joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f88d0
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e2f3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x661850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push str.Tue_Jun__9_22:22:25_2015
push 0x16a
push str.CStallWnd::OnLButtonDown
push str.GameProcessStallWnd.cpp
lea ecx, [ebp - 0xd]
call fcn.004024e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.004f77d0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x2e8c
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4f89a3
cmp dword [0x66ada0], 3
jne 0x4f896b
push 0x103
mov eax, dword [ebp - 0x18]
add eax, 0x1b4
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x2fcc
call fcn.004f67e0
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x2fcc
call fcn.004f67e0
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x2fcc
call fcn.004f67e0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x66ada0], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x648
call fcn.004d0ed0
movzx eax, al
test eax, eax
je 0x4f89db
mov byte [ebp - 0xe], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov al, byte [ebp - 0xe]
jmp 0x4f8ac0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x2b8
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x2b8]
mov eax, dword [edx + 8]
call eax
movzx ecx, al
test ecx, ecx
je 0x4f8a1c
mov byte [ebp - 0xf], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov al, byte [ebp - 0xf]
jmp 0x4f8ac0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x3e8
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x3e8]
mov edx, dword [eax + 8]
call edx
movzx eax, al
test eax, eax
je 0x4f8a5a
mov byte [ebp - 0x10], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov al, byte [ebp - 0x10]
jmp 0x4f8ac0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
add ecx, 0x518
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x518]
mov eax, dword [edx + 8]
call eax
movzx ecx, al
test ecx, ecx
je 0x4f8a98
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov al, byte [ebp - 0x11]
jmp 0x4f8ac0
mov edx, dword [ebp - 0x18]
movzx eax, byte [edx + 4]
test eax, eax
jne 0x4f8aaa
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 0x36], 1
mov byte [ebp - 0x12], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov al, byte [ebp - 0x12]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x504f70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ef30
mov eax, dword fs:[0]
push eax
sub esp, 0x624
mov eax, dword [0x661850]
xor eax, ebp
mov dword [ebp - 0x24], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x630], ecx
push str.Mon_Aug_10_12:09:09_2015
push 0x1c9
push str.CClientSocket::SendRunLogin
push str.Mir3ClientSocket.cpp
lea ecx, [ebp - 0x19]
call fcn.004024e0
mov dword [ebp - 4], 0
mov byte [ebp - 0x424], 0
push 0x1ff
push 0
lea eax, [ebp - 0x423]
push eax
call fcn.005454d0
add esp, 0xc
mov byte [ebp - 0x624], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x623]
push ecx
call fcn.005454d0
add esp, 0xc
mov byte [ebp - 0x224], 0
push 0x1ff
push 0
lea edx, [ebp - 0x223]
push edx
call fcn.005454d0
add esp, 0xc
mov ecx, 0x6acf18
call fcn.004321d0
mov eax, dword [ebp + 0x10]
xor eax, 0x3eb2c5cc
mov dword [ebp - 0x62c], eax
mov ecx, dword [ebp + 0x10]
xor ecx, dword [ebp + 0x14]
xor ecx, 0x5580af27
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x14]
xor edx, 0xfa0280af
mov dword [ebp - 0x10], edx
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x62c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s__s__d__d__d_1__d
lea edx, [ebp - 0x624]
push edx
call fcn.005456a9
add esp, 0x20
mov dword [ebp - 0x14], str.2_5_2_1_6_8_9_3_4_1_8_4_2_0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x624]
push ecx
call fcn.00545a90
add esp, 4
push eax
lea edx, [ebp - 0x624]
push edx
call dword [0x69d474]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
push str._s
lea ecx, [ebp - 0x624]
push ecx
call fcn.005456a9
add esp, 0xc
push 0x200
lea edx, [ebp - 0x624]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x624]
push ecx
call fcn.00509a70
mov dword [ebp - 0x628], eax
mov edx, dword [ebp - 0x628]
mov byte [ebp + edx - 0x424], 0
mov eax, dword [ebp - 0x630]
mov dword [eax + 0xe10c], 2
lea ecx, [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x630]
mov eax, dword [edx + 0xe10c]
push eax
push str._d_s_
lea ecx, [ebp - 0x224]
push ecx
call fcn.005456a9
add esp, 0x10
lea edx, [ebp - 0x224]
push edx
call fcn.00545a90
add esp, 4
push eax
lea eax, [ebp - 0x224]
push eax
push 0x69ce30
call fcn.00545160
add esp, 0xc
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.00545a90
add esp, 4
push eax
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x630]
mov ecx, dword [eax + 0xe11c]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x19]
call fcn.00402620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0054514c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5063f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f10e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x661850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push str.Mon_Aug_10_12:09:09_2015
push 0x3c2
push str.CClientSocket::SendPacket
push str.Mir3ClientSocket.cpp
lea ecx, [ebp - 0xd]
call fcn.004024e0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 4]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00508ed0
movzx edx, al
test edx, edx
je 0x506466
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
jmp 0x506594
push 0x104
mov eax, dword [ebp - 0x14]
add eax, 0x8008
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00509d00
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0xe10c], 9
jl 0x50649f
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xe10c], 1
mov dword [ebp - 0x18], 1
jmp 0x5064c0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xe10c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xe10c]
add ecx, 1
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xe10c], ecx
cmp dword [ebp + 0xc], 0
je 0x506521
push 0x2000
mov eax, dword [ebp + 0xc]
push eax
call fcn.00545a90
add esp, 4
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x810c
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00509a70
mov eax, dword [ebp - 0x14]
add eax, 0x810c
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x8008
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xe10c]
push eax
push str._d_s_s_
mov ecx, dword [ebp - 0x14]
add ecx, 0xa10c
push ecx
call fcn.005456a9
add esp, 0x14
jmp 0x50654c
mov edx, dword [ebp - 0x14]
add edx, 0x8008
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xe10c]
push ecx
push str._d_s_
mov edx, dword [ebp - 0x14]
add edx, 0xa10c
push edx
call fcn.005456a9
add esp, 0x10
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 4]
test ecx, ecx
je 0x506585
push 0
mov edx, dword [ebp - 0x14]
add edx, 0xa10c
push edx
call fcn.00545a90
add esp, 4
push eax
mov eax, dword [ebp - 0x14]
add eax, 0xa10c
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xe11c]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x507470
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f333
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x661850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
push str.Mon_Aug_10_12:09:09_2015
push 0x53a
push str.CClientSocket::SendPresent
push str.Mir3ClientSocket.cpp
lea ecx, [ebp - 0xd]
call fcn.004024e0
mov dword [ebp - 4], 0
push 0x475
mov ecx, dword [ebp - 0x20]
call fcn.00508ed0
movzx eax, al
test eax, eax
je 0x5074e3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
jmp 0x5075e6
lea ecx, [ebp - 0x1c]
call fcn.0043b330
push 0
push 0
push 0
push 0
push 0x475
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00509d80
push 0x104
mov edx, dword [ebp - 0x20]
add edx, 0x8008
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00509d00
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0xe10c], 9
jl 0x50753b
mov edx, dword [ebp - 0x20]
mov dword [edx + 0xe10c], 1
mov dword [ebp - 0x24], 1
jmp 0x50755c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xe10c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0xe10c]
add eax, 1
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xe10c], eax
push 0x2000
push 0x253
mov edx, dword [ebp - 0x20]
add edx, 0x810c
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00509a70
mov ecx, dword [ebp - 0x20]
add ecx, 0x810c
push ecx
mov edx, dword [ebp - 0x20]
add edx, 0x8008
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0xe10c]
push ecx
push str._d_s_s_
push 0x7ce7bc
call fcn.005456a9
add esp, 0x14
push 0
mov edx, dword [ebp - 0x20]
add edx, 0xa10c
push edx
call fcn.00545a90
add esp, 4
push eax
mov eax, dword [ebp - 0x20]
add eax, 0xa10c
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xe11c]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x509bc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push eax
call fcn.00545a90
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 2
mov dword [ebp - 4], 0
mov byte [ebp - 9], 0
mov dword [ebp - 0x1c], 0
jmp 0x509c00
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 8]
jge 0x509cf3
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x1c]
movsx ecx, byte [eax]
sub ecx, 0x3c
js 0x509c2b
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x1c]
movsx eax, byte [edx]
sub eax, 0x3c
mov byte [ebp - 0x16], al
jmp 0x509c5e
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx]
cmp edx, 0x2a
jne 0x509c52
push 0
push 1
push 0x5771c0
mov eax, dword [0x7d27cc]
push eax
call dword [sym.imp.WS2_32.dll_send]
jmp 0x509bf7
mov dword [ebp - 0x14], 0
jmp 0x509cf3
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jl 0x509c6b
jmp 0x509cf3
mov edx, dword [ebp - 4]
add edx, 6
cmp edx, 8
jl 0x509cc8
movzx eax, byte [ebp - 9]
movzx edx, byte [ebp - 0x16]
and edx, 0x3f
mov ecx, 6
sub ecx, dword [ebp - 0x10]
sar edx, cl
or eax, edx
mov byte [ebp - 0x15], al
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x14]
mov cl, byte [ebp - 0x15]
mov byte [eax], cl
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 6
jge 0x509cbc
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
jmp 0x509cc8
mov dword [ebp - 0x10], 2
jmp 0x509bf7
movzx edx, byte [ebp - 0x16]
mov ecx, dword [ebp - 0x10]
shl edx, cl
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x65f616]
and edx, ecx
mov byte [ebp - 9], dl
mov edx, 8
sub edx, dword [ebp - 0x10]
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
jmp 0x509bf7
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x509e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], 0
jmp 0x509e9d
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x509f71
push 0x31
push 0
call fcn.0053e280
add esp, 8
add eax, 0xa
mov byte [ebp - 9], al
push 0x13
push 0
call fcn.0053e280
add esp, 8
add eax, 0xa
mov byte [ebp - 1], al
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx]
mov byte [ebp - 0xa], dl
movzx eax, byte [ebp - 0xa]
xor eax, 0x87
mov byte [ebp - 0xa], al
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 1]
mov byte [ecx - 1], dl
mov eax, dword [ebp - 8]
mov cl, byte [ebp - 9]
mov byte [eax + 8], cl
mov dword [ebp - 0x20], 0
jmp 0x509f03
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 8
jge 0x509f5a
mov byte [ebp - 0xb], 0x80
mov al, byte [ebp - 0xb]
mov cl, byte [ebp - 0x20]
shr al, cl
mov byte [ebp - 0xb], al
movzx ecx, byte [ebp - 1]
sub ecx, 1
push ecx
push 0
call fcn.0053e280
add esp, 8
mov byte [ebp - 0x11], al
movzx edx, byte [ebp - 0xb]
movzx eax, byte [ebp - 0xa]
and edx, eax
je 0x509f46
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp - 0x11]
add edx, ecx
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
movzx ecx, byte [ebp - 9]
add eax, ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x20]
mov byte [edx], al
jmp 0x509efa
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
add ecx, 0xa
mov dword [ebp - 8], ecx
jmp 0x509e94
mov esp, ebp
pop ebp
ret
Function at 0x50e970
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x661850]
xor eax, ebp
mov dword [ebp - 0x20], eax
cmp dword [0x664d5c], 0
jbe 0x50eaad
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0x664d60]
mov ecx, dword [0x664d5c]
imul ecx, ecx, 0x3e8
cmp eax, ecx
jae 0x50e9cc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x664d64]
mov edx, dword [0x664d5c]
imul edx, edx, 0x3e8
cmp eax, edx
jb 0x50eaad
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0x664d60]
mov dword [ebp - 0x12c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x664d64]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [0x664d60], 0
mov dword [0x664d64], 0
mov dword [0x664d5c], 0
mov byte [ebp - 0x128], 0
push 0x103
push 0
lea eax, [ebp - 0x127]
push eax
call fcn.005454d0
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x12c]
push eax
push str._d__d__d
lea ecx, [ebp - 0x128]
push ecx
call fcn.005456a9
add esp, 0x14
mov dword [ebp - 4], str.2_5_2_1_6_8_9_3_4_1_8_4_2_0
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.00545a90
add esp, 4
push eax
lea ecx, [ebp - 0x128]
push ecx
call dword [0x69d474]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x1c]
call fcn.0043b330
push 0
push 0
push 0
push 0
push 0xea75
lea edx, [ebp - 0x1c]
push edx
call fcn.00509d80
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, 0x7c46b0
call fcn.005063f0
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0054514c
mov esp, ebp
pop ebp
ret

Function at 0x50eac0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
jmp 0x50ead8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x50eb30
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x50eaf9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x50eb21
mov eax, dword [ebp - 4]
and eax, 1
je 0x50eb17
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x50eb1f
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x50eaf0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x69d060], ecx
jmp 0x50eacf
mov esp, ebp
pop ebp
ret
Function at 0x50eff0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56fd0b
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x661850]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [0x69d460]
cmp eax, 0x1f4397a8
jne 0x50f031
mov byte [0x69e65a], 1
mov dword [ebp - 0x244], 0x94
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x50f162
cmp dword [ebp - 0x234], 1
jne 0x50f068
mov dword [0x69e648], 1
jmp 0x50f162
cmp dword [ebp - 0x234], 2
jne 0x50f089
cmp dword [ebp - 0x240], 4
jne 0x50f089
mov dword [0x69e648], 2
jmp 0x50f162
cmp dword [ebp - 0x234], 2
jne 0x50f0b3
cmp dword [ebp - 0x240], 5
jne 0x50f0b3
cmp dword [ebp - 0x23c], 0
jne 0x50f0b3
mov dword [0x69e648], 3
jmp 0x50f162
cmp dword [ebp - 0x234], 2
jne 0x50f13a
cmp dword [ebp - 0x240], 5
jne 0x50f13a
cmp dword [ebp - 0x23c], 1
jne 0x50f13a
mov dword [0x69e648], 4
push 0x585ba0
lea ecx, [ebp - 0x230]
push ecx
call fcn.004372c0
add esp, 8
test eax, eax
jne 0x50f138
push 0x585b9c
lea edx, [ebp - 0x230]
push edx
call fcn.004372c0
add esp, 8
test eax, eax
jne 0x50f138
push 0x585b98
lea eax, [ebp - 0x230]
push eax
call fcn.004372c0
add esp, 8
test eax, eax
jne 0x50f138
push 0
push 0
push 0x585b88
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0054b4be
jmp 0x50f162
cmp dword [ebp - 0x234], 2
jne 0x50f158
cmp dword [ebp - 0x240], 6
jne 0x50f158
mov dword [0x69e648], 5
jmp 0x50f162
mov dword [0x69e648], 6
mov dword [ebp - 0xac], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
lea esi, [ebp - 0xac]
mov eax, 1
xor ecx, ecx
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0xa4]
push eax
mov ecx, dword [ebp - 0xa8]
push ecx
mov edx, dword [ebp - 0xac]
push edx
push str._x_x_x_x
push 0x104
push 0x69e320
call fcn.0054572d
add esp, 0x1c
lea ecx, [ebp - 0x9c]
call fcn.0040dd10
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x9c]
call fcn.0040df10
push 0x585b78
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x50f21a
lea ecx, [ebp - 0x98]
push ecx
push 0x575830
push 0x69e218
call fcn.00439720
add esp, 0xc
jmp 0x50f251
movsx edx, byte [ebp - 0x58]
test edx, edx
je 0x50f23a
lea eax, [ebp - 0x58]
push eax
push 0x575830
push 0x69e218
call fcn.00439720
add esp, 0xc
jmp 0x50f251
push str.UnKnown
push 0x575830
push 0x69e218
call fcn.00439720
add esp, 0xc
mov byte [ebp - 0x1ac], 0
push 0xff
push 0
lea ecx, [ebp - 0x1ab]
push ecx
call fcn.005454d0
add esp, 0xc
push str.Dn_BtUKcoHfGyIYj
push 0x575830
lea edx, [ebp - 0x1ac]
push edx
call fcn.005456a9
add esp, 0xc
push 0xc
push 0x69e530
lea eax, [ebp - 0x1ac]
push eax
call fcn.00509bc0
push str._____c______c______c______c
push 0x69e530
call fcn.00545750
add esp, 8
push 0xc
push 0x69e635
lea ecx, [ebp - 0x1ac]
push ecx
call fcn.00509bc0
push eax
call fcn.00408ed0
call [eax - 0x39]
inc ebp
cld
Function at 0x512000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push str.Sun_Oct__5_10:27:24_2014
push 0x232
push str.CChatEdit::Create
push str.UIChatEditBox.cpp
lea ecx, [ebp - 1]
call fcn.004024e0
mov eax, dword [ebp - 8]
mov byte [eax + 4], 0
mov ecx, dword [ebp - 8]
mov byte [ecx + 5], 0
mov edx, dword [ebp - 8]
mov dword [edx + 8], 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0x90000080
push 0x574a9b
push str.EDIT
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
push 0x510fc0
push 0xfffffffffffffffc
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x14], 0
je 0x5120b0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], 0
push 0x578044
push 0
push 0
push 0
push 0
push 0x86
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0xc
call dword [sym.imp.GDI32.dll_CreateFontA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], eax
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
push 0x30
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x5f
push 0xc5
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov byte [ebp - 2], 1
lea ecx, [ebp - 1]
call fcn.00402620
mov al, byte [ebp - 2]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x518920
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570a8a
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x661850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push str.Tue_Jun__9_21:48:49_2015
push 0x74
push str.CCharacterProcess::SetNextProc
push str.CharSelectProcessCharacterProcess.cpp
lea ecx, [ebp - 0xd]
call fcn.004024e0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
call fcn.005189e0
mov dword [0x69edfa], 0x6acf18
mov eax, dword [0x69edfa]
mov dword [0x7d27d4], eax
mov ecx, 0x6acf18
call fcn.00412900
push 0x78
mov ecx, 0x7c0e48
call fcn.005121c0
push 0
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xc
mov ecx, 0x7c0e48
call fcn.00512140
mov byte [0x69e641], 3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x519a50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x570bcf
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x661850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push str.Tue_Jun__9_21:48:49_2015
push 0x1f9
push str.CCharacterProcess::OnWindowMove
push str.CharSelectProcessCharacterProcess.cpp
lea ecx, [ebp - 0xd]
call fcn.004024e0
mov dword [ebp - 4], 0
push 0
mov ecx, 0x7c0e48
call fcn.0043b450
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, 0x69ec08
call fcn.00534910
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x51d390
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
pop ebp
ret