joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x576aa0
push 0x52b5d0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x57a040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x2c], esi
push esi
call fcn.00478780
test al, al
jne 0x4bf2fe
push esi
call fcn.00478810
test al, al
jne 0x4bf2fe
lea ebx, [esi + 0x30e]
mov dword [ebp - 0x24], ebx
movsx eax, word [ebx]
lea eax, [eax*2 + 1]
mov dword [ebp - 0x20], eax
mov edi, 0xa
lea eax, [esi + 0x22c]
mov dword [ebp - 0x28], eax
mov dword [eax], 0x3e8
nop
mov eax, edi
dec edi
mov dword [ebp - 0x30], edi
test eax, eax
je 0x4bf2fe
mov dword [ebp - 4], 0
call fcn.00526930
mov ecx, dword [ebp - 0x20]
cdq
idiv ecx
mov al, byte [esi + 0x144]
sub al, byte [ebx]
add al, dl
mov byte [ebp - 0x19], al
call fcn.00526930
mov ecx, dword [ebp - 0x20]
cdq
idiv ecx
mov al, byte [esi + 0x146]
sub al, byte [ebx]
add al, dl
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x1c], al
mov dword [ebp - 4], 0xfffffffe
jmp 0x4bf1d4
movzx ebx, al
movzx eax, byte [ebp - 0x19]
mov dword [ebp - 0x30], eax
push ebx
mov edx, eax
mov ecx, esi
call fcn.004bca90
add esp, 4
mov byte [ebp - 0x1b], al
movzx ecx, byte [esi + 0x149]
imul edx, ecx, 0x15d38
mov eax, dword [ebp - 0x30]
cmp eax, dword [edx + 0xd2f384]
jge 0x4bf21e
mov ecx, dword [edx + 0xd2f388]
cmp ebx, ecx
jge 0x4bf21e
imul ecx, ebx
add ecx, dword [edx + 0xd2f380]
mov bl, byte [ecx + eax]
jmp 0x4bf220
mov bl, 4
movzx ecx, word [esi + 0xcc]
mov eax, 0xf9
cmp cx, ax
je 0x4bf25d
xor eax, eax
mov edx, ecx
lea ecx, [eax*4 + 0x637ac4]
cmp dword [ecx], edx
je 0x4bf248
inc eax
cmp eax, 0x64
jl 0x4bf235
jmp 0x4bf24c
test ecx, ecx
jne 0x4bf25d
movzx eax, word [esi + 0xcc]
mov ecx, 0xf7
cmp ax, cx
jne 0x4bf2a8
mov al, byte [ebp - 0x1b]
test al, al
je 0x4bf2ab
test bl, 2
mov ebx, dword [ebp - 0x24]
jne 0x4bf160
movzx eax, byte [ebp - 0x19]
mov word [esi + 0x16a], ax
movzx eax, byte [ebp - 0x1a]
mov word [esi + 0x16c], ax
or dword [esi + 0x1f8], 4
mov eax, dword [ebp - 0x28]
mov dword [eax], 0xbb8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x1b]
test bl, 0xf
mov ebx, dword [ebp - 0x24]
jne 0x4bf160
test al, al
je 0x4bf160
mov eax, 0xffffffff
mov word [esi + 0x2b0], ax
mov eax, dword [ebp - 0x28]
mov dword [eax], 0x1f4
movzx eax, byte [ebp - 0x19]
mov word [esi + 0x16a], ax
movzx eax, byte [ebp - 0x1a]
mov word [esi + 0x16c], ax
mov eax, dword [esi + 0x1f8]
and eax, 0xffffff0d
or eax, 4
mov dword [esi + 0x1f8], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c7aa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b290
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x57a040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
call esi
sub eax, dword [edi + 0xad164c]
cmp eax, 0x3e8
jb 0x4c7c73
call esi
push 0
mov dword [edi + 0xad164c], eax
call fcn.0052d9f5
add esp, 4
mov esi, eax
mov eax, dword [edi + 0xad1648]
push edx
cdq
push esi
push edx
push eax
call fcn.0052d9b0
add esp, 0x10
call fcn.00545cc0
mov ecx, dword [edi + 0xad1640]
mov dword [edi + 0xad1644], eax
sub ecx, 0
je 0x4c7c6d
sub ecx, 1
je 0x4c7bca
sub ecx, 1
jne 0x4c7c6d
test eax, eax
jg 0x4c7c6d
mov esi, dword [edi + 0xad1654]
cmp esi, 0xffffffff
je 0x4c7bb2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
lea eax, [ebp - 0x24]
mov ecx, 0xa9b83c
push eax
call fcn.00405650
mov eax, dword [ebp - 0x1c]
mov ecx, dword [0xa9b83c]
cmp byte [eax + 0xd], 0
jne 0x4c7b78
cmp esi, dword [eax + 0x10]
jge 0x4c7b7a
mov eax, ecx
cmp eax, ecx
jne 0x4c7b95
push esi
push str.Could_not_find_message__d_
push 0xa9b7bc
call ebx
add esp, 0xc
mov eax, 0xa9b7bc
jmp 0x4c7b98
add eax, 0x18
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb90558
call fcn.004cdd70
add esp, 0x20
push 1
lea eax, [edi + 0xad163c]
mov ecx, 0xad1638
push eax
call fcn.004c7ca0
jmp 0x4c7c6d
test eax, eax
jg 0x4c7c6d
mov esi, dword [edi + 0xad1650]
cmp esi, 0xffffffff
je 0x4c7c3c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
lea eax, [ebp - 0x30]
mov ecx, 0xa9b83c
push eax
call fcn.00405650
mov eax, dword [ebp - 0x28]
cmp byte [eax + 0xd], 0
jne 0x4c7c0d
cmp esi, dword [eax + 0x10]
jl 0x4c7c0d
cmp eax, dword [0xa9b83c]
je 0x4c7c0d
add eax, 0x18
jmp 0x4c7c22
push esi
push str.Could_not_find_message__d_
push 0xa9b7bc
call ebx
add esp, 0xc
mov eax, 0xa9b7bc
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb90558
call fcn.004cdd70
add esp, 0x20
mov eax, dword [edi + 0xad165c]
push 0
mov dword [edi + 0xad1640], 2
mov dword [edi + 0xad1644], eax
call fcn.0052d9f5
mov ecx, dword [edi + 0xad1644]
add esp, 4
add ecx, eax
mov dword [ebp - 0x14], edx
mov dword [edi + 0xad1648], ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add edi, 0x3c
cmp edi, 0x1770
jl 0x4c7ad6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4caf50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0xb90508]
cmp eax, 0x3e8
jb 0x4cb110
call esi
push 0
mov dword [0xb90508], eax
call fcn.0052d9f5
add esp, 4
mov esi, eax
mov eax, dword [0xb90504]
push edx
cdq
push esi
push edx
push eax
call fcn.0052d9b0
mov eax, dword [0xb904fc]
add esp, 0x10
cmp dword [0xbdaf18], 0
fstp qword [ebp - 8]
cvttsd2si ecx, qword [ebp - 8]
mov dword [0xb90500], ecx
jne 0x4cafc6
cmp dword [0xbd8f10], 0xffffffff
je 0x4cafe6
mov dword [0xbd8f10], 0xffffffff
jmp 0x4cafe6
cmp eax, 1
jne 0x4cafd3
mov dword [0xbd8f10], ecx
jmp 0x4cafe6
cmp dword [0xbd8f10], 0
je 0x4cafe6
mov dword [0xbd8f10], 0
sub eax, 0
je 0x4cb110
sub eax, 1
je 0x4cb08d
sub eax, 1
jne 0x4cb110
test ecx, ecx
jg 0x4cb110
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xd1
push eax
lea eax, [ebp - 0x14]
mov ecx, 0xa9b83c
push eax
call fcn.00405650
mov eax, dword [ebp - 0xc]
mov ecx, dword [0xa9b83c]
cmp byte [eax + 0xd], 0
jne 0x4cb03a
cmp dword [eax + 0x10], 0xd1
jle 0x4cb03c
mov eax, ecx
cmp eax, ecx
jne 0x4cb05f
push 0xd1
push str.Could_not_find_message__d_
push 0xa9b7bc
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, 0xa9b7bc
jmp 0x4cb062
add eax, 0x18
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb90558
call fcn.004cdd70
add esp, 0x20
mov ecx, 0xb904f8
push 1
call fcn.004cb120
pop esi
mov esp, ebp
pop ebp
ret
test ecx, ecx
jg 0x4cb110
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xd0
push eax
lea eax, [ebp - 0x14]
mov ecx, 0xa9b83c
push eax
call fcn.00405650
mov eax, dword [ebp - 0xc]
mov ecx, dword [0xa9b83c]
cmp byte [eax + 0xd], 0
jne 0x4cb0c2
cmp dword [eax + 0x10], 0xd0
jle 0x4cb0c4
mov eax, ecx
cmp eax, ecx
jne 0x4cb0e7
push 0xd0
push str.Could_not_find_message__d_
push 0xa9b7bc
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, 0xa9b7bc
jmp 0x4cb0ea
add eax, 0x18
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0xb90558
call fcn.004cdd70
add esp, 0x20
mov ecx, 0xb904f8
push 2
call fcn.004cb120
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d2bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x57a040]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov edx, 0xcd73b0
mov dword [esp + 0xc], 0xffff
push edi
xor edi, edi
mov dword [esp + 0xc], edx
nop word [eax + eax]
test edi, edi
js 0x4d2db6
cmp edi, 0x1194
jge 0x4d2db6
mov ecx, dword [edi*4 + 0x20a514c]
cmp dword [ecx + 4], 3
jne 0x4d2db6
movzx eax, word [ecx + 0x78]
cmp eax, 2
je 0x4d2d25
cmp eax, 3
je 0x4d2d25
mov ecx, edx
call fcn.00465220
mov esi, dword [edi*4 + 0x20a514c]
cmp byte [esi + 0x5e1], 0
je 0x4d2d06
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [esi + 0x5e4]
cmp eax, 0x1f4
jb 0x4d2d06
call ebx
mov dl, byte [esi + 0x5e2]
inc dl
mov dword [esi + 0x5e4], eax
mov byte [esi + 0x5e2], dl
cmp dl, 0xc
jne 0x4d2cc1
mov eax, dword [esi + 0x324]
xor ecx, ecx
add eax, 6
nop word [eax + eax]
movzx edx, word [eax + 2]
lea ebx, [eax - 6]
cmp dx, word [esp + 0x10]
je 0x4d2c99
cmp edx, 0x28
je 0x4d2ca4
cmp word [eax], 0x28
je 0x4d2ca4
inc ecx
add eax, 0x14
cmp ecx, 0x3c
jl 0x4d2c80
jmp 0x4d2d06
test ebx, ebx
je 0x4d2d06
push 0
push 0
push 0
push 0
push ebx
push 0
push dword [esi]
mov ecx, 0xbf0bd0
call fcn.005090b0
jmp 0x4d2d06
mov ecx, dword [esi]
mov eax, ecx
shr eax, 8
mov byte [esp + 0x17], al
lea eax, [esp + 0x14]
push 7
push eax
push ecx
mov word [esp + 0x20], 0x7c1
mov byte [esp + 0x22], 0xba
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], 0x28
mov byte [esp + 0x26], dl
call fcn.005192f0
movzx eax, byte [esp + 0x15]
lea edx, [esp + 0x14]
push eax
mov ecx, esi
call fcn.005264a0
add esp, 4
push dword [edi*4 + 0x20a514c]
call fcn.004d1710
push dword [edi*4 + 0x20a514c]
mov ecx, 0x637470
call fcn.00448d10
jmp 0x4d2d33
cmp dword [ecx + 0xe40], 0
jne 0x4d2d33
call fcn.004be930
xor esi, esi
nop word [eax + eax]
mov eax, dword [edi*4 + 0x20addfc]
mov ebx, dword [esi + eax + 4]
cmp dword [ebx], 0xffffffff
je 0x4d2daa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebx + 8]
jbe 0x4d2daa
mov eax, dword [edi*4 + 0x20addfc]
mov eax, dword [esi + eax + 4]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 4]
push dword [eax]
push dword [edi*4 + 0x20a514c]
call fcn.004d24e0
mov eax, dword [edi*4 + 0x20addfc]
mov eax, dword [esi + eax + 4]
mov dword [eax], 0xffffffff
mov dword [eax + 4], 0xffffffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
add esi, 4
cmp esi, 0x78
jl 0x4d2d40
mov edx, dword [esp + 0xc]
add edx, 0x28
inc edi
mov dword [esp + 0xc], edx
cmp edx, 0xd032d0
jl 0x4d2be0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret
Function at 0x4d8270
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0xc
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
test eax, eax
js 0x4d83cf
cmp eax, 0xcc
jge 0x4d83cf
test ecx, ecx
js 0x4d83cf
cmp ecx, 0xcc
jge 0x4d83cf
mov ebx, dword [ebp + 8]
imul eax, eax, 0x10c
mov edx, dword [ebx + 0x390]
movzx eax, word [eax + edx + 4]
mov esi, eax
test ax, ax
js 0x4d83cf
mov eax, 0x2000
cmp si, ax
jge 0x4d83cf
imul edi, ecx, 0x10c
add edi, edx
movzx edx, word [edi + 4]
mov eax, edx
test dx, dx
js 0x4d83cf
mov ecx, 0x2000
cmp ax, cx
jge 0x4d83cf
cmp byte [edi + 0xba], 0
jne 0x4d83cf
mov eax, 0x80f
cmp dx, ax
je 0x4d83cf
mov eax, 0x807
cmp dx, ax
je 0x4d83cf
xor esi, esi
mov ecx, 0x638708
nop dword [eax + eax]
cmp esi, 0x1f3
ja 0x4d8344
cmp dword [ecx], esi
jne 0x4d8344
movsx eax, dx
cmp dword [ecx + 4], eax
je 0x4d8352
add ecx, 8
inc esi
cmp ecx, 0x6396a8
jl 0x4d8330
jmp 0x4d835b
cmp dword [0x638700], 1
je 0x4d83cf
mov eax, 0x1806
cmp dx, ax
jle 0x4d83da
mov eax, 0x1824
cmp dx, ax
jl 0x4d8379
mov eax, 0x182b
cmp dx, ax
jle 0x4d83da
mov eax, 0x1831
cmp dx, ax
je 0x4d83da
mov eax, 0x1832
cmp dx, ax
je 0x4d83da
mov eax, 0x1906
cmp dx, ax
jl 0x4d83a1
mov eax, 0x1909
cmp dx, ax
jle 0x4d83da
mov eax, 0x1a1e
cmp dx, ax
je 0x4d83da
xor esi, esi
mov ecx, 0x63d1e4
cmp esi, 0x63
ja 0x4d83c3
cmp dword [ecx], esi
jne 0x4d83c3
movsx eax, dx
cmp dword [ecx + 4], eax
je 0x4d83da
add ecx, 0x78
inc esi
cmp ecx, 0x6400c4
jl 0x4d83b2
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp word [edi + 6], 9
jge 0x4d83cf
cmp byte [edi + 0x9d], 0
mov eax, dword [ebx + 0x644]
mov esi, dword [eax*4 + 0xbdad6c]
je 0x4d83fe
add esi, dword [eax*4 + 0xbdadbc]
call fcn.00526930
cdq
mov ecx, 0x64
idiv ecx
movzx eax, word [edi + 6]
cmp edx, esi
jge 0x4d8416
inc eax
jmp 0x4d842b
cmp ax, 7
jl 0x4d8422
xor eax, eax
xor ecx, ecx
jmp 0x4d842e
mov ecx, eax
cmp ax, 1
jl 0x4d8432
dec eax
movzx ecx, ax
mov word [edi + 6], ax
mov al, byte [edi + 0xb6]
movzx edx, word [edi + 4]
test al, 3
mov dword [esp + 0x14], eax
mov eax, 0
setne al
mov dword [esp + 0x10], eax
mov eax, 0x1a03
cmp dx, ax
je 0x4d8474
mov eax, 0x1a25
cmp dx, ax
je 0x4d8474
cmp byte [edi + 0x9f], 0
mov ebx, edi
je 0x4d8476
mov eax, 1
jmp 0x4d8478
mov ebx, edi
xor eax, eax
push dword [esp + 0x10]
movsx esi, dx
push eax
movsx eax, cx
push eax
push esi
call fcn.0049cad0
mov ecx, edi
movd xmm0, eax
movzx eax, byte [edi + 0xd8]
cvtdq2ps xmm0, xmm0
push eax
lea eax, [edi + 0xd3]
push eax
movzx eax, byte [edi + 0xd2]
push eax
mulss xmm0, dword [edi + 0x20]
movzx eax, byte [edi + 0xcc]
push eax
push dword [esp + 0x24]
divss xmm0, dword [edi + 0x24]
mov eax, 0x9f
movzx eax, byte [eax + ebx]
push eax
movzx eax, byte [edi + 0x9e]
push eax
movzx eax, byte [edi + 0x9d]
push eax
movzx eax, byte [edi + 0x9c]
push eax
push esi
movss dword [edi + 0x20], xmm0
call fcn.00493d40
mov eax, dword [ebp + 8]
mov ecx, 0x6509a4
push dword [eax]
call fcn.004d6bf0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4de920
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x57a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4de967
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x18]
push 0
push eax
push 6
lea eax, [ebp - 0x20]
push eax
push edi
call ebx
mov eax, 0x1112
cmp word [ebp - 0x20], ax
jne 0x4dea80
cmp dword [ebp - 0x1e], 0x36
jne 0x4dea80
cmp byte [ebp + 0x10], 0
mov eax, 0xb9426c
push esi
push 0
mov esi, 0xb9429c
cmove esi, eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
xor eax, dword [0xb942cc]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [0xb942d0]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [0xb942d4]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
xor eax, dword [0xb942d8]
push 0
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
xor eax, dword [0xb942cc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [0xb942d0]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [0xb942d4]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
xor eax, dword [0xb942d8]
push 0
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x14]
xor eax, dword [0xb942cc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [0xb942d0]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [0xb942d4]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
xor eax, dword [0xb942d8]
push edi
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop ebx
xor ecx, ebp
pop edi
call fcn.00529f01
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e1e50
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x744
mov eax, dword [0x57a040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebx + 0xc]
push edi
mov dword [ebp - 0x728], edx
mov byte [ebp - 0x721], cl
mov dword [ebp - 0x718], esi
jmp 0x4e1e9d
mov edx, dword [ebp - 0x718]
mov edi, dword [ebp - 0x728]
mov eax, dword [edx*4 + 0x20a514c]
lea ecx, [edi + 4]
mov dword [ebp - 0x72c], ecx
lea esi, [edi + 3]
cmp word [eax + 0x78], 1
jne 0x4e1f10
cmp byte [edi], 0xc1
jne 0x4e1ecc
mov al, byte [esi]
jmp 0x4e1ed4
mov al, byte [ecx]
mov dword [ebp - 0x72c], ecx
push dword [ebx + 0x14]
mov ah, byte [ebp - 0x721]
push dword [ebx + 0x10]
movzx ecx, ah
movzx eax, al
push eax
push ecx
push edx
mov dword [ebp - 0x720], ecx
call fcn.004893e0
test al, al
je 0x4e6a00
mov edx, dword [ebp - 0x718]
mov ecx, dword [ebp - 0x72c]
mov eax, dword [ebp - 0x720]
jmp 0x4e1f1d
movzx eax, byte [ebp - 0x721]
mov dword [ebp - 0x72c], ecx
movzx eax, byte [eax + 0x4e6bb4]
jmp dword [eax*4 + 0x4e6a14]
mov ecx, edi
call fcn.004e70c0
jmp 0x4e69f0
mov ecx, edi
call fcn.004e7620
jmp 0x4e69f0
jmp 0x4e6a00
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00529f01
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4e79a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x10], ecx
mov esi, dword [edi*4 + 0x20a514c]
mov eax, dword [esi + 4]
cmp eax, 2
je 0x4e79ca
cmp eax, 3
jne 0x4e7abe
cmp dword [0xbda888], 0
je 0x4e7a4f
mov eax, dword [esi + 0x58]
mov ebx, dword [ecx + 4]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0xc]
sub ecx, dword [esi + 0x5c]
sub ecx, ebx
add eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [0xbda88c]
jle 0x4e7a4b
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
sub eax, dword [esi + 0x5c]
sub ebx, dword [esp + 0xc]
push ebx
push eax
lea eax, [esi + 0x86]
push eax
lea eax, [esi + 0x7b]
push eax
push str.__s___s__Client_Latency_Hack_Detected___d___d_
push 5
push 0x9f30a0
call fcn.004b2600
add esp, 0x1c
mov dword [esp + 0x10], 0x2f105c3
lea eax, [esp + 0x10]
mov byte [esp + 0x14], 0
push 5
push eax
push edi
call fcn.005192f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
cmp dword [esi + 4], 3
jne 0x4e7ab4
cmp dword [0xbda880], 0
je 0x4e7ab4
movzx ecx, word [ecx + 8]
mov ebx, dword [esi + 0x2f8]
cmp ecx, ebx
jle 0x4e7a91
mov eax, ebx
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [0xbda884]
jle 0x4e7a91
push ecx
push ebx
lea eax, [esi + 0x86]
push eax
lea eax, [esi + 0x7b]
push eax
push str.__s___s__Client_Speed_Hack_Detected___d___d_
jmp 0x4e7a1b
mov eax, dword [esp + 0x10]
mov ebx, dword [esi + 0x2fc]
movzx ecx, word [eax + 0xa]
cmp ecx, ebx
jle 0x4e7ab4
mov eax, ebx
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, dword [0xbda884]
jg 0x4e7a7d
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [esi + 0x54], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e90d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x57a040]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov esi, dword [edi*4 + 0x20a514c]
test edi, edi
js 0x4e928f
cmp edi, 0x1194
jge 0x4e928f
cmp dword [esi + 4], 3
jne 0x4e928f
movzx eax, word [esi + 0x78]
cmp eax, 1
je 0x4e9122
cmp eax, 6
jne 0x4e928f
cmp byte [esi + 0xa], 0
jg 0x4e928f
cmp byte [esi + 0x9c0], 0
jne 0x4e928f
movzx eax, byte [ebx + 4]
push 1
push eax
push esi
mov dword [esp + 0x1c], 0x6f334c1
mov byte [esp + 0x20], 0
call fcn.004d68e0
test al, al
je 0x4e9282
mov al, byte [ebx + 4]
add al, 0x10
mov byte [esp + 0x14], al
movzx eax, byte [ebx + 4]
mov ebx, 0xfde8
sub eax, 2
je 0x4e918c
sub eax, 1
jne 0x4e91b8
movd xmm0, dword [esi + 0x150]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [esi + 0x10c]
jmp 0x4e919f
movd xmm0, dword [esi + 0x14c]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [esi + 0x100]
comiss xmm0, dword [0x56a824]
jbe 0x4e91af
mov word [esp + 0x16], bx
jmp 0x4e91b8
cvttss2si eax, xmm0
mov word [esp + 0x16], ax
mov eax, dword [esi + 0x130]
mov ecx, dword [esi + 0x12c]
lea edx, [ecx + eax]
mov dword [esp + 0xc], edx
cmp edx, ebx
jle 0x4e91d6
mov word [esp + 0x1a], bx
jmp 0x4e91dd
add eax, ecx
mov word [esp + 0x1a], ax
mov eax, dword [esi + 0x15c]
mov ecx, dword [esi + 0x158]
lea ebx, [ecx + eax]
cmp ebx, 0xfde8
jle 0x4e91fb
mov eax, 0xfde8
jmp 0x4e91fd
add eax, ecx
movd xmm0, dword [esi + 0x14c]
cvtdq2ps xmm0, xmm0
mov word [esp + 0x18], ax
mov eax, dword [esi + 0xd4]
mov dword [esp + 0x1c], eax
addss xmm0, dword [esi + 0x100]
call fcn.00545fb0
movd xmm0, dword [esi + 0x150]
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x20], eax
addss xmm0, dword [esi + 0x10c]
call fcn.00545fb0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xe8]
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0xec]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0xf0]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0xf4]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0xf8]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x40], eax
push 0x34
lea eax, [esp + 0x14]
push eax
push edi
call fcn.005192f0
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret

Function at 0x4e9ab0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0x1f105c1
mov byte [ebp - 4], dl
push esi
mov esi, 5
cmp ebx, 0xffffffff
je 0x4e9b0d
push edi
mov edx, esi
lea ecx, [ebp - 8]
call fcn.00488db0
xor edi, edi
nop dword [eax]
push 0
push esi
lea eax, [ebp - 8]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4e9b04
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4e9b0c
jmp 0x4e9b08
add edi, eax
sub esi, eax
test esi, esi
jne 0x4e9ae0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret