joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x607868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push 1
push eax
mov dword [esp + 0xc], esi
call fcn.004095d0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x10], 0
mov dword [esi + 0x40], 1
mov dword [esi], 0x61b71c
mov word [esi + 4], 3
mov dword [esi + 0x30], ecx
je 0x402e78
mov edx, dword [eax + 8]
cmp byte [edx + 4], 0x50
jne 0x402e78
mov ecx, dword [eax + 0x1c4]
test ecx, ecx
je 0x402e78
mov eax, ecx
push eax
mov ecx, esi
call fcn.00409aa0
lea eax, [esi + 0x24]
lea ecx, [esi + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.00403740
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x4064e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x607a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push 1
push eax
mov dword [esp + 0x10], esi
call fcn.004095d0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esi + 0x20], ecx
mov ecx, dword [esi + 8]
xor edi, edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi], 0x61bc40
mov word [esi + 4], 8
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x54], edi
mov edx, dword [ecx + 8]
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, esi
mov al, byte [edx + 0x16e]
mov dword [esp + 0x18], edi
mov byte [esi + 0x58], al
call fcn.00409aa0
mov edx, dword [esp + 0x20]
mov ecx, esi
push edx
call fcn.00409b20
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x5c], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x40d810
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x607df6
push eax
mov ax, word [esp + 0x1c]
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov word [esi + 0x1c], ax
mov ax, word [esp + 0x20]
movsx ecx, ax
shl ecx, 2
push ecx
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x61c4e8
mov word [esi + 4], ax
mov word [esi + 6], di
call fcn.005faa3d
mov dword [esi + 8], eax
mov ax, word [esp + 0x28]
movsx ebx, ax
mov word [esi + 0xc], ax
mov word [esi + 0xe], di
lea edx, [ebx + ebx*2]
lea eax, [edx*8 + 4]
push eax
call fcn.005faa3d
add esp, 8
mov dword [esp + 0x2c], eax
cmp eax, edi
mov dword [esp + 0x18], edi
je 0x40d8ac
push 0x410680
push 0x410660
lea ebp, [eax + 4]
push ebx
push 0x18
push ebp
mov dword [eax], ebx
call fcn.005faf46
mov eax, ebp
jmp 0x40d8ae
xor eax, eax
mov dword [esi + 0x10], eax
mov ax, word [esp + 0x28]
movsx ebx, ax
or ebp, 0xffffffff
mov word [esi + 0x14], ax
lea ecx, [ebx + ebx*2]
mov dword [esp + 0x18], ebp
mov word [esi + 0x16], di
lea edx, [ecx*4 + 4]
push edx
call fcn.005faa3d
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, edi
mov dword [esp + 0x18], 1
je 0x40d90a
push 0x409e30
push 0x409e10
lea ebp, [eax + 4]
push ebx
push 0xc
push ebp
mov dword [eax], ebx
call fcn.005faf46
mov eax, ebp
or ebp, 0xffffffff
jmp 0x40d90c
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esp + 0x18], ebp
movsx eax, word [esi + 0x1c]
shl eax, 4
push eax
call fcn.005faa3d
add esp, 4
xor ecx, ecx
cmp word [esi + 0x1c], di
mov dword [esi + 0x20], eax
jle 0x40d960
xor eax, eax
mov edx, dword [esi + 0x20]
inc ecx
mov dword [eax + edx], edi
mov edx, dword [esi + 0x20]
mov dword [eax + edx + 4], ebp
mov edx, dword [esi + 0x20]
mov word [eax + edx + 8], di
mov edx, dword [esi + 0x20]
mov word [eax + edx + 0xa], di
mov edx, dword [esi + 0x20]
mov dword [eax + edx + 0xc], edi
add eax, 0x10
movsx edx, word [esi + 0x1c]
cmp ecx, edx
jl 0x40d930
movsx eax, word [esi + 0x1c]
shl eax, 3
push eax
call fcn.005faa3d
mov dword [esi + 0x24], eax
add esp, 4
xor eax, eax
cmp word [esi + 0x1c], di
jle 0x40d99b
mov ecx, dword [esi + 0x24]
inc eax
mov word [ecx + eax*8 - 8], di
mov edx, dword [esi + 0x24]
mov word [edx + eax*8 - 6], di
mov ecx, dword [esi + 0x24]
mov dword [ecx + eax*8 - 4], edi
movsx edx, word [esi + 0x1c]
cmp eax, edx
jl 0x40d97b
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x10
Function at 0x41f100
Capabilities:
Get disk information

Disassembly:
sub esp, 0x20c
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 0x28]
mov ecx, dword [eax + 0x408]
test ecx, ecx
jne 0x41f127
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
mov eax, dword [esp + 0x218]
test eax, eax
jle 0x41f187
push ebp
xor ebp, ebp
push edi
xor esi, esi
mov ecx, dword [ebx + 0x1b4]
lea edi, [esi + 1]
push edi
call fcn.0042d630
cmp eax, 2
jne 0x41f159
push esi
mov ecx, ebx
call fcn.00421820
test eax, eax
je 0x41f159
inc ebp
mov esi, edi
cmp esi, 9
jl 0x41f138
mov ecx, dword [ebx + 0x28]
xor eax, eax
pop edi
mov edx, dword [ecx + 0x40c]
mov ecx, dword [esp + 0x21c]
imul edx, ebp
cmp ecx, edx
pop ebp
pop esi
pop ebx
setle al
add esp, 0x20c
ret 4
mov eax, dword [0x66337c]
test eax, eax
je 0x41f1a0
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
mov ecx, dword [ebx + 0x1d8]
push str.CDPath
push 0
call fcn.004be4e0
mov esi, eax
test esi, esi
jne 0x41f1c3
pop esi
pop ebx
add esp, 0x20c
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jmp 0x41f1dc
lea eax, [esp + 0x114]
push 0x100
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x28]
push 0x100
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jmp 0x41f218
mov edx, dword [ebx + 0x28]
lea eax, [esp + 0x14]
add edx, 0x2fd
push edx
push eax
call fcn.005fd5a0
add esp, 8
neg eax
sbb eax, eax
pop esi
inc eax
pop ebx
add esp, 0x20c
ret 4

Function at 0x41f3e0
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x28]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41f49a
mov eax, dword [esi + 0x28]
lea ecx, [eax + 0x7a]
push ecx
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x41f476
push 0x64c8e4
mov ecx, esi
call fcn.00422160
test al, al
je 0x41f44d
push 0
push 0
push 0x10
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [esi + 0x3c]
test esi, esi
je 0x41f4a8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 1
pop esi
ret
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x41f461
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x41f495
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esi + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], 0
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [esi + 0x3c]
test esi, esi
je 0x41f4a8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 1
pop esi
ret
Function at 0x422500
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [0x6633d4]
push eax
lea esi, [ebx + 0x10c]
mov edx, dword [ecx + 0x28]
add edx, 0xe49
push edx
push 0x64c6a0
push esi
call fcn.005faef4
push 0x8000
push esi
call fcn.005fbe12
mov esi, eax
add esp, 0x18
test esi, esi
jl 0x4225ad
push 0x108
push ebx
push esi
call fcn.005fbc1c
mov eax, dword [ebx + 0x104]
add esp, 0xc
test eax, eax
jle 0x422593
push 0x208
push eax
call fcn.005fab6a
mov ecx, dword [ebx + 0x104]
mov dword [ebx + 0x108], eax
mov edx, ecx
shl edx, 6
add edx, ecx
shl edx, 3
push edx
push eax
push esi
call fcn.005fbc1c
add esp, 0x14
push esi
call fcn.005fbb69
add esp, 4
mov eax, ebx
pop esi
pop ebx
ret 4
push esi
mov dword [ebx + 0x108], 0
call fcn.005fbb69
add esp, 4
mov eax, ebx
pop esi
pop ebx
ret 4
push edi
mov edi, str.FILE_NOT_FOUND
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 4]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [ebx + 0x104], 0
mov dword [ebx], 0
mov dword [ebx + 0x108], 0
pop esi
pop ebx
ret 4

Function at 0x423769
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x60834b
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov dword [esi], eax
call fcn.00423b00
lea ecx, [esi + 4]
push ecx
push 0x101
call sub.WSOCK32.dll_WSAStartup
push 0x504
call fcn.005faa3d
add esp, 4
mov dword [esp + 0x18], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x10], edi
je 0x4237bd
push 0x4cdaa0
push 0x423820
lea edi, [eax + 4]
push 8
push 0xa0
push edi
mov dword [eax], 8
call fcn.005faf46
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 0x220], edi
mov dword [esi + 0x214], 1
call fcn.004238e0
push 0xff
call fcn.005faa3d
add esp, 4
mov edi, eax
mov ecx, esi
push edi
call fcn.00423a00
push edi
mov ecx, esi
call fcn.00423900
push edi
call fcn.005faa32
mov ecx, dword [esp + 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x423900
Capabilities:
Resolve dns

Disassembly:
push ebx
mov ebx, ecx
lea eax, [ebx + 0x194]
test eax, eax
jne 0x423911
pop ebx
ret 4
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x42391f
pop ebx
ret 4
mov ecx, dword [esp + 8]
push edi
mov byte [ecx], 0
mov edx, dword [eax + 4]
mov dword [ebx + 0x21c], 0
mov edi, dword [edx]
test edi, edi
je 0x423987
push ebp
push esi
mov eax, dword [ebx + 0x21c]
mov ecx, dword [ebx + 0x220]
add edx, 4
lea eax, [eax + eax*4]
shl eax, 5
lea ebp, [eax + ecx + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 0x21c]
inc esi
mov dword [ebx + 0x21c], esi
mov edi, dword [edx]
test edi, edi
jne 0x42393c
pop esi
pop ebp
mov eax, dword [ebx + 0x21c]
pop edi
pop ebx
ret 4
Function at 0x423a00
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
lea eax, [ebx + 0x194]
test eax, eax
jne 0x423a17
pop ebx
add esp, 0x1c
ret 4
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x423a28
pop ebx
add esp, 0x1c
ret 4
mov ecx, dword [esp + 0x24]
push ebp
mov byte [ecx], 0
mov ebp, dword [eax + 0xc]
mov dword [ebx + 0x218], 0
mov eax, dword [ebp]
test eax, eax
je 0x423af0
push esi
push edi
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + 3]
mov cl, byte [eax + 2]
push edx
push ecx
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + 1]
mov cl, byte [eax]
push edx
push ecx
lea edx, [esp + 0x20]
push str._d._d._d._d_n
push edx
call fcn.005faef4
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add ebp, 4
mov esi, edi
mov edi, dword [esp + 0x30]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x218]
mov ecx, dword [ebx + 0x220]
lea edi, [esp + 0x10]
lea edx, [eax + eax*4]
xor eax, eax
shl edx, 5
add edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 0x218]
inc esi
mov dword [ebx + 0x218], esi
mov eax, dword [ebp]
test eax, eax
jne 0x423a4a
pop edi
pop esi
mov eax, dword [ebx + 0x218]
pop ebp
pop ebx
add esp, 0x1c
ret 4

Function at 0x424340
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x42437a
mov al, byte [esi + 0x14]
mov ecx, dword [esi + 8]
inc al
push 1
mov byte [esi + 0x14], al
lea eax, [esp + 0xb]
push eax
push ecx
call fcn.005fbc1c
add esp, 0xc
test eax, eax
jle 0x42437f
mov dl, byte [esp + 7]
mov al, byte [esi + 0x14]
cmp dl, al
mov eax, 2
jne 0x42437f
mov eax, 1
pop esi
pop ecx
ret
Function at 0x424420
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
jle 0x424535
mov eax, dword [esi + 8]
mov dword [esp + 0xc], 0xffffffff
push eax
call fcn.005fc0e2
mov edx, dword [esi + 8]
lea ecx, [esp + 0x10]
push 4
push ecx
push edx
mov edi, eax
call fcn.005fbc1c
add esp, 0x10
test eax, eax
jle 0x42453a
cmp dword [esp + 0xc], 1
je 0x42448b
mov eax, dword [esi + 8]
push 0
push edi
push eax
call fcn.005fc0f3
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov eax, 4
pop edi
pop esi
mov dword [ecx], 0
pop ebx
pop ecx
ret 0xc
mov ecx, esi
call fcn.00424340
cmp eax, 1
jne 0x42453a
mov edi, dword [esp + 0x18]
mov edx, dword [esi + 8]
push 4
push edi
push edx
call fcn.005fbc1c
add esp, 0xc
test eax, eax
jle 0x42453a
mov eax, dword [edi]
push eax
push 1
call fcn.005fab6a
mov ebx, dword [esp + 0x1c]
mov dword [ebx], eax
mov ecx, dword [edi]
mov edx, dword [esi + 8]
push ecx
push eax
push edx
call fcn.005fbc1c
mov edi, eax
add esp, 0x14
test edi, edi
jg 0x4244f6
mov eax, dword [ebx]
push eax
call fcn.005fabe7
add esp, 4
mov eax, edi
mov dword [ebx], 0
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 8]
push 4
push ecx
push edx
call fcn.005fbc1c
mov esi, eax
add esp, 0xc
test esi, esi
jg 0x424529
mov eax, dword [ebx]
push eax
call fcn.005fabe7
add esp, 4
mov eax, esi
mov dword [ebx], 0
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, 6
pop edi
pop esi
pop ebx
pop ecx
ret 0xc

Function at 0x424610
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
jle 0x424705
mov eax, dword [esi + 8]
mov dword [esp + 8], 0xffffffff
push eax
call fcn.005fc0e2
mov edx, dword [esi + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push edx
mov edi, eax
call fcn.005fbc1c
add esp, 0x10
test eax, eax
jle 0x42470a
cmp dword [esp + 8], 2
je 0x42466f
mov eax, dword [esi + 8]
push 0
push edi
push eax
call fcn.005fc0f3
add esp, 0xc
mov eax, 4
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, esi
call fcn.00424340
cmp eax, 1
jne 0x42470a
mov edi, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push 4
push edi
push ecx
call fcn.005fbc1c
add esp, 0xc
test eax, eax
jle 0x42470a
mov eax, dword [esi + 0x548]
test eax, eax
je 0x4246ce
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 8]
push 4
push edx
push eax
call fcn.005fbc1c
add esp, 0xc
test eax, eax
jle 0x42470a
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 8]
push 4
push ecx
push edx
call fcn.005fbc1c
add esp, 0xc
test eax, eax
jle 0x42470a
mov eax, dword [esi + 0xc]
dec eax
mov dword [esi + 0xc], eax
jne 0x4246fa
mov eax, dword [esi + 0x548]
test eax, eax
je 0x4246e5
push 0
jmp 0x4246e8
mov eax, dword [edi]
push eax
mov ecx, esi
call fcn.00424840
cmp eax, 1
jne 0x42470a
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], ecx
pop edi
mov eax, 1
pop esi
pop ecx
ret 0xc
mov eax, 6
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x424840
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 4], edi
jle 0x424a3e
lea eax, [esp + 0x28]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [0x6633d4]
push edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x38], edi
call fcn.00421d90
mov eax, dword [0x6633d4]
mov edx, dword [esi + 8]
push edx
mov ecx, dword [eax + 0x420]
mov ebp, dword [ecx + 0x10]
mov ecx, dword [esp + 0x40]
add ebp, ecx
mov dword [esp + 0x14], 0xffffffff
call fcn.005fc0e2
mov ecx, dword [esi + 8]
mov ebx, eax
lea eax, [esp + 0x14]
push 4
push eax
push ecx
call fcn.005fbc1c
add esp, 0x10
cmp eax, edi
jle 0x424a43
cmp dword [esp + 0x10], edi
je 0x4248f7
mov edx, dword [esi + 8]
push edi
push ebx
push edx
call fcn.005fc0f3
add esp, 0xc
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov ecx, esi
call fcn.00424340
cmp eax, 1
jne 0x424a43
mov ecx, dword [esi + 8]
lea eax, [esp + 0x30]
push 4
push eax
push ecx
call fcn.005fbc1c
add esp, 0xc
cmp eax, edi
jle 0x424a43
mov eax, dword [esi + 8]
lea edx, [esp + 0x14]
push 4
push edx
push eax
call fcn.005fbc1c
add esp, 0xc
cmp eax, edi
jle 0x424a43
mov edx, dword [esi + 8]
lea ecx, [esp + 0x1c]
push 4
push ecx
push edx
call fcn.005fbc1c
add esp, 0xc
cmp eax, edi
jle 0x424a43
mov ecx, dword [esi + 8]
lea eax, [esp + 0x24]
push 4
push eax
push ecx
call fcn.005fbc1c
add esp, 0xc
cmp eax, edi
jle 0x424a43
mov eax, dword [esi + 8]
lea edx, [esp + 0x34]
push 4
push edx
push eax
call fcn.005fbc1c
add esp, 0xc
cmp eax, edi
jle 0x424a43
mov edx, dword [esi + 8]
lea ecx, [esp + 0x2c]
push 4
push ecx
push edx
call fcn.005fbc1c
add esp, 0xc
cmp eax, edi
jle 0x424a43
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x4249cc
cmp dword [esi + 0x538], edi
jne 0x4249cc
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x28
ret 4
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
je 0x4249ef
cmp dword [esi + 0x538], edi
jne 0x4249ef
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x28
ret 4
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp edx, eax
je 0x424a12
cmp dword [esi + 0x538], edi
jne 0x424a12
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x28
ret 4
cmp dword [esp + 0x2c], ebp
je 0x424a2f
cmp dword [esi + 0x538], edi
jne 0x424a2f
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x28
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret 4
mov eax, 6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x424ae0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
jle 0x424b9b
mov eax, dword [esi + 8]
mov dword [esp + 8], 0xffffffff
push eax
call fcn.005fc0e2
mov edx, dword [esi + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push edx
mov edi, eax
call fcn.005fbc1c
add esp, 0x10
test eax, eax
jle 0x424ba0
cmp dword [esp + 8], 3
je 0x424b3f
mov eax, dword [esi + 8]
push 0
push edi
push eax
call fcn.005fc0f3
add esp, 0xc
mov eax, 4
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, esi
call fcn.00424340
cmp eax, 1
jne 0x424ba0
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 8]
push 4
push ecx
push edx
call fcn.005fbc1c
add esp, 0xc
test eax, eax
jle 0x424ba0
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 8]
push 4
push eax
push ecx
call fcn.005fbc1c
add esp, 0xc
test eax, eax
jle 0x424ba0
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 8]
push 4
push edx
push eax
call fcn.005fbc1c
add esp, 0xc
test eax, eax
jle 0x424ba0
pop edi
mov eax, 1
pop esi
pop ecx
ret 0xc
mov eax, 6
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x431870
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
push esi
push edi
mov edi, dword [esp + 0x218]
mov esi, ecx
mov eax, dword [esi + edi*4 + 0x1a68]
mov ecx, dword [esi + 0x1a58]
cmp eax, ecx
jb 0x4318cc
mov dword [esi + edi*4 + 0x1ab8], 6
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [esi + edi*4 + 0x1c1c], eax
mov eax, dword [esi + 0x1610]
push edi
push str.Done_sending_to_player__i
push 3
push eax
call fcn.004bf420
add esp, 0x10
pop edi
pop esi
add esp, 0x20c
ret 8
sub ecx, eax
cmp ecx, 0x200
ja 0x431979
mov edx, dword [esi + edi*4 + 0x1b84]
mov dword [esp + 0xc], ecx
add edx, ecx
push 0
mov dword [esi + edi*4 + 0x1b84], edx
mov ecx, dword [esi + 0x1a54]
push eax
push ecx
mov byte [esp + 0x14], 0x24
mov dword [esp + 0x1c], eax
call fcn.005fc0f3
mov edx, dword [esp + 0x18]
mov ecx, dword [esi + 0x1a54]
lea eax, [esp + 0x20]
push edx
push eax
push ecx
call fcn.005fbc1c
mov eax, dword [esi + edi*4 + 0x1e48]
add esp, 0x18
lea edx, [esp + 8]
mov ecx, esi
push 1
push 0
push 0
push 0x20c
push edx
push eax
call fcn.00427610
mov ecx, dword [esi + edi*4 + 0x1ae0]
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x1610]
push ecx
push edx
push str.Sending_Final_Packet_at_Pos__ld___Rate
push 3
push eax
call fcn.004bf420
mov ecx, dword [esi + 0x1a58]
add esp, 0x14
mov dword [esi + edi*4 + 0x1a68], ecx
pop edi
pop esi
add esp, 0x20c
ret 8
mov edx, dword [esi + edi*4 + 0x1b84]
mov dword [esp + 0x10], eax
add edx, 0x200
push 0
mov dword [esi + edi*4 + 0x1b84], edx
mov edx, dword [esi + edi*4 + 0x1a68]
mov eax, dword [esi + 0x1a54]
push edx
push eax
mov byte [esp + 0x14], 0x24
mov dword [esp + 0x18], 0x200
call fcn.005fc0f3
mov edx, dword [esi + 0x1a54]
lea ecx, [esp + 0x20]
push 0x200
push ecx
push edx
call fcn.005fbc1c
mov ecx, dword [esi + edi*4 + 0x1e48]
add esp, 0x18
lea eax, [esp + 8]
push 1
push 0
push 0
push 0x20c
push eax
push ecx
mov ecx, esi
call fcn.00427610
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1610]
lea edx, [esi + 0x18c4]
push edx
push eax
push str.Sending_MAX_PACKET_at_Pos__ld____s
push 3
push ecx
call fcn.004bf420
mov edx, dword [esp + 0x20]
mov eax, dword [esi + edi*4 + 0x1a68]
add esp, 0x14
add eax, edx
mov dword [esi + edi*4 + 0x1a68], eax
pop edi
pop esi
add esp, 0x20c
ret 8