joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c2b0
Capabilities:
Get number of processors

Disassembly:
mov ecx, dword [ecx + 0x2ac]
jmp 0x46c2b0
push 0xffffffffffffffff
push 0x59f26b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x691844]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x30]
test ebx, ebx
je 0x46c459
cmp dword [ebx + 0x40], 0
lea edi, [ebp + 0x368]
mov ecx, edi
jne 0x46c3d7
call fcn.00594840
mov dword [esp + 0x30], eax
test eax, eax
je 0x46c329
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.005948a0
mov esi, dword [eax]
test esi, esi
je 0x46c329
mov eax, dword [ebx + 0x3c]
cmp dword [esi + 8], eax
je 0x46c336
cmp dword [esp + 0x30], 0
jne 0x46c308
push ebx
mov ecx, ebp
call fcn.0046b010
jmp 0x46c452
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.00594840
mov dword [esp + 0x18], eax
test eax, eax
je 0x46c367
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.005948a0
mov eax, dword [eax]
cmp dword [eax + 0x40], 0
je 0x46c459
cmp dword [esp + 0x18], 0
jne 0x46c348
mov ebp, 1
push ebx
mov ecx, edi
mov dword [esi], ebp
call fcn.005940c0
add dword [esi + 4], ebp
push 0x48
call fcn.00599902
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0
test eax, eax
je 0x46c39c
mov ecx, eax
call fcn.004fb100
jmp 0x46c39e
xor eax, eax
mov edx, dword [ebx + 0x3c]
mov ecx, edx
imul ecx, ecx, 0x64
add ecx, 0x63
mov dword [eax + 0x44], ecx
push eax
mov ecx, edi
mov dword [esp + 0x2c], 0xffffffff
mov dword [eax + 0x3c], edx
mov dword [eax + 0x40], 0x63
call fcn.00594150
mov eax, dword [esp + 0x14]
add dword [esi + 4], ebp
add dword [eax + 0x364], ebp
mov ebp, eax
jmp 0x46c452
call fcn.00594840
mov dword [esp + 0x1c], eax
test eax, eax
je 0x46c44a
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call fcn.005948a0
mov esi, dword [eax]
test esi, esi
je 0x46c44a
mov eax, dword [esi + 8]
cmp eax, dword [ebx + 0x3c]
je 0x46c407
cmp dword [esp + 0x1c], 0
jne 0x46c3e4
jmp 0x46c44a
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.00594870
mov ebp, eax
test ebp, ebp
je 0x46c446
mov ecx, edi
call fcn.005947b0
mov eax, dword [eax]
cmp dword [eax + 0x40], 0x63
push ebx
mov ecx, edi
jne 0x46c438
push ebp
call fcn.00594440
inc dword [esi + 4]
mov ebp, dword [esp + 0x14]
jmp 0x46c452
call fcn.00594150
inc dword [esi + 4]
mov ebp, dword [esp + 0x14]
jmp 0x46c452
mov ebp, dword [esp + 0x14]
push ebx
mov ecx, ebp
call fcn.0046b120
mov ecx, ebp
call fcn.0046bed0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
mov ecx, dword [0x6939dc]
jmp 0x46a940
Function at 0x4727e0
Capabilities:
Print debug messages

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
mov ebx, ecx
test eax, eax
jne 0x472800
push str.Item_DB_idx__0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop ebx
ret 4
push esi
push eax
mov ecx, 0x69fe70
call fcn.004ae4d0
mov esi, eax
test esi, esi
je 0x47281f
mov ax, word [edi + 6]
mov word [esi + 0x312], ax
jmp 0x47284d
push str.CItemShopGridDialog::AddItem
push edi
mov ecx, 0x69fe70
call fcn.004b1f60
mov esi, eax
test esi, esi
jne 0x47283b
pop esi
pop edi
pop ebx
ret 4
push esi
mov ecx, 0x69fe70
mov dword [esi + 0x24], 1
call fcn.004baf70
mov edx, dword [esi]
mov eax, dword [edx + 0x7c]
mov ecx, esi
call eax
movzx eax, ax
movzx eax, ax
sub eax, 0xf0
cdq
mov ecx, 0x1e
idiv ecx
push esi
mov ecx, ebx
push edx
call fcn.00429490
pop esi
pop edi
pop ebx
ret 4
Function at 0x477ff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59f886
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x691844]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov dword [ebx], vtable.CGuildMunhaDialog.0
lea esi, [ebx + 0x2a4]
mov ecx, esi
mov dword [esp + 0x3c], 1
call fcn.00593e50
push 0
lea ecx, [esp + 0x1c]
call fcn.00593d70
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x30]
mov dword [esi + 0x14], ecx
lea ecx, [esp + 0x18]
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], edx
call fcn.00593ed0
lea edi, [ebx + 0x29c]
mov ebp, 2
mov eax, dword [edi]
lea ecx, [eax + 0x29c]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
add edi, 4
sub ebp, 1
jne 0x478081
mov ecx, esi
mov byte [esp + 0x3c], 0
call fcn.00593ed0
mov ecx, ebx
mov dword [esp + 0x3c], 0xffffffff
call fcn.00424d90
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x488530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a01ce
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x691844]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00424b30
lea edi, [esi + 0x2a0]
mov ecx, edi
mov dword [esp + 0x38], 0
mov dword [esi], vtable.CUniqueItemCurseCancellationDlg.0
call fcn.004c2c10
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
mov dword [esi + 0x29c], 0
mov word [esi + 0x5b0], ax
call fcn.00429880
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x3f
mov ecx, 0x69d200
mov byte [esp + 0x44], 2
call fcn.0042f6b0
push 0x33517d
lea edx, [esp + 0x14]
push edx
push 0xffffff
push 0x5af25f
mov ecx, edi
call fcn.0043c130
lea ecx, [esp + 0x10]
mov dword [esi + 0x2c4], 0
mov byte [esp + 0x38], 1
call fcn.00429890
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x48aef5
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp ebx, 1
jne 0x48af35
mov eax, dword [0x6a01bc]
push edi
add eax, 0x1d4c0
lea edi, [esi + 0x308]
mov ecx, edi
mov dword [esi + 0x2bc], eax
call fcn.00445c80
push str.ANRaster.tga
mov ecx, edi
call fcn.00445cb0
pop edi
push ebx
mov ecx, esi
call fcn.00425130
pop esi
pop ebx
ret 4
lea ecx, [esi + 0x308]
call fcn.00445c80
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.00425130
pop esi
pop ebx
ret 4
Function at 0x48af60
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp ebx, 1
jne 0x48afab
mov eax, dword [esp + 0x10]
imul eax, eax, 0x3e8
add eax, dword [0x6a01bc]
push edi
lea edi, [esi + 0x308]
mov ecx, edi
mov dword [esi + 0x2bc], eax
call fcn.00445c80
push str.ANRaster.tga
mov ecx, edi
call fcn.00445cb0
pop edi
push ebx
mov ecx, esi
call fcn.00425130
pop esi
pop ebx
ret 8
lea ecx, [esi + 0x308]
call fcn.00445c80
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.00425130
pop esi
pop ebx
ret 8

Function at 0x48d120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a04d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x691844]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
push 0xa
lea ecx, [esp + 0x18]
call fcn.00593d70
lea edi, [esi + 0x5c]
mov ecx, edi
mov dword [esp + 0x38], 0
call fcn.00594840
mov dword [esp + 0xc], eax
test eax, eax
je 0x48d1d9
lea esp, [esp]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.005948a0
mov esi, dword [eax]
test esi, esi
je 0x48d1d2
fld dword [esi + 0x28c]
push ecx
fstp dword [esp + 0x14]
lea ecx, [esi + 0x284]
fld dword [esp + 0x14]
fcom qword [0x5b8e20]
fnstsw ax
test ah, 1
jne 0x48d1bc
fstp st(0)
fld1
fstp dword [esp]
call fcn.0054e260
push esi
lea ecx, [esp + 0x18]
call fcn.00594150
jmp 0x48d1d2
fadd qword [0x5b8e18]
fstp dword [esp + 0x14]
fld dword [esp + 0x14]
fstp dword [esp]
call fcn.0054e260
cmp dword [esp + 0xc], 0
jne 0x48d170
lea ecx, [esp + 0x14]
call fcn.00594840
mov dword [esp + 0xc], eax
test eax, eax
je 0x48d213
lea ebx, [ebx]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x18]
call fcn.005948a0
mov eax, dword [eax]
test eax, eax
je 0x48d20c
push eax
mov ecx, edi
call fcn.00594ad0
cmp dword [esp + 0xc], 0
jne 0x48d1f0
lea ecx, [esp + 0x14]
call fcn.00593e50
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call fcn.00593ed0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x4920a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a09be
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x691844]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x38], eax
lea ebx, [ebx]
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x49214f
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
mov dword [ebx + 0x38], edx
test ecx, ecx
je 0x49214f
mov ecx, dword [ecx + 0x640]
test ecx, ecx
je 0x49213b
test byte [0x6932a8], 1
movzx esi, word [ecx + 0x3b]
jne 0x49212b
or dword [0x6932a8], 1
mov ecx, 0x693138
mov dword [esp + 0x14], 0
call fcn.0053ef00
push 0x5aa6a0
call fcn.005998a5
add esp, 4
mov dword [esp + 0x14], 0xffffffff
push esi
mov ecx, 0x693138
call fcn.0053c7c0
cmp eax, 1
jne 0x4920d0
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x49e550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a0e28
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x691844]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
cmp dword [ecx + 0x120], 1
je 0x49e5a6
push 0
push 0x236
push str..Object.cpp
call fcn.00527110
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
mov ebx, dword [esp + 0x38]
lea esi, [ecx + 0x18]
xor edx, edx
mov eax, ebx
div dword [esi + 4]
mov eax, dword [esi + 8]
push 0xa
mov ecx, dword [eax + edx*4]
mov dword [esi + 0x18], ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], ebx
call fcn.00593d70
mov dword [esp + 0x30], 0
lea ebx, [ebx]
cmp dword [esi + 0x18], 0
je 0x49e601
mov ecx, dword [esi + 0x20]
lea esp, [esp]
mov eax, dword [esi + 0x18]
cmp dword [eax], ecx
je 0x49e65f
mov edx, dword [eax + 0xc]
mov dword [esi + 0x18], edx
test edx, edx
jne 0x49e5f0
lea ecx, [esp + 0xc]
call fcn.00594840
mov dword [esp + 0x38], eax
test eax, eax
je 0x49e631
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x10]
call fcn.005948a0
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.0049e280
cmp dword [esp + 0x38], 0
jne 0x49e612
lea ecx, [esp + 0xc]
call fcn.00593e50
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00593ed0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret 4
mov dword [esi + 0x1c], eax
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x49e601
push eax
mov ecx, 0x6e4b00
call fcn.00562c60
cmp eax, 1
jne 0x49e5e0
push ebx
lea ecx, [esp + 0x10]
call fcn.00594150
jmp 0x49e5e0
Function at 0x4a1cd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0xb7c]
push edi
xor edi, edi
cmp eax, edi
je 0x4a1cf8
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x1b80]
xor ecx, 0xda1f20b8
xor edx, eax
mov dword [edx], ecx
jmp 0x4a1d68
push 4
push 0x3000
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.MSVCR90.dll_rand]
xor ecx, 0xda1f20b8
mov dword [esi + 0xb7c], eax
mov dword [eax], ecx
mov dword [esi + 0x1b80], edi
lea ebx, [esi + 0xb80]
lea esp, [esp]
call ebp
cdq
mov ecx, 0xff
idiv ecx
add ebx, 4
lea eax, [edx + edi - 0x25e0df48]
xor eax, dword [esi + 0xb7c]
inc edi
mov dword [ebx - 4], eax
add dword [esi + 0x1b80], eax
cmp edi, 0x400
jl 0x4a1d30
mov edx, dword [esi + 0x1b80]
xor dword [esi + 0xb7c], edx
xor ecx, ecx
xor ebx, ebx
xor edi, edi
xor edx, edx
lea eax, [esi + 0xb84]
mov ebp, 0x100
jmp 0x4a1d80
add ecx, dword [eax - 4]
add edx, dword [eax]
add edi, dword [eax + 4]
add ebx, dword [eax + 8]
add eax, 0x10
sub ebp, 1
jne 0x4a1d80
mov eax, dword [esi + 0x1b80]
add ebx, edi
add ebx, edx
add ecx, ebx
cmp ecx, eax
jne 0x4a1db5
mov ecx, dword [esi + 0xb7c]
xor ecx, eax
mov edx, dword [ecx]
xor edx, 0xda1f20b8
jne 0x4a1dd2
mov ecx, dword [0x6939cc]
test ecx, ecx
je 0x4a1dd2
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 0
mov edx, dword [eax + 8]
jmp edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4b1f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5a15a9
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x691844]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x691844]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x18c]
movzx esi, word [ebx + 4]
mov ebp, dword [esp + 0x190]
movzx eax, si
mov edi, ecx
test ax, ax
je 0x4b1fe3
movzx ecx, ax
xor edx, edx
mov eax, ecx
div dword [edi + 0x30]
mov eax, dword [edi + 0x34]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x4b1fe3
jmp 0x4b1fd0
cmp dword [eax], ecx
je 0x4b1fdd
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4b1fd0
jmp 0x4b1fe3
cmp dword [eax + 4], 0
jne 0x4b2023
mov edx, dword [0x69e248]
push ebp
movzx ecx, si
push ecx
push edx
lea eax, [esp + 0x84]
push str.NoItemInfo__d____d____s
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea ecx, [esp + 0x8c]
push ecx
push 0x136
push str..ItemManager.cpp
call fcn.00527110
add esp, 0x20
xor eax, eax
jmp 0x4b2136
mov ebp, dword [ebx]
test ebp, ebp
je 0x4b201c
push ebp
mov ecx, edi
call fcn.004ae4d0
mov esi, eax
test esi, esi
jne 0x4b210c
push 0x384
call fcn.00599902
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x184], esi
cmp eax, esi
je 0x4b2061
push ebx
mov ecx, eax
call fcn.004a8320
mov esi, eax
mov edx, dword [ebx]
push edx
push esi
lea ecx, [edi + 8]
mov dword [esp + 0x18c], 0xffffffff
call fcn.004b0870
lea ecx, [esp + 0x18]
call fcn.00429880
mov ebx, dword [esi]
lea ecx, [edi + 0x2e0]
mov dword [esp + 0x184], 1
add ebx, 0x10
call fcn.00594c60
mov edx, dword [esi]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edx + 0x78]
mov ecx, esi
call eax
movzx ecx, ax
push ecx
mov ecx, edi
call fcn.004b1f10
mov edx, dword [ebx]
push eax
push 0x28
push 0x28
push 0
push 0
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x78]
mov ecx, esi
mov dword [esi + 0x2a0], 1
call edx
movzx eax, ax
mov dword [esi + 0x2a4], eax
xor eax, eax
mov word [esi + 0x32c], ax
mov ecx, dword [0x683110]
push esi
call fcn.00594150
lea ecx, [esp + 0x18]
mov dword [esp + 0x184], 0xffffffff
call fcn.00429890
jmp 0x4b2134
push ebp
lea ecx, [esp + 0x3c]
push 0x5ba4f4
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea edx, [esp + 0x44]
push edx
push 0x15f
push str..ItemManager.cpp
call fcn.00527110
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.005997a8
add esp, 0x174
ret 8
Function at 0x4b6be0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x691844]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebp
mov ebp, dword [sym.imp.WINMM.dll_timeGetTime]
push esi
mov esi, ecx
call ebp
cmp dword [esi + 0x1bc], 0
jne 0x4b6c0f
mov dword [esi + 0x1bc], eax
sub eax, dword [esi + 0x1bc]
cmp eax, 0x1388
jbe 0x4b6d08
mov eax, dword [esi + 0x198]
mov ecx, dword [esi + 0x1a4]
mov dword [esi + 0x1ac], ecx
test eax, eax
jle 0x4b6c57
mov ecx, eax
jmp 0x4b6c40
mov eax, dword [esi + 0x1ac]
test eax, eax
je 0x4b6c52
mov edx, dword [eax]
mov dword [esi + 0x1ac], edx
sub ecx, 1
jne 0x4b6c40
push ebx
push 0
push 2
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b6d07
lea eax, [esp + 0xc]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4b6cf8
push edi
mov edi, dword [sym.imp.MSVCR90.dll_sprintf]
lea ebx, [ebx]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x13c]
push 0x5acee4
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x138]
push eax
mov ecx, esi
call fcn.004b0810
test eax, eax
je 0x4b6ce8
mov ecx, 0x68ec10
call fcn.00525340
push 0x230
mov ecx, 0x6a0f60
call fcn.004d6bc0
push eax
push 1
push 0x17a0
push 0x6830f8
call fcn.00443290
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4b6c90
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebp
mov dword [esi + 0x1bc], eax
pop ebx
mov ecx, dword [esp + 0x1b0]
pop esi
pop ebp
xor ecx, esp
call fcn.005997a8
add esp, 0x1ac
ret
Function at 0x4c5670
Capabilities:
Delete file
Download url
Read file on windows
Receive data

Disassembly:
sub esp, 0x10
mov eax, dword [0x691844]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
mov cl, 0x74
push 0
push 0
mov byte [esp + 0x11], cl
mov byte [esp + 0x13], cl
mov byte [esp + 0x15], cl
lea ecx, [esp + 0xc]
push ecx
push eax
push 0
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x1b], 0x75
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1e], 0x2e
mov byte [esp + 0x20], 0x78
mov byte [esp + 0x22], 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x4c574c
push ebx
push esi
push edi
lea edx, [esp + 0x10]
push 0x5af344
push edx
call dword [sym.imp.MSVCR90.dll_fopen]
mov ebx, dword [sym.imp.MSVCR90.dll_fseek]
push 2
mov esi, eax
push 0
push esi
call ebx
push esi
call dword [sym.imp.MSVCR90.dll_ftell]
push 0
push 0
push esi
mov edi, eax
call ebx
lea eax, [edi + 1]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
push esi
push edi
mov ebx, eax
push 1
push ebx
call dword [sym.imp.MSVCR90.dll_fread]
push esi
mov byte [ebx + edi], 0
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x3c
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp], edi
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005997a8
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.005997a8
add esp, 0x10
ret

Function at 0x4c6960
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x6854b1], 0
push esi
mov esi, ecx
je 0x4c6983
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
mov dword [0x6a01c0], eax
mov byte [0x6854b1], 0
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xc]
mov edx, eax
sub edx, ecx
mov dword [0x6a01c0], eax
cmp eax, ecx
jae 0x4c699a
dec edx
mov dword [0x6a01b8], edx
mov dword [esi + 0xc], eax
mov eax, dword [0x6a01b8]
add dword [0x6a01bc], eax
add dword [esi + 8], eax
cmp dword [esi + 8], 0x5265c00
jb 0x4c69c4
inc dword [esi + 4]
add dword [esi + 8], 0xfad9a400
pop esi
ret
Function at 0x4cf8f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4cf91f
pop edi
xor eax, eax
pop esi
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x500
lea edx, [edi + 0x504]
push edx
push esi
call ebx
test eax, eax
jne 0x4cf94f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
ret 4
push 0
lea eax, [esp + 0x14]
push eax
push 0x140
add edi, 0xb44
push edi
push esi
call ebx
push esi
test eax, eax
je 0x4cf941
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
ret 4
Function at 0x4d5060
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push connect
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d5093
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x20], 0
call edi
test eax, eax
je 0x4d50d8
cmp dword [esp + 0x10], 0x61208
jne 0x4d50d8
push 0
lea edx, [esp + 0x10]
push edx
push 0x164
add ebx, 4
push ebx
push esi
call edi
test eax, eax
jne 0x4d50e8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [esp + 0xc], 0x164
push esi
ja 0x4d50d9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x4d5110
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d5176
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0x61208
call edi
push 0
lea edx, [esp + 0x14]
push edx
push 0x164
add ebx, 4
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4f1120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5a2cfb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x691844]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
push 0x3d
lea eax, [esi + 0x38]
push edi
push eax
mov dword [esi], vtable.COBalloonName.0
mov dword [esi + 0x78], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x7c], 0xffffff
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call sub.MSVCR90.dll_memset
xor eax, eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov byte [esi + 0x90], al
mov dword [esi + 0x91], eax
mov dword [esi + 0x95], eax
mov dword [esi + 0x99], eax
mov dword [esi + 0x9d], eax
mov dword [esi + 0xa1], eax
mov dword [esi + 0xa5], eax
mov dword [esi + 0xa9], eax
mov dword [esi + 0xad], eax
mov byte [esi + 0xb1], al
mov dword [esi + 0xb2], eax
mov dword [esi + 0xb6], eax
mov dword [esi + 0xba], eax
mov dword [esi + 0xbe], eax
mov dword [esi + 0xc2], eax
mov dword [esi + 0xc6], eax
mov dword [esi + 0xca], eax
mov dword [esi + 0xce], eax
mov byte [esi + 0xd2], al
mov dword [esi + 0xd3], eax
mov dword [esi + 0xd7], eax
mov dword [esi + 0xdb], eax
mov dword [esi + 0xdf], eax
mov dword [esi + 0xe3], eax
mov dword [esi + 0xe7], eax
mov dword [esi + 0xeb], eax
mov dword [esi + 0xef], eax
push 0x1c8
mov byte [esi + 0xf3], al
call fcn.00599902
add esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], edi
cmp eax, edi
je 0x4f126b
mov ecx, eax
call fcn.0042ce10
jmp 0x4f126d
xor eax, eax
mov dword [esi + 0x100], eax
mov dword [esi + 0xfc], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0x104], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret