joyce8/EMBER2024-capa huggingface dataset:
Function at 0x503960
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x503abc
cmp byte [edi + 0x49], 0
je 0x503abc
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
jne 0x5039a5
xor al, al
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00565a22
add esp, 0x24
ret
mov ecx, 0xf
xor eax, eax
mov byte [esp + 8], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 8
cmp ecx, 0x10
jae 0x5039ce
lea eax, [esp + 8]
push ebx
push ebp
mov byte [eax + 8], 0
lea ebx, [edi + 0x4c]
push esi
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
mov edx, eax
cmp ebp, 0x10
jae 0x5039ed
lea edx, [esp + 0x14]
mov eax, edx
add edx, dword [esp + 0x24]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push edx
push eax
mov eax, dword [esi + 0x18]
push ebx
call eax
sub eax, 0
je 0x503a32
dec eax
je 0x503a36
sub eax, 2
lea ecx, [esp + 0x14]
je 0x503aa2
call fcn.00429190
pop esi
pop ebp
pop ebx
xor al, al
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00565a22
add esp, 0x24
ret
mov byte [edi + 0x49], 0
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov ecx, eax
cmp ebp, 0x10
jae 0x503a49
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x10]
sub esi, ecx
je 0x503a76
cmp ebp, 0x10
jae 0x503a5a
lea eax, [esp + 0x14]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.005657ec
add esp, 0x10
cmp esi, eax
jne 0x503a95
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
cmp byte [edi + 0x49], 0
je 0x503a9e
test esi, esi
jne 0x5039e0
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00503780
jmp 0x5039d8
lea ecx, [esp + 0x14]
jmp 0x503a18
lea ecx, [esp + 0x14]
call fcn.00429190
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00565a22
add esp, 0x24
ret
mov ecx, dword [esp + 0x24]
pop edi
xor ecx, esp
mov al, 1
call fcn.00565a22
add esp, 0x24
ret

Function at 0x5058d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x110]
push ebp
mov ebp, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x124]
push edi
push 0xff
lea ecx, [esp + 0x18]
push ecx
push 0
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x14]
push 0x5c
push edx
call fcn.00568580
mov byte [eax + 1], 0
mov eax, esi
add esp, 8
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x505931
lea edi, [esp + 0x14]
sub eax, ecx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x505940
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x14]
push eax
push 0xff
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
push ecx
push 0
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00565a22
add esp, 0x108
ret
Function at 0x506b50
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov dword [esi], vtable.PingManager.0
push edi
xor edi, edi
push 0x1e
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.00533120
push edi
push edi
push edi
push 0x506af0
push edi
push edi
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], edi
call fcn.0056888a
add esp, 0x18
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x506cc0
Capabilities:
Create raw socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x198
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
xor eax, eax
push 0x18e
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00565470
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x102
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x506d1c
xor al, al
pop esi
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00565a22
add esp, 0x198
ret
push 1
push 3
push 2
call sub.WSOCK32.dll_socket
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x506d04
push 4
lea ecx, [esp + 8]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x18], 0x7d0
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x506d04
mov eax, dword [esi + 4]
push 4
lea edx, [esp + 8]
push edx
push 0x1005
push 0xffff
push eax
mov dword [esp + 0x18], 0x7d0
call sub.WSOCK32.dll_setsockopt
mov ecx, dword [esp + 0x198]
cmp eax, 0xffffffff
setne al
pop esi
xor ecx, esp
call fcn.00565a22
add esp, 0x198
ret
Function at 0x50e950
Capabilities:
Create directory

Disassembly:
sub esp, 0x210
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
push esi
call ecx
test eax, eax
je 0x50e9aa
push 0x7c9
mov ecx, 0x6b3178
call fcn.004c5e50
push eax
push 0x1d
push 0x6b3178
call fcn.004c7080
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00565a22
add esp, 0x210
ret
mov eax, dword [0x6dc2dc]
mov dword [esp + 4], 0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0x592e98
push eax
mov eax, dword [ecx + 0x134]
call eax
test eax, eax
je 0x50e992
cmp dword [esi + 0xc], 0
jne 0x50ea11
push str.bdcap32.dll
mov ecx, esi
call fcn.0050edb0
test eax, eax
jns 0x50e9f5
push 0x7ca
jmp 0x50e978
mov ecx, dword [esi]
mov edx, dword [ecx + 0xc]
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
push esi
call edx
cmp dword [esi + 0xc], 0
je 0x50ead4
mov eax, dword [esi]
mov ecx, dword [eax + 0x40]
push 0x3c
push 0x1e
push esi
call ecx
mov ecx, esi
call fcn.0050e860
push 0
mov ecx, 0x6dede8
call fcn.0054d050
push eax
lea edx, [esp + 0xc]
push str._sScreenShot
push edx
call fcn.00565980
add esp, 0xc
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x50ea6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x50ea6b
push 0x7cc
jmp 0x50e978
push 0x104
lea ecx, [esp + 0x110]
push ecx
push 0x592f90
push str.Capture
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.0050e5f0
lea eax, [esp + 0x10c]
push eax
push 0x7cd
mov ecx, 0x6b3178
call fcn.004c5e50
push eax
push 0x1d
push 0x6b3178
call fcn.004c7080
mov ecx, dword [esp + 0x14]
add esp, 0x10
push ecx
push 4
push 0
lea edx, [esp + 0x118]
push edx
push esi
call fcn.0050e680
test eax, eax
js 0x50e992
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00565a22
add esp, 0x210
ret

Function at 0x50f170
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push esi
test eax, eax
jne 0x50f1c3
mov eax, dword [esp + 8]
push 0x593004
push eax
call fcn.00565922
mov esi, eax
add esp, 8
test esi, esi
je 0x50f1f9
mov edx, dword [esp + 0xc]
mov eax, edx
push edi
lea edi, [eax + 1]
jmp 0x50f1a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x50f1a0
push esi
sub eax, edi
push 1
push eax
push edx
call fcn.005657ec
push esi
call fcn.00565621
add esp, 0x14
pop edi
xor eax, eax
pop esi
ret 0xc
cmp eax, 1
jne 0x50f1f9
mov ecx, dword [esp + 8]
push 0x593000
push ecx
call fcn.00565922
mov esi, eax
add esp, 8
test esi, esi
je 0x50f1f9
mov edx, dword [esp + 0xc]
push edx
push 0x592ffc
push esi
call fcn.005668b1
push esi
call fcn.00565621
add esp, 0x10
xor eax, eax
pop esi
ret 0xc
Function at 0x510970
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x208
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x204], eax
push esi
push edi
mov edi, dword [esp + 0x214]
mov esi, ecx
mov dword [esp + 8], edi
test edi, edi
jne 0x51099e
xor eax, eax
jmp 0x510a5a
push 0x5836b0
push edi
call fcn.00565922
lea edx, [esi + 0x30]
add esp, 8
mov dword [esi + 4], eax
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5109b6
mov eax, dword [esi + 4]
test eax, eax
je 0x510997
push ebx
push ebp
push 2
push 0
push eax
call fcn.005689b4
mov eax, dword [esi + 4]
push eax
call fcn.00568cfc
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
mov ebx, eax
call fcn.005689b4
add esp, 0x1c
mov ecx, esi
call fcn.0050fed0
mov edx, dword [esi + 4]
push edx
push 1
lea edi, [esi + 0x18]
push 0xc
push edi
call fcn.00565f05
mov eax, dword [edi]
sub eax, dword [esi + 0x1c]
add esp, 0x10
sub eax, dword [esi + 0x20]
lea ecx, [esi + 0x148]
push eax
call fcn.0055f0b0
test eax, eax
jne 0x510a73
push eax
push 0x38
push str.MHFile.cpp
call fcn.005160e0
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push str.Bin_File_Version_Error_____s
push edx
call fcn.00565980
add esp, 0x18
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
xor ecx, esp
call fcn.00565a22
add esp, 0x208
ret 4
lea ecx, [esi + 0x148]
call fcn.0055f090
test eax, eax
je 0x510b17
lea edi, [ebx - 0xe]
push edi
call fcn.00564db8
add esp, 4
mov dword [esi + 0x28], eax
test eax, eax
jne 0x510aab
push eax
push 0x49
push str.MHFile.cpp
call fcn.005160e0
add esp, 0xc
jmp 0x510a56
push edi
push 0
push eax
call fcn.00565470
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 4]
add esp, 0xc
push ecx
push edi
push edx
push eax
lea ecx, [esi + 0x148]
call fcn.0055f350
test eax, eax
jne 0x510af7
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push str.File_Open_Error_:__s
push edx
call fcn.00565980
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x1c]
jmp 0x510a4d
mov ecx, dword [esi + 4]
push ecx
call fcn.00565621
mov eax, 1
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 0x2c], eax
jmp 0x510a58
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esi + 0x24]
push 1
push eax
call fcn.00565f05
mov eax, dword [esi + 0x20]
add esp, 0x10
test eax, eax
je 0x510b4e
push eax
call fcn.00564db8
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x20]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x28], eax
call fcn.00565f05
add esp, 0x14
mov eax, dword [esi + 4]
push eax
push 1
lea ecx, [esi + 0x25]
push 1
push ecx
call fcn.00565f05
mov edx, dword [esi + 4]
push edx
call fcn.00565621
add esp, 0x14
mov ecx, esi
mov dword [esi + 4], 0
call fcn.00510340
test eax, eax
je 0x510a56
call fcn.0050fe90
test eax, eax
je 0x510a56
mov eax, 1
mov dword [esi + 0x2c], eax
jmp 0x510a58
Function at 0x514310
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x114
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x18]
mov ebx, ecx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x514337
movsx eax, byte [esi]
push eax
call fcn.0056909a
add esp, 4
test eax, eax
je 0x5143af
lea ecx, [esp + 0x18]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x51441a
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp dword [eax], edi
je 0x5143ae
nop
movsx edx, word [esi + 0xa]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00567420
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x20]
push 0x58399c
push eax
call fcn.00565980
mov ecx, dword [esi + 0xc]
inc edi
lea eax, [ecx + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x514370
pop edi
lea edx, [esp + 0x18]
push edx
push 0x20
push 0x6bfff4
call fcn.00568fe5
mov eax, dword [0x6c0038]
mov esi, dword [esp + 0x130]
imul eax, eax, 0x58
add esp, 0xc
cmp si, word [eax + 0x6db390]
jne 0x5143f7
cmp dword [0x6c0018], 0
je 0x5143f7
cmp dword [0x6c0034], 0
jne 0x5143f7
mov ecx, 0x6c0018
call fcn.00507540
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
mov eax, ecx
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
xor ecx, esp
call fcn.00565a22
add esp, 0x114
ret 8

Function at 0x5144a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x3c]
mov bl, 0x53
push edi
mov edi, ecx
cmp byte [esi + 1], bl
jb 0x5144d7
push 0
push 0xb6
push str.MHNetwork.cpp
call fcn.005160e0
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x56734661
mov dword [esp + 0x14], 0x31313561
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x19], bl
mov dword [esp + 0x1a], 0x61637646
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov dword [esp + 0x21], 0x40215e59
mov dword [esp + 0x25], 0x5a767324
mov dword [esp + 0x29], 0x26317241
mov dword [esp + 0x2d], 0x2a21405e
mov dword [esp + 0x31], 0x786673
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x514534
sub eax, ecx
mov ecx, eax
xor edx, edx
lea ebx, [ecx - 1]
mov eax, ebp
div ebx
dec ecx
mov al, byte [esp + edx + 0x10]
xor byte [esi + 1], al
xor edx, edx
mov eax, ebp
div ecx
mov cl, byte [esp + edx + 0x10]
xor byte [esi + 2], cl
mov dl, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x514586
mov edi, dword [edi + 0x114]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push ebp
push esi
push eax
push edi
call edx
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00565a22
add esp, 0x2c
ret 8
Function at 0x515b60
Capabilities:
Get file size

Disassembly:
sub esp, 0x3a0
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x39c], eax
push esi
mov esi, dword [esp + 0x3b0]
push edi
mov edi, dword [esp + 0x3ac]
push 0x1ff
lea eax, [esp + 0x1a9]
push 0
push eax
mov byte [esp + 0x1b0], 0
call fcn.00565470
add esp, 0xc
test esi, esi
je 0x515bc8
mov ecx, dword [esp + 0x3b0]
push esi
push ecx
push edi
lea edx, [esp + 0x1b0]
push str._s_line:_d__msg:_s_
push edx
call fcn.00565980
add esp, 0x14
jmp 0x515be6
mov eax, dword [esp + 0x3b0]
push eax
push edi
lea ecx, [esp + 0x1ac]
push str._s_line:_d_
push ecx
call fcn.00565980
add esp, 0x10
push 0xff
lea edx, [esp + 0xa9]
push 0
push edx
mov byte [esp + 0xb0], 0
call fcn.00565470
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0xc]
push ecx
push edx
push eax
lea ecx, [esp + 0xb0]
push str.._Log_Debug__4d_02d_02d.txt
push ecx
call fcn.00565980
add esp, 0x14
cmp dword [0x6c1c70], 0
jne 0x515ce9
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x515cbb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xa4]
push 0x59353c
push ecx
call fcn.00565922
mov esi, eax
add esp, 8
test esi, esi
je 0x515ce9
call fcn.005153a0
push eax
lea edx, [esp + 0x1a8]
push edx
push str._stime:_s_n
push esi
call fcn.005668b1
push esi
call fcn.00565621
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.00565a22
add esp, 0x3a0
ret
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x515c67
mov dword [0x6c1c70], 1
mov ecx, dword [esp + 0x3a4]
pop edi
pop esi
xor ecx, esp
call fcn.00565a22
add esp, 0x3a0
ret
Function at 0x5160e0
Capabilities:
Get file size

Disassembly:
sub esp, 0x2a0
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x29c], eax
cmp dword [0x6c1a38], 0
mov ecx, dword [esp + 0x2a4]
mov eax, dword [esp + 0x2ac]
je 0x51615b
push eax
mov eax, dword [esp + 0x2ac]
push eax
push ecx
push 0x5934d8
push 0x6c1938
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6c1938
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x51629e
int3
mov edx, dword [esp + 0x2a8]
test eax, eax
je 0x516180
push eax
push edx
push ecx
lea eax, [esp + 0x1a8]
push str._s_line:_d__msg:_s_
push eax
call fcn.00565980
add esp, 0x14
jmp 0x516197
push edx
push ecx
lea eax, [esp + 0x1a4]
push str._s_line:_d_
push eax
call fcn.00565980
add esp, 0x10
push 0xff
lea ecx, [esp + 0xa1]
push 0
push ecx
mov byte [esp + 0xa8], 0
call fcn.00565470
add esp, 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0xa]
movzx ecx, word [esp + 6]
movzx edx, word [esp + 4]
push eax
push ecx
push edx
lea eax, [esp + 0xa8]
push str.._Log_Assert__4d_02d_02d.txt
push eax
call fcn.00565980
add esp, 0x14
cmp dword [0x6c1c98], 0
jne 0x51629e
push esi
push edi
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x51626e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xa4]
push 0x59353c
push eax
call fcn.00565922
mov esi, eax
add esp, 8
test esi, esi
je 0x51629c
call fcn.005153a0
push eax
lea ecx, [esp + 0x1a8]
push ecx
push str._stime:_s_n
push esi
call fcn.005668b1
push esi
call fcn.00565621
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.00565a22
add esp, 0x2a0
ret
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x51621a
mov dword [0x6c1c98], 1
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.00565a22
add esp, 0x2a0
ret
Function at 0x532ff0
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x4c]
add eax, 0x493e0
cmp edi, eax
jbe 0x53301d
mov ecx, esi
call fcn.00532fb0
push 0x595da0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], edi
pop edi
pop esi
ret

Function at 0x537c60
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
jne 0x537c6f
xor eax, eax
ret 8
jmp 0x53b7f0
mov edx, dword [esp + 4]
fld dword [edx]
sub esp, 8
fld qword [0x589ee0]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jnp 0x53b8f4
fldz
fcom dword [edx]
fnstsw ax
test ah, 0x41
je 0x53b8f2
fld dword [edx + 8]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 1
je 0x53b8f4
fcomp dword [edx + 8]
fnstsw ax
test ah, 0x41
je 0x53b8f6
push esi
fnstcw word [esp + 0x10]
mov esi, dword [esp + 0x14]
fld dword [esi + 8]
fld qword [0x588a90]
movzx eax, word [esp + 0x10]
fdiv st(1), st(0)
or eax, 0xc00
mov dword [esp + 0x14], eax
fldcw word [esp + 0x14]
fxch st(1)
fistp qword [esp + 4]
mov eax, dword [esp + 4]
push eax
fldcw word [esp + 0x14]
fld dword [esi]
fdiv st(1)
fnstcw word [esp + 0x14]
movzx eax, word [esp + 0x14]
or eax, 0xc00
mov dword [esp + 0x18], eax
fldcw word [esp + 0x18]
fistp qword [esp + 8]
mov eax, dword [esp + 8]
push eax
fldcw word [esp + 0x18]
fld dword [edx + 8]
fdiv st(1)
fnstcw word [esp + 0x18]
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
fldcw word [esp + 0x1c]
fdivr dword [edx]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x20], eax
fldcw word [esp + 0x20]
fistp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
push edx
fldcw word [esp + 0x20]
call fcn.0053b210
pop esi
add esp, 8
ret 8
fstp st(0)
fstp st(0)
push str._____________________________.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
ret 8

Function at 0x539160
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1f4], 0
push edi
je 0x53920f
mov edi, dword [esp + 0x14]
test edi, edi
je 0x53920f
push 0
push 1
push 0x6de100
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x53920f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [0x6de0ac], ecx
mov edx, dword [eax + 4]
mov dword [0x6de0b0], edx
mov eax, dword [eax + 8]
mov dword [0x6de0b4], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [0x6de0a0], ecx
mov edx, dword [eax + 4]
mov dword [0x6de0a4], edx
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x18]
mov dword [0x6de0a8], eax
mov ecx, dword [esi + 0x1f4]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x5390d0
push 0
push 0
mov dword [0x6de0fc], ecx
mov dword [0x6de0f8], edi
mov dword [0x69fb84], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x539216
push eax
push 0x6de100
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x53d230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xa0]
mov ecx, edi
call fcn.0040a190
mov ebp, 1
cmp dword [ebx + 0x88], ebp
jbe 0x53d3b3
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x584370]
fstp qword [esp + 0x14]
jmp 0x53d270
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x53d287
mov ecx, dword [ecx]
test ecx, ecx
je 0x53d287
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x53d29a
mov eax, dword [eax]
test eax, eax
je 0x53d29a
mov eax, dword [eax]
test eax, eax
jne 0x53d29e
xor edx, edx
jmp 0x53d2a0
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53d2b1
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x53d2d3
fadd dword [0x583680]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x53d2f6
mov eax, dword [eax]
test eax, eax
je 0x53d2f6
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x53d308
mov edx, dword [edx]
test edx, edx
je 0x53d308
mov edx, dword [edx]
test edx, edx
jne 0x53d30c
xor edx, edx
jmp 0x53d30e
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53d31f
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x53d341
fadd dword [0x583680]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x53d35f
push 1
mov ecx, edi
call fcn.0040a040
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x53d36e
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x53d38b
push 0xc
call fcn.00565b01
add esp, 4
test eax, eax
je 0x53d3cb
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.005204e0
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x53d270
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0053f040
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.00566032
push 0x5ac4c8
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.00566120
int3