joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486d20
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
mov ecx, dword [ebx + 0xd14]
mov edx, dword [ecx + 0x144]
xor eax, eax
cmp dword [edx + 0x24], eax
mov dword [esp], eax
jle 0x486e39
push ebp
push esi
mov dword [esp + 0xc], eax
push edi
mov eax, dword [esp + 0xc]
push eax
mov esi, ebx
call fcn.00485e20
mov edx, dword [ebx + 0xd14]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea ebp, [ebx + ecx*4]
mov ecx, dword [edx + 0x144]
mov edx, dword [esp + 0x10]
lea esi, [ecx + edx + 0x28]
mov edx, dword [ebp + 0xd8]
mov edi, eax
call fcn.00489b50
cmp byte [ebp + 0xd0], 0
je 0x486e11
mov eax, dword [ebp + 0xd4]
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x34]
cmp eax, 0x3c
je 0x486de2
cmp eax, 0x3d
je 0x486de2
cmp eax, 0x3e
je 0x486de2
cmp eax, 0x3f
je 0x486de2
cmp eax, 0x40
je 0x486de2
cmp eax, 0x41
je 0x486de2
cmp eax, 0x42
je 0x486de2
cmp eax, 0x43
je 0x486de2
cmp eax, 0x44
je 0x486de2
cmp eax, 0x45
je 0x486de2
cmp eax, 0x46
je 0x486de2
cmp eax, 0x47
je 0x486de2
cmp eax, 0x48
je 0x486de2
cmp eax, 0x49
je 0x486de2
cmp eax, 0x4a
jne 0x486de6
xor eax, eax
jmp 0x486e06
cmp eax, 0x30
jne 0x486dfc
cmp ecx, 0xffffffff
je 0x486dfc
lea ecx, [ecx + ecx*8]
mov eax, dword [ecx*4 + 0x69f2c4]
jmp 0x486e06
lea edx, [eax + eax*8]
mov eax, dword [edx*4 + 0x69f2c4]
mov dword [esi + 0x28], eax
mov byte [esi + 0x49], 1
mov byte [esi + 0x48], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [ebx + 0xd14]
mov edx, dword [ecx + 0x144]
add dword [esp + 0x10], 0x50
add eax, 1
cmp eax, dword [edx + 0x24]
mov dword [esp + 0xc], eax
jl 0x486d44
pop edi
pop esi
pop ebp
mov eax, dword [ebx + 0xd14]
mov eax, dword [eax + 0x15c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x774]
mov byte [edx + 0x55], 0
mov ecx, dword [eax + 0x20]
mov edx, dword [0x6aa230]
lea ecx, [ecx + edx + 0xa]
mov edx, dword [eax]
mov byte [eax + 0x2c], 0
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0x320]
mov edx, dword [ecx]
mov eax, dword [eax + 4]
mov edx, dword [edx + 0x20]
push eax
call edx
add esp, 8
ret
Function at 0x48d4b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x647abb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x40]
push edi
call fcn.005396f0
xor ebx, ebx
mov dword [esp + 0x38], ebx
fldz
mov eax, dword [esp + 0x44]
mov dword [edi + 0x88], vtable.Sexy::ButtonListener.0
fst dword [edi + 0x90]
fld dword [0x679744]
lea ebp, [edi + 0x88]
fstp dword [edi + 0x94]
push 0x12
fld dword [0x67953c]
push str.DisplayPartnerLogo
fstp dword [edi + 0x98]
lea ecx, [esp + 0x1c]
mov dword [edi], 0x66dd90
fst dword [edi + 0x9c]
mov dword [ebp], method.Sexy::ButtonListener.virtual_0
fstp dword [edi + 0xb0]
mov dword [edi + 0xc4], eax
mov dword [edi + 0xa4], ebx
mov byte [edi + 0xac], bl
mov byte [edi + 0xa0], bl
mov byte [edi + 0xad], bl
mov byte [edi + 0xa1], bl
mov byte [edi + 0xae], bl
mov byte [edi + 0xaf], 1
mov dword [edi + 0xa8], ebx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00404330
mov byte [esp + 0x38], 1
mov eax, dword [edi + 0xc4]
push ebx
lea ecx, [esp + 0x18]
call fcn.00552840
mov byte [esp + 0x38], bl
cmp dword [esp + 0x2c], 0x10
mov byte [edi + 0xc0], al
jb 0x48d5b3
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0061c19a
add esp, 4
push 0x148
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xbc], ebx
mov dword [edi + 0xb8], ebx
mov byte [edi + 0xc1], bl
call fcn.0061c130
mov esi, eax
add esp, 4
mov dword [esp + 0x44], esi
cmp esi, ebx
mov byte [esp + 0x38], 2
je 0x48d5f2
mov eax, ebp
call fcn.0053c9e0
mov esi, eax
jmp 0x48d5f4
xor esi, esi
mov edx, 0xb8
push 0x21
lea ecx, [edx + 0x22]
lea eax, [esp + 0x18]
mov dword [edi + 0x8c], esi
call fcn.005643d0
mov edx, dword [eax]
mov dword [esi + 0x120], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0x124], ecx
mov edx, dword [eax + 8]
mov dword [esi + 0x128], edx
mov eax, dword [eax + 0xc]
mov dword [esi + 0x12c], eax
push 0xf
mov edx, 0x5a
mov ecx, 0xfa
lea eax, [esp + 0x18]
call fcn.005643d0
mov ecx, dword [edi + 0x8c]
mov edx, dword [eax]
mov dword [ecx + 0x130], edx
mov edx, dword [eax + 4]
mov dword [ecx + 0x134], edx
mov edx, dword [eax + 8]
add ecx, 0x130
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [edi + 0x8c]
mov dword [ecx + 0x140], ebx
mov edx, dword [edi + 0x8c]
mov ecx, dword [esp + 0x30]
mov byte [edx + 0x56], 1
mov eax, dword [edi + 0x8c]
mov byte [eax + 0x54], bl
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 8
Function at 0x518d60
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x100
cmp dword [0x6a9f18], 0
jne 0x518dc1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0061d4e6
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x6a9f18], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x6a9f1c], eax
mov eax, dword [eax]
add esp, 0x100
ret
mov edx, dword [0x6a9f1c]
mov eax, dword [edx]
add esp, 0x100
ret

Function at 0x519240
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.00518dd0
mov esi, eax
test esi, esi
jne 0x519258
xor al, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.00518d60
test eax, eax
push 2
push 0
je 0x519276
mov eax, dword [0x6a9f1c]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push esi
call eax
jmp 0x519282
mov ecx, dword [esi + 8]
push ecx
call fcn.0061d72b
add esp, 0xc
call fcn.00518d60
test eax, eax
je 0x51929d
mov edx, dword [0x6a9f1c]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push esi
call edx
jmp 0x5192a9
mov eax, dword [esi + 8]
push eax
call fcn.0061d948
add esp, 4
mov edi, eax
call fcn.00518d60
test eax, eax
push 0
push 0
je 0x5192ca
mov ecx, dword [0x6a9f1c]
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push esi
call eax
jmp 0x5192d6
mov ecx, dword [esi + 8]
push ecx
call fcn.0061d72b
add esp, 0xc
lea edx, [edi + 1]
push edx
call fcn.0060ae9b
add esp, 4
test edi, edi
mov ebp, eax
mov bl, 1
jle 0x519331
call fcn.00518d60
test eax, eax
je 0x519308
mov eax, dword [0x6a9f1c]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push esi
push edi
push 1
push ebp
call eax
jmp 0x519318
mov ecx, dword [esi + 8]
push ecx
push edi
push 1
push ebp
call fcn.0061d24e
add esp, 0x10
test eax, eax
jg 0x51931e
xor bl, bl
test bl, bl
mov byte [eax + ebp], 0
je 0x519331
push ebp
call fcn.00519080
add esp, 4
mov bl, al
call fcn.00518d60
test eax, eax
je 0x51935b
mov edx, dword [0x6a9f1c]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
push esi
call edx
push ebp
call fcn.0061c19f
add esp, 4
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 8]
push eax
call fcn.0061cf36
add esp, 4
push esi
call fcn.0061c19a
add esp, 4
push ebp
call fcn.0061c19f
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret
Function at 0x51b830
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x64d8b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push ecx
push str.Load_Trail__s
lea eax, [esp + 0x34]
call fcn.0044f400
add esp, 8
xor ebx, ebx
mov dword [esp + 0x140], ebx
mov eax, ecx
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x51b880
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00404330
push edi
lea eax, [esp + 0x14]
push 0x69d98c
push eax
mov byte [esp + 0x14c], 1
call fcn.004447f0
add esp, 0xc
test al, al
sete byte [esp + 0xf]
mov byte [esp + 0x140], bl
cmp dword [esp + 0x28], 0x10
jb 0x51b8d3
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0061c19a
add esp, 4
cmp byte [esp + 0xf], bl
je 0x51b8f2
xor al, al
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x13c
ret
fld1
push ecx
lea esi, [edi + 0x18]
fstp dword [esp]
call fcn.004449f0
fld1
lea esi, [edi + 0x20]
fstp dword [esp]
call fcn.004449f0
fld dword [0x679498]
lea esi, [edi + 0x10]
fstp dword [esp]
call fcn.004449f0
fld1
lea esi, [edi + 0x28]
fstp dword [esp]
call fcn.004449f0
fld1
lea esi, [edi + 0x30]
fstp dword [esp]
call fcn.004449f0
mov ecx, dword [esp + 0x13c]
add esp, 4
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x13c
ret
Function at 0x51c470
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x642183
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, 0xf
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x14], eax
mov byte [ebx + 4], al
mov dword [esp + 0xc], eax
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x30], eax
mov byte [ebx + 0x20], al
mov byte [esp + 0xc], 1
call fcn.0051c4d0
mov ecx, dword [esp + 4]
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x522580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x6c], eax
mov eax, 0x28
mov dword [edi + 0x1c], esi
call fcn.005af400
jmp loc.0079feac

Function at 0x525be0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [edi]
sub esp, 8
cmp dword [eax + 0x7f8], 0x2c
push esi
jne 0x525c2f
fld dword [0x67a130]
fcomp dword [edi + 0x2c]
fnstsw ax
test ah, 0x41
jne 0x525c2f
fld dword [edi + 0x84]
fsub qword [0x679a68]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [edi + 0x84]
fcomp dword [0x679f64]
fnstsw ax
test ah, 5
jp 0x525c2f
push 0
mov eax, edi
call fcn.00525b60
cmp dword [edi + 0x28], 0x4a
jne 0x525c6a
mov ecx, dword [edi]
mov edx, dword [ecx + 0x820]
mov eax, dword [edi + 0x118]
mov ecx, dword [edx + 8]
and eax, 0xffff
lea edx, [eax + eax*4]
mov eax, dword [ecx]
shl edx, 5
cmp dword [eax + edx + 0x5c], 0
jle 0x525c6a
xor esi, esi
mov eax, edi
mov dword [edi + 0x28], 0x4b
call fcn.0052f2e0
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x525cd1
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x525cad
cmp eax, 0x3e
je 0x525cad
cmp eax, 0x3f
je 0x525cad
cmp eax, 0x40
je 0x525cad
cmp eax, 0x41
je 0x525cad
cmp eax, 0x42
je 0x525cad
cmp eax, 0x43
je 0x525cad
cmp eax, 0x44
je 0x525cad
cmp eax, 0x45
je 0x525cad
cmp eax, 0x46
jne 0x525cd1
cmp dword [edi + 0x28], 0x49
jne 0x525cd1
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 0x160]
push edx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x525cd1
push 0
mov eax, edi
call fcn.00525b60
pop esi
add esp, 8
ret
Function at 0x52b340
Capabilities:
Check http status code

Disassembly:
mov eax, dword [edi + 4]
sub esp, 8
add dword [edi + 0x3c], 0xffffffff
mov eax, dword [eax + 0xa0]
push esi
jne 0x52b415
call fcn.005af400
test eax, eax
jne 0x52b415
cmp byte [edi + 0xba], al
je 0x52b415
cmp dword [edi + 0x24], 0x19
je 0x52b415
mov eax, dword [edi + 4]
call fcn.00413a40
test al, al
jne 0x52b415
fldz
mov ecx, dword [edi]
fstp dword [esp + 8]
call fcn.004538c0
test al, al
je 0x52b3bd
fld dword [0x679800]
sub esp, 8
fstp dword [esp + 4]
fld dword [0x67959c]
fstp dword [esp]
call fcn.00511cb0
fstp dword [esp + 0x10]
add esp, 8
cmp dword [edi + 0x24], 0x17
jne 0x52b3d1
mov eax, dword [edi]
mov esi, 0x46
call fcn.00453630
jmp 0x52b403
cmp byte [edi + 0x50], 0
je 0x52b3e1
push ecx
mov ecx, dword [edi]
mov eax, 0xc
jmp 0x52b3f7
mov ecx, dword [edi]
cmp byte [ecx + 0x8be], 0
push ecx
mov eax, 0xd
jne 0x52b3f7
mov eax, 0xb
fld dword [esp + 0xc]
fstp dword [esp]
call fcn.00453650
mov eax, 0x3e8
call fcn.005af400
add eax, 0x1f4
mov dword [edi + 0x3c], eax
mov eax, dword [edi + 0xb4]
test eax, eax
jle 0x52b43e
add eax, 0xffffffff
mov dword [edi + 0xb4], eax
jne 0x52b43e
mov eax, edi
call fcn.00532350
push 0x3a
push 0x6a
push 0x4b
mov eax, edi
call fcn.005321f0
mov eax, dword [edi + 0xac]
test eax, eax
jle 0x52b45a
add eax, 0xffffffff
mov dword [edi + 0xac], eax
jne 0x52b45a
mov esi, edi
call fcn.0052f050
mov eax, dword [edi + 0xb0]
test eax, eax
jle 0x52b476
add eax, 0xffffffff
mov dword [edi + 0xb0], eax
jne 0x52b476
mov eax, edi
call fcn.00532570
cmp dword [edi + 0x28], 0xe
jne 0x52b488
mov esi, edi
call fcn.00528ec0
pop esi
add esp, 8
ret
cmp dword [edi + 0xb4], 0
jg 0x52b4c3
cmp dword [edi + 0xb0], 0
jg 0x52b4c3
mov eax, edi
call fcn.0052b110
mov eax, edi
call fcn.0052ad30
mov eax, edi
call fcn.0052f4c0
push edi
call fcn.0052f870
mov esi, edi
call fcn.0052fa20
mov eax, edi
call fcn.0052b280
cmp dword [edi + 0x24], 0x19
jne 0x52b4d0
mov eax, edi
call fcn.00536080
cmp byte [edi + 0xec], 0
jne 0x52b551
mov eax, dword [edi + 0x28]
cmp eax, 1
je 0x52b551
cmp eax, 2
je 0x52b551
cmp eax, 3
je 0x52b551
cmp dword [edi + 0x6c], 0xfffffffc
je 0x52b551
cmp byte [edi + 0xba], 0
mov eax, dword [edi + 0x24]
sete cl
cmp eax, 0xc
je 0x52b508
cmp eax, 0x16
jne 0x52b514
cmp dword [edi + 0xc8], 0xc8
jl 0x52b518
test cl, cl
je 0x52b551
cmp eax, 0x13
mov esi, 1
jne 0x52b525
lea esi, [eax - 9]
cmp dword [edi + 0xcc], 0x1f4
jl 0x52b536
mov esi, 3
mov eax, 5
call fcn.005af400
test eax, eax
jne 0x52b551
push esi
mov eax, 9
mov esi, edi
call fcn.005317c0
pop esi
add esp, 8
ret
Function at 0x52edb0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [esp + 0x10]
call fcn.00532140
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0xc], 0
jmp 0x52ede0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
lea esi, [esp + 0xc]
call fcn.0041c950
test al, al
je 0x52ee7c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov esi, dword [esp + 0xc]
cmp edx, dword [esi + 0x1c]
jne 0x52ede0
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.00467ef0
mov ecx, dword [esp + 0x10]
cmp edi, ecx
jge 0x52ee24
mov edx, dword [esp + 0x18]
lea eax, [ebx + edi]
add edx, ecx
jmp 0x52ee2f
mov eax, dword [esp + 0x18]
add eax, ecx
mov ecx, edi
lea edx, [ebx + edi]
cmp eax, ecx
jg 0x52ee37
sub eax, ecx
jmp 0x52ee43
cmp eax, edx
jg 0x52ee3f
sub eax, ecx
jmp 0x52ee43
sub edx, ecx
mov eax, edx
cmp eax, 0x14
jl 0x52ede0
mov ecx, dword [ebp + 8]
push 1
push esi
call fcn.0052e4c0
test al, al
je 0x52ede0
mov eax, dword [esi + 0x24]
cmp eax, 0x15
je 0x52ede0
cmp eax, 0x2e
je 0x52ede0
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov edi, dword [ebp + 8]
push 1
push ecx
push edx
call fcn.0052e920
jmp 0x52ee7f
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x52eee6
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x52eec2
cmp eax, 0x3e
je 0x52eec2
cmp eax, 0x3f
je 0x52eec2
cmp eax, 0x40
je 0x52eec2
cmp eax, 0x41
je 0x52eec2
cmp eax, 0x42
je 0x52eec2
cmp eax, 0x43
je 0x52eec2
cmp eax, 0x44
je 0x52eec2
cmp eax, 0x45
je 0x52eec2
cmp eax, 0x46
jne 0x52eee6
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x160]
push ecx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x52eee6
mov edx, dword [edi + 4]
mov ecx, dword [edx + 0x160]
push ecx
call fcn.0042ba30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x530480
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, eax
call fcn.00530410
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x128]
add ecx, 0xac
test edx, edx
je 0x5304c3
movzx eax, dx
cmp eax, dword [ecx + 8]
jae 0x5304c3
imul eax, eax, 0x14c
add eax, dword [ecx]
cmp dword [eax + 0x148], edx
jne 0x5304c3
mov ecx, dword [esi + 4]
add dword [ecx + 0x5798], 1
push eax
call fcn.004679b0
mov edx, dword [esi + 0xf0]
mov esi, dword [esi + 4]
add esi, 0x90
test edx, edx
je 0x5304ff
movzx eax, dx
cmp eax, dword [esi + 8]
jae 0x5304ff
imul eax, eax, 0x15c
add eax, dword [esi]
cmp dword [eax + 0x158], edx
jne 0x5304ff
cmp byte [eax + 0xec], 0
jne 0x5304ff
mov ecx, eax
pop esi
jmp fcn.00530510
pop esi
ret
Function at 0x530510
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push edi
mov edi, ecx
push edi
call fcn.00530850
mov ecx, dword [edi + 0x110]
test ecx, ecx
je 0x53056b
mov eax, dword [0x6a9eb8]
mov edx, dword [eax + 0xc]
movzx eax, cx
cmp eax, dword [edx + 8]
jb 0x53053e
xor ecx, ecx
jmp 0x530558
imul eax, eax, 0x30c
add eax, dword [edx]
xor edx, edx
cmp dword [eax + 0x308], ecx
setne dl
sub edx, 1
and edx, eax
mov ecx, edx
test ecx, ecx
mov dword [edi + 0x110], 0
je 0x53056b
call fcn.00404fc0
mov ecx, dword [edi]
mov eax, dword [edi + 0x118]
test eax, eax
mov edx, dword [ecx + 0x820]
mov edx, dword [edx + 8]
je 0x53059d
movzx ecx, ax
cmp ecx, dword [edx + 8]
jae 0x53059d
lea ecx, [ecx + ecx*4]
shl ecx, 5
add ecx, dword [edx]
cmp dword [ecx + 0x9c], eax
jne 0x53059d
call fcn.004733f0
mov ecx, dword [edi]
mov eax, dword [edi + 0x150]
test eax, eax
mov edx, dword [ecx + 0x820]
mov edx, dword [edx + 8]
je 0x5305cf
movzx ecx, ax
cmp ecx, dword [edx + 8]
jae 0x5305cf
lea ecx, [ecx + ecx*4]
shl ecx, 5
add ecx, dword [edx]
cmp dword [ecx + 0x9c], eax
jne 0x5305cf
call fcn.004733f0
mov ecx, dword [edi]
mov eax, dword [edi + 0x144]
test eax, eax
mov edx, dword [ecx + 0x820]
mov edx, dword [edx + 8]
je 0x530601
movzx ecx, ax
cmp ecx, dword [edx + 8]
jae 0x530601
lea ecx, [ecx + ecx*4]
shl ecx, 5
add ecx, dword [edx]
cmp dword [ecx + 0x9c], eax
jne 0x530601
call fcn.004733f0
push edi
jmp 0x795535
Function at 0x537f60
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x640888
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [esi + 0x44]
mov ecx, dword [edi + 4]
or edx, eax
mov ebx, eax
mov eax, dword [esi + 0x48]
not eax
and edx, eax
mov dword [edi], edx
mov edx, dword [esi + 0x48]
mov dword [esp + 0x20], ecx
or ecx, dword [esi + 0x44]
not edx
and ecx, edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov dword [edi + 4], ecx
mov dword [esp + 0x30], 0
cmp byte [edi + 8], 0
je 0x537fd1
mov eax, dword [edi]
jmp 0x537fd3
mov eax, ecx
test al, 2
je 0x537fe0
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
mov ecx, esi
call edx
mov ecx, dword [esi + 0x10]
test ecx, ecx
mov dword [esp + 0x14], ecx
jne 0x538009
mov eax, dword [esp + 0x20]
mov dword [edi], ebx
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [edi + 8], 0
je 0x538013
mov eax, dword [edi]
jmp 0x538016
mov eax, dword [edi + 4]
test al, 1
je 0x53802e
mov eax, dword [ecx + 0x28]
cmp dword [esi + 0x24], eax
je 0x53802e
mov edx, dword [esi]
mov dword [esi + 0x24], eax
mov eax, dword [edx + 0x58]
mov ecx, esi
call eax
mov ecx, dword [esi + 8]
mov ecx, dword [ecx]
lea eax, [esi + 4]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
lea esp, [esp]
mov eax, dword [esi + 0x1c]
test eax, eax
mov ebx, dword [esi + 8]
lea ecx, [esi + 4]
je 0x538051
cmp eax, ecx
je 0x538056
call fcn.0061c63f
cmp dword [esi + 0x20], ebx
je 0x5380c6
mov byte [esi + 0x18], 0
cmp dword [esi + 0x1c], 0
jne 0x53806a
call fcn.0061c63f
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x20]
cmp eax, dword [edx + 4]
jne 0x53807a
call fcn.0061c63f
mov ecx, dword [esi + 0x20]
mov ecx, dword [ecx + 8]
mov edx, dword [esp + 0x14]
cmp ecx, dword [edx + 0x94]
jne 0x538090
mov byte [edi + 8], 1
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
push edi
call edx
cmp byte [esi + 0x18], 0
jne 0x538040
cmp dword [esi + 0x1c], 0
jne 0x5380a9
call fcn.0061c63f
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
cmp ecx, dword [eax + 4]
jne 0x5380b9
call fcn.0061c63f
mov edx, dword [esi + 0x20]
mov eax, dword [edx]
mov dword [esi + 0x20], eax
jmp 0x538040
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov byte [esi + 0x18], 1
mov dword [edi], ecx
mov dword [edi + 4], edx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
jmp 0x7964c4
Function at 0x543900
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x699fe8]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x6a9f30], 0
jne 0x54397d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0061d4e6
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x6a9f30], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x6a9f34], eax
mov eax, dword [eax]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0061efd1
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
mov edx, dword [0x6a9f34]
mov eax, dword [edx]
xor ecx, esp
call fcn.0061efd1
add esp, 0x104
ret

Function at 0x543aa0
Capabilities:
Read file on windows

Disassembly:
call fcn.00543900
test eax, eax
je 0x543abd
mov eax, dword [0x6a9f34]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push esi
push edi
push 1
push ebx
call eax
ret
mov ecx, dword [esi + 8]
push ecx
push edi
push 1
push ebx
call fcn.0061d24e
add esp, 0x10
ret
Function at 0x545c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x64aa38
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp byte [esi + 0x510], 0
je 0x545e28
mov edi, 0x10
cmp dword [esi + 0x548], edi
jb 0x545c71
mov eax, dword [esi + 0x534]
jmp 0x545c77
lea eax, [esi + 0x534]
push 0x670908
push eax
call fcn.0061ceb1
mov ebx, eax
add esp, 8
test ebx, ebx
mov dword [esp + 0x24], ebx
je 0x545e28
push ebx
push 1
lea eax, [esp + 0x20]
push 4
push eax
mov dword [esp + 0x28], 0x42beef78
call fcn.0061d3c8
push ebx
push 1
lea ecx, [esp + 0x34]
push 4
push ecx
mov dword [esp + 0x3c], 2
call fcn.0061d3c8
push ebx
push 1
lea edx, [esi + 8]
push 4
push edx
call fcn.0061d3c8
movzx eax, word [esi + 0x3ac]
push ebx
push 1
lea ecx, [esp + 0x58]
push 2
push ecx
mov dword [esp + 0x60], eax
call fcn.0061d3c8
mov eax, dword [esi + 0x3ac]
add esp, 0x40
cmp dword [esi + 0x3b0], edi
jb 0x545d02
mov ecx, dword [esi + 0x39c]
jmp 0x545d08
lea ecx, [esi + 0x39c]
push ebx
push eax
push 1
push ecx
call fcn.0061d3c8
add esp, 0x10
lea eax, [esp + 0x3c]
call fcn.005d60a0
mov dword [esp + 0x68], 0
mov eax, dword [esi + 0x5a8]
lea edi, [esp + 0x3c]
call fcn.005d6420
mov edx, dword [esi + 0x5a4]
mov edi, dword [edx]
add esi, 0x5a0
mov dword [esp + 0x30], edi
cmp esi, esi
mov eax, dword [esi + 4]
mov dword [esp + 0x38], eax
je 0x545d57
call fcn.0061c63f
cmp edi, dword [esp + 0x38]
je 0x545da5
cmp edi, dword [esi + 4]
jne 0x545d67
call fcn.0061c63f
lea ebx, [edi + 8]
lea eax, [esp + 0x3c]
call fcn.005d6450
cmp edi, dword [esi + 4]
jne 0x545d7d
call fcn.0061c63f
mov eax, dword [edi + 0x24]
lea edi, [esp + 0x3c]
call fcn.005d6420
mov edi, dword [esp + 0x30]
cmp edi, dword [esi + 4]
jne 0x545d97
call fcn.0061c63f
mov ecx, dword [edi]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x30], ecx
mov edi, ecx
jmp 0x545d47
lea eax, [esp + 0x3c]
call fcn.005d69c0
push ebx
push 1
lea edx, [esp + 0x1c]
push 4
push edx
mov dword [esp + 0x24], eax
call fcn.0061d3c8
mov eax, dword [esp + 0x24]
add esp, 0x10
push ebx
push 1
push eax
lea esi, [esp + 0x48]
call fcn.005d6990
push eax
call fcn.0061d3c8
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x484]
push ebx
push 1
lea edx, [esp + 0x40]
push 4
push edx
mov dword [esp + 0x48], ecx
call fcn.0061d3c8
add esp, 0x20
add esi, 0x54c
push ebx
mov eax, esi
call fcn.005d69c0
push eax
push 1
call fcn.005d6990
push eax
call fcn.0061d3c8
push ebx
call fcn.0061cf36
add esp, 0x14
lea ecx, [esp + 0x3c]
call fcn.005d60c0
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4