecx, [ebp - 0x138]
mov word [ebp - 0x24], bx
push 1
push 8
mov byte [ebp + 8], 0xd3
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [esi + 0x4e6b30]
mov byte [ebp - 0x20], al
cvttss2si eax, dword [0x4f148e]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [esi + 0x4e6b34]
mov byte [ebp - 0x1f], al
lea eax, [ebp + 8]
push eax
movss dword [ebp - 0x10], xmm0
call fcn.0040169e
push 0x18
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x138]
call fcn.00401632
mov ecx, dword [0x4e6b24]
lea edx, [ebp - 0x138]
push 0
push 7
push 1
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x138]
mov dword [0x493958], eax
call fcn.00401225
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x419610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [0x49397c]
sub esp, 0x40
imul eax, eax, 0x153
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [eax + 0x4939c8], ebx
je 0x41965c
push 0x3f
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.00421760
mov ax, word [ebp + 0xc]
push esi
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.00418348
push esi
push ebx
push ebx
call fcn.0041803e
add esp, 0x24
cmp dword [0x4f07a8], ebx
je 0x4196dd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x2710
cmp dword [0x4f07a8], eax
jae 0x4196dd
movzx eax, word [0x49397c]
imul eax, eax, 0x153
cmp dword [eax + 0x4939c8], ebx
jne 0x4196d0
movzx eax, si
mov ecx, 0xffff
imul eax, eax, 0x153
cmp word [eax + 0x493a12], cx
je 0x4196f9
movzx eax, word [0x4f145d]
push ebx
push eax
call fcn.00418234
movzx eax, word [0x49397c]
imul eax, eax, 0x153
pop ecx
pop ecx
mov dword [0x4f07a8], ebx
mov dword [eax + 0x4939c8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4f07a8], eax
jmp 0x4196f9
movzx eax, word [0x49397c]
imul eax, eax, 0x153
cmp dword [eax + 0x4939c8], ebx
jne 0x4196f9
push esi
call fcn.004197de
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x419810
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
xor ebp, ebp
cmp byte [0x4f1492], 0
push edi
mov edi, 0x3ec
je 0x4199dd
cmp byte [0x4f0808], 0
je 0x4199dd
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x4f0798]
cmp eax, dword [0x4f142c]
jb 0x4199dd
mov si, word [0x4f07b0]
cmp si, di
jae 0x419a2b
cmp si, word [0x49397c]
je 0x4199e4
movzx eax, si
imul edi, eax, 0x153
cmp dword [edi + 0x4939a0], ebp
je 0x4199e4
cmp dword [edi + 0x4939a4], ebp
jne 0x419898
cmp dword [edi + 0x4939a8], ebp
je 0x4199e4
cmp dword [0x4f13d6], 4
jne 0x4198cc
push 0x4f1449
call fcn.00419595
pop ecx
movzx eax, ax
mov ecx, 0xffff
cmp ax, cx
je 0x4198cc
cmp ax, si
jne 0x4198cc
inc si
mov word [0x4f07b0], si
jmp 0x4199e4
movss xmm0, dword [0x4f1493]
movss dword [esp + 0x13], xmm0
movss xmm0, dword [0x4f1497]
movss dword [esp + 0x17], xmm0
movss xmm0, dword [0x4f149b]
movss dword [esp + 0x1b], xmm0
movss xmm0, dword [edi + 0x4939d4]
movss dword [esp + 0x1f], xmm0
movss xmm0, dword [edi + 0x4939d8]
movss dword [esp + 0x23], xmm0
movss xmm0, dword [edi + 0x4939dc]
mov byte [esp + 0x10], 1
mov word [esp + 0x11], si
movss dword [esp + 0x27], xmm0
call fcn.0042f69e
push 0xa
cdq
pop esi
idiv esi
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x441f3c]
movss dword [esp + 0x2b], xmm0
call fcn.0042f69e
cdq
idiv esi
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x441f3c]
movss dword [esp + 0x2f], xmm0
call fcn.0042f69e
cdq
idiv esi
mov al, byte [0x4f149f]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x441f3c]
movss dword [esp + 0x33], xmm0
test al, al
jne 0x4199c0
mov eax, dword [0x4f13d6]
cmp eax, 4
je 0x41999c
cmp eax, 5
jne 0x4199c4
push 0x4f1449
call fcn.00419595
pop ecx
movzx eax, ax
mov ecx, 0xffff
cmp ax, cx
je 0x4199c4
imul eax, eax, 0x153
mov al, byte [eax + 0x4939f2]
mov byte [esp + 0x37], al
lea eax, [esp + 0x10]
push eax
call fcn.004181bf
inc word [0x4f07b0]
pop ecx
call ebx
mov dword [0x4f0798], eax
mov si, word [0x4f07b0]
mov ebx, 0x3ec
cmp si, bx
jae 0x419a2b
cmp si, word [0x49397c]
je 0x419a18
movzx eax, si
imul eax, eax, 0x153
cmp dword [eax + 0x4939a0], ebp
je 0x419a18
cmp dword [eax + 0x4939a4], ebp
jne 0x419a1f
cmp dword [eax + 0x4939a8], ebp
jne 0x419a1f
inc si
cmp si, bx
jb 0x4199ee
mov word [0x4f07b0], si
cmp si, bx
jb 0x419a33
xor eax, eax
mov word [0x4f07b0], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x419afd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4f079c]
cmp eax, dword [0x4f1424]
jb 0x419b39
lea eax, [ebp - 0x40]
push 0x3c
push eax
call fcn.00418cfa
lea eax, [ebp - 0x40]
push eax
call fcn.0041a25d
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4f079c], eax
leave
ret
Function at 0x419b3b
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x493968], 0
je 0x419b93
cmp dword [0x493974], 0
je 0x419b93
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4f07a0]
cmp eax, dword [0x4f1428]
jb 0x419b93
push dword [0x4f07ac]
call fcn.0041a014
pop ecx
call fcn.0041a0f2
mov eax, dword [0x4f07ac]
xor ecx, ecx
inc eax
cmp eax, dword [0x493978]
cmovge eax, ecx
mov dword [0x4f07ac], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4f07a0], eax
ret

Function at 0x419c28
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4f078c]
cmp eax, dword [0x4f1418]
jb 0x419cc0
push ebx
push ebp
push esi
mov ebp, 0x10000
mov esi, ebp
call fcn.0042f69e
push 0x2e
cdq
pop ecx
idiv ecx
mov ebx, edx
cmp esi, 0x3eb
ja 0x419c82
movzx eax, word [0x49397c]
cmp esi, eax
je 0x419c82
imul eax, esi, 0x153
cmp dword [eax + 0x4939a0], 0
je 0x419c82
cmp byte [eax + 0x4939cd], 0
je 0x419c9e
call fcn.00419547
cmp ax, 2
jb 0x419ca4
call fcn.0042f69e
cdq
mov ecx, 0x3ec
idiv ecx
mov esi, edx
jmp 0x419c57
cmp esi, ebp
je 0x419cb2
jmp 0x419ca9
mov esi, 0xffff
push esi
push ebx
call fcn.00418929
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop esi
pop ebp
mov dword [0x4f078c], eax
pop ebx
ret
Function at 0x419cc1
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
sub esp, 0x4c
mov eax, 0x43de9b
call fcn.0041ff30
sub esp, 0x114
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4f0794]
cmp eax, dword [0x4f1420]
jb 0x419e9d
push ebx
push esi
push 0x10
mov ebx, 0x493980
push ebx
call fcn.00418cfa
movzx eax, word [0x49397c]
imul edx, eax, 0x153
pop ecx
pop ecx
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx + 0x4939ac], al
inc ecx
test al, al
jne 0x419d0f
mov esi, dword [0x515a20]
lea eax, [ebp]
push 0x40
push 0
push eax
xor esi, 0xfd9
call fcn.00421760
lea eax, [ebp]
push 0x3e9
push eax
call fcn.00419482
lea ebx, [ebp]
add esp, 0x14
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x419d4d
sub ebx, ecx
mov ecx, 0x493980
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419d5e
sub ecx, edx
mov dword [ebp + 0x44], ecx
mov ecx, 0x4f13fa
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419d72
sub ecx, edx
mov dword [ebp + 0x40], ecx
lea ecx, [ebp - 0x120]
call fcn.0040120a
and dword [ebp - 4], 0
lea eax, [ebp + 0x48]
push 1
push 0x20
push eax
lea ecx, [ebp - 0x120]
mov dword [ebp + 0x48], 0xfd9
call fcn.0040169e
push 1
push 8
lea eax, [ebp + 0x4c]
mov byte [ebp + 0x4c], 1
push eax
lea ecx, [ebp - 0x120]
call fcn.0040169e
mov eax, dword [ebp + 0x44]
lea ecx, [ebp - 0x120]
push 1
mov byte [ebp + 0x4c], al
lea eax, [ebp + 0x4c]
push 8
push eax
call fcn.0040169e
mov ecx, dword [ebp + 0x44]
movzx eax, cl
lea ecx, [ebp - 0x120]
push eax
push 0x493980
call fcn.00401632
mov dword [ebp + 0x48], esi
lea eax, [ebp + 0x48]
xor esi, esi
lea ecx, [ebp - 0x120]
inc esi
push esi
push 0x20
push eax
call fcn.0040169e
push esi
push 8
lea eax, [ebp + 0x4c]
mov byte [ebp + 0x4c], bl
push eax
lea ecx, [ebp - 0x120]
call fcn.0040169e
movzx eax, bl
lea ecx, [ebp - 0x120]
push eax
lea eax, [ebp]
push eax
call fcn.00401632
mov ebx, dword [ebp + 0x40]
lea eax, [ebp + 0x4c]
push esi
push 8
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp + 0x4c], bl
call fcn.0040169e
movzx eax, bl
lea ecx, [ebp - 0x120]
push eax
push 0x4f13fa
call fcn.00401632
mov ecx, dword [0x4e6b24]
xor edx, edx
push edx
push dword [0x441e48]
push dword [0x441e44]
mov eax, dword [ecx]
push edx
push edx
push 8
push esi
lea edx, [ebp - 0x120]
push edx
push 0x450398
call dword [eax + 0x64]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x120]
mov dword [0x4f0794], eax
call fcn.00401225
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add ebp, 0x50
leave
ret
Function at 0x419eac
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x43e15f
call fcn.0041ff30
sub esp, 0x118
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4f07a4]
cmp eax, dword [0x4f141c]
jb 0x41a008
push ebx
push edi
lea ecx, [ebp - 0x124]
call fcn.0040120a
mov eax, dword [0x4f0784]
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x10], eax
xor ebx, ebx
inc eax
mov dword [ebp - 4], ebx
push 1
mov dword [0x4f0784], eax
lea eax, [ebp - 0x10]
push 0x20
push eax
call fcn.0040169e
mov ecx, dword [0x4e6b24]
lea edx, [ebp - 0x124]
push ebx
push dword [0x441e48]
push dword [0x441e44]
mov eax, dword [ecx]
push ebx
push ebx
push 0xa
pop edi
push edi
push 1
push edx
push 0x450444
call dword [eax + 0x64]
mov ecx, dword [0x4e6b24]
lea edx, [ebp - 0x124]
push ebx
push dword [0x441e48]
push dword [0x441e44]
mov eax, dword [ecx]
push ebx
push ebx
push edi
push 1
push edx
push 0x4503b8
call dword [eax + 0x64]
mov ecx, dword [0x4e6b24]
lea edx, [ebp - 0x124]
push ebx
push dword [0x441e48]
push dword [0x441e44]
mov eax, dword [ecx]
push ebx
push ebx
push edi
push 1
push edx
push 0x4503bc
call dword [eax + 0x64]
mov ecx, dword [0x4e6b24]
lea edx, [ebp - 0x124]
push ebx
push dword [0x441e48]
push dword [0x441e44]
mov eax, dword [ecx]
push ebx
push ebx
push edi
push 1
push edx
push 0x45042c
call dword [eax + 0x64]
mov ecx, dword [0x4e6b24]
lea edx, [ebp - 0x124]
push ebx
push dword [0x441e48]
push dword [0x441e44]
mov eax, dword [ecx]
push ebx
push ebx
push edi
push 1
push edx
push 0x4503a8
call dword [eax + 0x64]
movzx eax, word [0x4f09f5]
push 0x4405b4
push 1
push 1
push eax
call fcn.0041a2f9
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x124]
mov dword [0x4f07a4], eax
call fcn.00401225
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x41a099
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4f0790]
cmp eax, dword [0x4f1414]
jb 0x41a0f1
call fcn.0042f69e
and eax, reloc.WS2_32.dll_ntohs
jns 0x41a0be
dec eax
or eax, 0xfffffff0
inc eax
add eax, 3
push eax
push 0x493980
call fcn.00418cfa
push 0
mov byte [0x4f0809], 1
call fcn.00419bf6
push 1
push 1
call fcn.0041be3d
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4f0790], eax
ret

Function at 0x41a696
Capabilities:
Create thread
Terminate thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x4f0e08], esi
je 0x41a6e9
push esi
push esi
push 2
push dword [0x4f0e14]
mov dword [0x4f0e08], esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x4f0e14]
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push str.teleportMenuWndClass
call dword [sym.imp.USER32.dll_UnregisterClassA]
push esi
push dword [0x4f0e10]
mov dword [0x4f0e0c], esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push esi
push esi
push 0x41f2c1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4f0e10], eax
pop esi
ret
Function at 0x41bb6c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, esi
push edi
mov eax, dword [esi]
call dword [eax + 0x20]
mov edi, eax
test edi, edi
je 0x41bd64
mov ebx, 0xc8
mov ecx, dword [edi + 0x10]
mov al, byte [ecx]
cmp al, 0x28
jne 0x41bb9f
cmp dword [edi + 8], 5
jbe 0x41bd74
mov al, byte [ecx + 5]
movzx eax, al
cmp eax, ebx
ja 0x41bce7
je 0x41bcde
cmp eax, 0x21
ja 0x41bc79
je 0x41bc58
sub eax, 0xc
je 0x41bc4c
sub eax, 0x11
je 0x41bc2b
dec eax
sub eax, 1
je 0x41bc0a
sub eax, 1
jne 0x41bd4b
cmp esi, dword [0x4e6b24]
jne 0x41bd4b
mov eax, dword [0x470cec]
mov ecx, 0x3e8
cdq
idiv ecx
push eax
push str._SAMP__Connection_was_closed_by_the_server._Reconnecting_in__d_seconds.
call fcn.004189dc
pop ecx
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp esi, dword [0x4e6b24]
jne 0x41bd4b
mov eax, dword [0x470cec]
mov ecx, 0x3e8
cdq
idiv ecx
push eax
push str._SAMP__The_server_is_full._Reconnecting_in__d_seconds.
jmp 0x41bbfb
cmp esi, dword [0x4e6b24]
jne 0x41bd4b
mov eax, dword [0x470cec]
mov ecx, 0x3e8
cdq
idiv ecx
push eax
push str._SAMP__Connection_attempt_failed._Reconnecting_in__d_seconds.
jmp 0x41bbfb
push esi
push edi
call fcn.0041aa7b
jmp 0x41bd49
cmp esi, dword [0x4e6b24]
jne 0x41bd4b
mov eax, dword [0x470cec]
mov ecx, 0x3e8
cdq
idiv ecx
push eax
push str._SAMP__The_connection_was_lost._Reconnecting_in__d_seconds.
jmp 0x41bbfb
sub eax, 0x22
je 0x41bcd5
dec eax
sub eax, 1
je 0x41bcb1
sub eax, 1
jne 0x41bd4b
cmp esi, dword [0x4e6b24]
jne 0x41bd4b
mov eax, dword [0x470cec]
mov ecx, 0x3e8
cdq
idiv ecx
push eax
push str._SAMP__Invalid_password._Reconnecting_in__d_seconds.
jmp 0x41bbfb
cmp esi, dword [0x4e6b24]
jne 0x41bd4b
mov eax, dword [0x470cec]
mov ecx, 0x3e8
cdq
idiv ecx
push eax
push str._SAMP__You_are_banned._Reconnecting_in__d_seconds.
jmp 0x41bbfb
push esi
push edi
call fcn.0041ad24
jmp 0x41bd49
push esi
push edi
call fcn.0041b7d9
jmp 0x41bd49
sub eax, 0xcb
je 0x41bd42
sub eax, 3
je 0x41bd39
sub eax, 1
je 0x41bd30
sub eax, 1
je 0x41bd27
sub eax, 1
je 0x41bd1e
sub eax, 1
je 0x41bd15
sub eax, 1
jne 0x41bd4b
push esi
push edi
call fcn.0041b20d
jmp 0x41bd49
push esi
push edi
call fcn.0041b6dd
jmp 0x41bd49
push esi
push edi
call fcn.0041b73e
jmp 0x41bd49
push esi
push edi
call fcn.0041b0b0
jmp 0x41bd49
push esi
push edi
call fcn.0041b325
jmp 0x41bd49
push esi
push edi
call fcn.0041ac3b
jmp 0x41bd49
push esi
push edi
call fcn.0041aba1
pop ecx
pop ecx
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x24]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
mov edi, eax
test edi, edi
jne 0x41bb89
push esi
push 0xbb8
push 1
call fcn.0041bd78
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x41bd78
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x43e6c3
call fcn.0041ff30
sub esp, 0x228
cmp dword [ebp + 8], 0
push esi
je 0x41bdec
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4f0800]
cmp eax, dword [ebp + 0xc]
jbe 0x41be30
call esi
lea ecx, [ebp - 0x120]
mov dword [0x4f0800], eax
call fcn.0040120a
mov ecx, dword [ebp + 0x10]
xor edx, edx
push edx
push dword [0x441f48]
mov dword [ebp - 4], edx
push dword [0x441f44]
mov eax, dword [ecx]
push edx
push edx
push 8
push 1
lea edx, [ebp - 0x120]
push edx
push 0x4503f8
call dword [eax + 0x64]
lea ecx, [ebp - 0x120]
jmp 0x41be2b
lea ecx, [ebp - 0x234]
call fcn.0040120a
mov ecx, dword [ebp + 0x10]
xor edx, edx
push edx
push dword [0x441f48]
xor esi, esi
push dword [0x441f44]
mov eax, dword [ecx]
inc esi
push edx
push edx
push 8
push esi
lea edx, [ebp - 0x234]
mov dword [ebp - 4], esi
push edx
push 0x4503f8
call dword [eax + 0x64]
lea ecx, [ebp - 0x234]
call fcn.00401225
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41e6c6
Capabilities:
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a4
lea eax, [ebp - 0x9a4]
push edi
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x41e6ea
xor eax, eax
pop edi
leave
ret
push ebx
push esi
xor ebx, ebx
push ebx
push 2
pop esi
push esi
push esi
call sub.WS2_32.dll_socket
mov dword [0x4f11aa], eax
cmp eax, 0xffffffff
jne 0x41e70e
call sub.WS2_32.dll_WSACleanup
pop esi
xor eax, eax
pop ebx
jmp 0x41e6e7
xor eax, eax
mov edi, 0x4f11ae
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, word [0x4f0f30]
push eax
mov word [0x4f11ae], si
call sub.WS2_32.dll_htons
mov edi, 0x4f0e30
mov word [0x4f11b0], ax
push edi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x41e75b
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
push 0x4f11b2
call fcn.004211e0
add esp, 0xc
jmp 0x41e766
push edi
call sub.WS2_32.dll_inet_addr
mov dword [0x4f11b2], eax
push ebx
mov word [0x4f11be], si
call sub.WS2_32.dll_htons
push dword [0x4f0f30]
mov word [0x4f11c0], ax
push edi
push str.RCON_mode_initialized___s:_d_._Type_login__password__to_set_the_password.
call fcn.004189dc
mov edi, 0x400
mov dword [ebp - 4], 0x10
push edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00421760
add esp, 0x18
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
lea eax, [ebp - 0x414]
push eax
push dword [0x4f11aa]
call sub.WS2_32.dll_recvfrom
test eax, eax
jle 0x41e83b
cmp byte [ebp - 0x40a], 0x78
jne 0x41e83b
push edi
lea eax, [ebp - 0x814]
push ebx
push eax
call fcn.00421760
movsx ax, byte [ebp - 0x409]
lea ecx, [ebp - 0x407]
add esp, 0xc
movzx edx, ax
cmp dx, di
ja 0x41e83b
mov al, byte [ebp - 0x407]
jmp 0x41e80b
dec al
cmp al, 0x1e
ja 0x41e808
mov byte [ecx], 0x20
inc ecx
mov al, byte [ecx]
test al, al
jne 0x41e7ff
mov esi, edx
lea eax, [ebp - 0x407]
push esi
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.00427f00
lea eax, [ebp - 0x814]
mov byte [ebp + esi - 0x814], bl
push eax
call fcn.004189dc
add esp, 0x10
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41e7a7
Function at 0x41e848
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
mov edi, 0x4f11d2
mov ebx, edi
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x41e85e
sub ebx, ecx
mov ecx, dword [ebp + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e86d
push 0x3f3
lea eax, [ebp - 0x3f7]
sub ecx, edx
push 0
push eax
mov dword [ebp - 4], ecx
call fcn.00421760
mov eax, dword [0x4f11b2]
mov dword [ebp - 0x400], eax
mov ax, word [0x4f11b0]
push 0x78
mov word [ebp - 0x3fc], ax
pop eax
mov word [ebp - 0x3fa], ax
movzx eax, bl
movzx esi, bl
push esi
mov word [ebp - 0x3f9], ax
lea eax, [ebp - 0x3f7]
push edi
push eax
mov dword [ebp - 0x404], 0x504d4153
call fcn.00427f00
add esp, 0x18
lea edi, [esi + 0xd]
cmp dword [ebp + 0xc], 0
jne 0x41e90a
mov ecx, dword [ebp - 4]
movzx eax, cl
mov word [ebp + edi - 0x404], ax
add edi, 2
movzx esi, cl
lea eax, [ebp - 0x404]
push esi
push dword [ebp + 8]
add eax, edi
push eax
call fcn.00427f00
add esp, 0xc
add edi, esi
push 0x10
push 0x4f11ae
push 0
push edi
lea eax, [ebp - 0x404]
push eax
push dword [0x4f11aa]
call sub.WS2_32.dll_sendto
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e92b
Capabilities:
Get graphical window text

Disassembly:
push ecx
and dword [esp], 0
push ebp
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebp, eax
test ebp, ebp
jne 0x41e944
inc eax
jmp 0x41e9ae
push ebx
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x41e9a9
lea eax, [ebp + 1]
push edi
push eax
call fcn.0041ff24
mov edi, eax
pop ecx
test edi, edi
je 0x41e99d
lea eax, [ebp + 1]
push eax
push edi
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41e993
push 0x410
push dword [esp + 0x1c]
push ebp
push edi
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
mov dword [esp + 0xc], 1
push 1
push edi
call fcn.0041ff7f
pop ecx
pop ecx
push ebx
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
mov eax, dword [esp + 8]
pop ebx
pop ebp
pop ecx
ret

Function at 0x41f0c6
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x4f0e28], eax
xor eax, eax
push eax
push eax
push eax
push 0x41f457
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret