joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4160
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
or ebp, 0xffffffff
push 0x5fc9f4
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
call fcn.00566e70
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.004c3ea0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00588796
mov eax, dword [0x679830]
add esp, 4
cmp eax, ebx
jne 0x4c41b4
mov eax, 0x5ad73f
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
call fcn.00566e70
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.004c3e40
mov eax, dword [esp + 0x10]
push eax
call fcn.00588796
mov eax, dword [edi + 0x14]
add esp, 4
cmp eax, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebp
jne 0x4c41f3
mov eax, 0x5ad73f
push eax
lea ecx, [esp + 0x1c]
call fcn.00566e70
push 0x5c6420
lea ecx, [esp + 0x1c]
call fcn.00566ee0
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x4c4218
mov eax, 0x5ad73f
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x4c42fa
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebp
call fcn.00566e70
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, edi
call fcn.004c4020
mov ecx, dword [edi + 0x1c]
cmp ecx, ebx
jne 0x4c4263
mov ecx, 0x5ad73f
mov eax, dword [eax]
cmp eax, ebx
jne 0x4c4270
mov eax, 0x5ad73f
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c4290
cmp dl, bl
je 0x4c428c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c4290
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x4c4270
xor esi, esi
jmp 0x4c4294
sbb esi, esi
sbb esi, ebp
mov edx, dword [esp + 0x30]
push edx
call fcn.00588796
mov eax, dword [esp + 0x24]
push eax
call fcn.00588796
add esp, 8
cmp esi, ebx
jne 0x4c42de
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebp
call fcn.00566e70
lea edx, [esp + 0x28]
push edx
mov ecx, edi
call fcn.004c4070
mov eax, dword [esp + 0x28]
push eax
call fcn.00588796
add esp, 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x4c4230
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [esp + 0x18]
push eax
call fcn.00588796
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e6ba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
mov bl, byte [esp + 0x20]
test bl, bl
push edi
mov edi, ecx
je 0x4e6ca2
cmp byte [edi + 0x112], 0
jne 0x4e6ca2
cmp byte [0x91d405], 0
jne 0x4e6ca2
fld dword [0x5adc38]
mov edx, dword [0x9f9488]
push esi
xor esi, esi
mov ecx, 0x682c9c
cmp dword [ecx], 2
jne 0x4e6c06
mov eax, edx
and eax, 0xff
fld dword [eax*4 + 0x9f948c]
add edx, 1
fcomp st(1)
mov dword [0x9f9488], edx
fnstsw ax
test ah, 5
jnp 0x4e6c28
add ecx, 0x600c
add esi, 1
cmp ecx, 0x8f317c
jl 0x4e6be1
pop esi
fstp st(0)
mov byte [edi + 0x112], bl
pop edi
pop ebx
add esp, 0x18
ret 4
mov al, 0x5a
fstp st(0)
mov byte [esp + 0x13], al
mov byte [esp + 0x15], al
mov byte [esp + 0xc], 0x50
mov byte [esp + 0xd], 0x64
mov byte [esp + 0xe], 0x70
mov byte [esp + 0xf], 0x63
mov byte [esp + 0x10], 0x6b
mov byte [esp + 0x11], 0x6d
mov byte [esp + 0x12], 0x67
mov byte [esp + 0x14], 0x66
mov byte [esp + 0x16], 0x5b
mov byte [esp + 0x17], 0xf5
xor eax, eax
jmp 0x4e6c70
mov cl, byte [esp + eax + 0xc]
add cl, al
mov byte [esp + eax + 0x18], cl
add eax, 1
cmp eax, 0xc
jb 0x4e6c70
lea edx, [esp + 0x18]
push edx
push 1
push esi
mov ecx, 0x908488
call fcn.0046c780
imul esi, esi, 0x600c
mov byte [esi + 0x684b94], 1
pop esi
mov byte [edi + 0x112], bl
pop edi
pop ebx
add esp, 0x18
ret 4

Function at 0x4e7420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [esp + 4]
mov byte [ecx + 0xe4], 0
fld qword [0xa1e878]
fst dword [ecx + 0xb8]
fstp dword [ecx + 0xb4]
fld dword [eax + 0xc]
fstp dword [ecx + 0xbc]
mov eax, dword [eax + 8]
cmp eax, dword [0x8f71c0]
je 0x4e745f
mov dword [esp + 4], eax
mov ecx, 0x8f71b0
jmp fcn.004399a0
ret 4
Function at 0x4f15d0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x4f1604
push 0
push 0
push eax
call fcn.0058aafd
mov eax, dword [esi]
push eax
push 1
lea ecx, [esi + 0x18]
push 4
push ecx
call fcn.0058b709
mov edx, dword [esi]
push edx
call fcn.0058b205
add esp, 0x20
mov dword [esi], 0
pop esi
ret

Function at 0x4f1610
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
push edi
mov edi, dword [esp + 0xc]
jle 0x4f1645
push ebx
movzx ebx, byte [eax + edi]
mov edx, dword [ecx + 0xc]
imul ebx, edx
add dword [ecx + 0x18], ebx
mov ebx, dword [ecx + 0x10]
mov dword [ecx + 0xc], ebx
mov ebx, dword [ecx + 0x14]
add eax, 1
cmp eax, esi
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], edx
jl 0x4f1621
pop ebx
mov eax, dword [ecx]
push eax
push 1
push esi
push edi
call fcn.0058b709
add esp, 0x10
pop edi
pop esi
ret 8
Function at 0x507140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fld dword [esp + 4]
fmul dword [str.fff_]
fadd dword [ecx + 0x335c]
fst dword [ecx + 0x335c]
fld dword [ecx + 0x336c]
fadd dword [0x5ed558]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jp 0x507175
fstp dword [ecx + 0x335c]
jmp 0x507177
fstp st(0)
fld dword [ecx + 0x336c]
fadd dword [0x5bf864]
fcomp dword [ecx + 0x335c]
fnstsw ax
test ah, 5
jp 0x5071cc
cmp dword [ecx + 0x3870], 0
jne 0x5071a3
mov dword [ecx + 0x3870], 1
fld dword [ecx + 0x3374]
fadd dword [ecx + 0x3364]
fmul dword [0x5ad750]
fcom dword [ecx + 0x3364]
fnstsw ax
test ah, 5
jp 0x5071ca
fstp dword [ecx + 0x3364]
jmp 0x5071cc
fstp st(0)
fld dword [ecx + 0x336c]
fadd dword [0x5ae17c]
fcomp dword [ecx + 0x335c]
fnstsw ax
test ah, 5
jp 0x5071f1
fld dword [ecx + 0x3374]
fstp dword [ecx + 0x3364]
mov dword [esp + 4], 0
jmp fcn.005049e0
Function at 0x51aa20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x58
mov cl, 0x6b
mov al, 0x77
mov byte [esp + 5], cl
mov byte [esp + 6], cl
xor ecx, ecx
mov byte [esp + 2], al
mov byte [esp + 4], al
mov byte [esp + 0x11], al
mov byte [esp], 0x46
mov byte [esp + 1], 0x70
mov byte [esp + 3], 0x69
mov byte [esp + 7], 0x28
mov byte [esp + 8], 0x5f
mov byte [esp + 9], 0x73
mov byte [esp + 0xa], 0x6f
mov byte [esp + 0xb], 0x79
mov byte [esp + 0xc], 0x6e
mov byte [esp + 0xd], 0x7c
mov byte [esp + 0xe], 0x49
mov byte [esp + 0xf], 0x4a
mov byte [esp + 0x10], 0x64
mov byte [esp + 0x12], 0x87
mov byte [esp + 0x13], 0x89
mov byte [esp + 0x14], 0x85
mov byte [esp + 0x15], 0x3e
mov byte [esp + 0x16], 0x40
mov byte [esp + 0x17], cl
xor eax, eax
lea esp, [esp]
mov dl, byte [esp + eax]
sub dl, al
sub dl, 1
mov byte [esp + eax + 0x18], dl
add eax, 1
cmp eax, 0x17
jb 0x51aaa0
cmp dword [0xa1a2c8], 2
mov byte [esp + eax + 0x18], cl
jl 0x51aaec
push 0x59d
push 0x61ef68
mov ecx, 0xa1a2c8
call fcn.004f3e00
lea eax, [esp + 0x18]
push eax
push 0x5c4e50
push 0xa1a2c8
call fcn.004f3d30
add esp, 0xc
xor eax, eax
add esp, 0x58
ret

Function at 0x51c390
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
push edi
je 0x51c3a4
push 0
push eax
call dword [sym.imp.mss32.dll__AIL_set_input_state_8]
cmp dword [esi + 0x1034], 0
lea edi, [esi + 0x1034]
mov byte [esi], 0
mov byte [esi + 1], 0
je 0x51c406
cmp dword [esi + 0x1038], 0
je 0x51c406
cmp dword [esi + 0x103c], 0
je 0x51c406
push 0x3e8
push 1
push edi
push 3
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x51c406
mov eax, dword [edi]
mov edi, dword [sym.imp.kernel32.dll_TerminateThread]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x1038]
push 0xffffffffffffffff
push ecx
call edi
mov edx, dword [esi + 0x103c]
push 0xffffffffffffffff
push edx
call edi
pop edi
pop esi
ret

Function at 0x51c4c0
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.kernel32.dll_TerminateThread]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x14]
xor ebp, ebp
cmp eax, ebp
push edi
mov edi, dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [esi + 0x10], 1
je 0x51c4fe
push 0xc8
push eax
call edi
cmp eax, 0x102
jne 0x51c4fb
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push eax
call ebx
mov dword [esi + 0x14], ebp
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x51c51f
push 0xc8
push eax
call edi
cmp eax, 0x102
jne 0x51c51c
mov ecx, dword [esi + 0x18]
push 0xffffffffffffffff
push ecx
call ebx
mov dword [esi + 0x18], ebp
pop edi
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
pop esi
pop ebp
pop ebx
ret 4
Function at 0x51d680
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov byte [esi + 0x26080], 1
call fcn.0051d570
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x51d290
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x26084], eax
cmp dword [0xa1a2c8], 1
pop esi
jl 0x51d6de
push 0x47f
push str...Source_voicechat.cpp
mov ecx, 0xa1a2c8
call fcn.004f3e00
push str.Voice_Chat:_Server_started
push 0xa1a2c8
call fcn.004f3d30
add esp, 8
pop ecx
ret

Function at 0x51d7b0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push esi
push edi
mov dword [esp + 0x14], ecx
lea esi, [ecx + 8]
mov dword [esp + 0x10], 0x10
xor ebx, ebx
jmp 0x51d704
mov ecx, dword [esp + 0x14]
lea eax, [esi - 8]
push eax
call fcn.0051c4c0
mov edi, dword [esi - 4]
cmp edi, ebx
je 0x51d726
lea ecx, [edi + 0x14008]
push ecx
call ebp
push edi
call fcn.00588796
add esp, 4
mov edi, dword [esi]
cmp edi, ebx
mov dword [esi - 4], ebx
je 0x51d741
lea edx, [edi + 0x14008]
push edx
call ebp
push edi
call fcn.00588796
add esp, 4
mov edi, dword [esi + 0x44]
cmp edi, ebx
mov dword [esi], ebx
je 0x51d75c
lea eax, [edi + 0x27108]
push eax
call ebp
push edi
call fcn.00588796
add esp, 4
mov dword [esi + 0x44], ebx
add esi, 0x2608
sub dword [esp + 0x10], 1
jne 0x51d700
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push esi
mov esi, ecx
mov al, byte [esi + 0x26080]
test al, al
je 0x51d802
mov eax, dword [esi + 0x26084]
test eax, eax
mov byte [esi + 0x26080], 0
je 0x51d7fa
push 0x3e8
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x51d7f0
mov ecx, dword [esi + 0x26084]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.kernel32.dll_TerminateThread]
mov dword [esi + 0x26084], 0
mov ecx, esi
pop esi
jmp 0x51d6e0
pop esi
ret
Function at 0x524100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x200
mov esi, edx
mov dword [esp + 0x28], ebx
call fcn.00566ab0
fld dword [ebp + 0x14]
fld dword [ebp + 0x10]
mov dword [esp + 0x30], eax
fsub st(1), st(0)
lea eax, [esp + 0x78]
fxch st(1)
mov dword [esp + 0x40], eax
lea ecx, [esp + 0xa0]
fst dword [esp + 0x34]
lea edx, [esp + 0xc8]
fst qword [esp + 0x58]
lea eax, [esp + 0xf0]
fld st(0)
mov dword [esp + 0x44], ecx
fmul st(1)
mov ecx, dword [ebp + 8]
mov dword [esp + 0x48], edx
mov edx, dword [ebp + 0xc]
fst qword [esp + 0x50]
mov dword [esp + 0x4c], eax
fld st(0)
mov eax, ebx
fmul st(2)
mov ebx, dword [ebp + 0x1c]
sub eax, esi
sub ecx, esi
fstp qword [esp + 0x68]
sub edx, esi
fld dword [ebp + 0x18]
xor edi, edi
fsubrp st(3)
mov dword [esp + 0x2c], eax
fxch st(2)
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
fst dword [esp + 0x24]
sub ebx, esi
fstp qword [esp + 0x10]
fld st(1)
fmul qword [0x5cade0]
fstp qword [esp + 0x60]
fld st(0)
fadd st(1)
fstp qword [esp + 0x70]
jmp 0x5241d4
fld qword [esp + 0x50]
mov edx, dword [esp + 0x3c]
fld qword [esp + 0x58]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
fldz
fld1
fxch st(1)
fst qword [esp + 0x78]
fst qword [esp + 0x80]
fst qword [esp + 0x88]
fxch st(1)
fst qword [esp + 0x90]
fld dword [eax + esi]
fstp qword [esp + 0x98]
fxch st(1)
fst qword [esp + 0xa0]
fst qword [esp + 0xa8]
fst qword [esp + 0xb8]
fxch st(1)
fst qword [esp + 0xb0]
fld dword [esi]
fstp qword [esp + 0xc0]
fld qword [esp + 0x68]
fstp qword [esp + 0xc8]
fxch st(3)
fstp qword [esp + 0xd0]
fxch st(1)
fstp qword [esp + 0xd8]
fxch st(1)
fst qword [esp + 0xe0]
fld dword [ecx + esi]
fstp qword [esp + 0xe8]
fld qword [esp + 0x60]
lea ecx, [esp + 0x40]
fstp qword [esp + 0xf0]
fld qword [esp + 0x70]
fstp qword [esp + 0xf8]
fstp qword [esp + 0x100]
fstp qword [esp + 0x108]
fld dword [edx + esi]
mov edx, 4
fstp qword [esp + 0x110]
call fcn.00566d30
test eax, eax
jne 0x5242d5
fld qword [esp + 0x98]
add edi, 1
fld qword [esp + 0x10]
add esi, 4
cmp edi, 3
fmul st(1), st(0)
fxch st(1)
fadd qword [esp + 0xc0]
fmul st(1)
fadd qword [esp + 0xe8]
fmulp st(1)
fadd qword [esp + 0x110]
fstp dword [ebx + esi - 4]
jl 0x5241c0
jmp 0x524343
cmp edi, 3
jge 0x524343
fld dword [esp + 0x34]
fldz
fld st(0)
fucomp st(2)
fnstsw ax
test ah, 0x44
jp 0x5242ef
fstp st(1)
jmp 0x5242f5
fstp st(0)
fdivr dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [ebp + 8]
fld dword [ecx]
fsub dword [eax]
fld dword [ecx + 4]
fsub dword [eax + 4]
fld dword [ecx + 8]
fsub dword [eax + 8]
fxch st(2)
fmul st(3)
fxch st(1)
fmul st(3)
fxch st(2)
fmulp st(3)
fadd dword [eax]
fstp dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
fadd dword [eax + 4]
fstp dword [esp + 0x14]
mov edx, dword [esp + 0x14]
fadd dword [eax + 8]
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov dword [eax + 4], edx
fstp dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x30]
cmp ecx, 0x200
je 0x524354
call fcn.00566af0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x52c840
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x52c84f
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
jne 0x52c89c
call fcn.0059086e
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.0058ba27
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x52c897
mov edx, dword [esi + 0x40]
mov dword [esi + 0x3c], 1
or eax, 0xffffffff
test byte [edx + 0xc], 0x20
je 0x52c8ae
mov dword [esi + 0x38], eax
pop esi
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi + 4]
xor ecx, ecx
dec eax
mov dword [esi + 4], eax
mov eax, dword [esi]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
mov eax, ecx
pop esi
ret
Function at 0x52cc00
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x52cc84
cmp byte [esi + 0x5c], 0x77
jne 0x52cc84
push edi
mov edi, dword [esp + 0x10]
test edi, edi
mov dword [esi], ebx
mov dword [esi + 4], edi
je 0x52cc69
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x52cc49
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.0058b709
add esp, 0x10
cmp eax, 0x4000
jne 0x52cc62
mov dword [esi + 0x10], eax
xor edx, edx
mov ecx, esi
call fcn.0052d890
test eax, eax
mov dword [esi + 0x38], eax
jne 0x52cc69
mov eax, dword [esi + 4]
test eax, eax
jne 0x52cc1e
jmp 0x52cc69
mov dword [esi + 0x38], 0xffffffff
mov ecx, dword [esi + 0x4c]
push edi
mov edx, ebx
call fcn.0052e8b0
mov ecx, dword [esi + 4]
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
pop esi
sub eax, ecx
pop ebx
ret 4
pop esi
mov eax, 0xfffffffe
pop ebx
ret 4

Function at 0x52cce0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
test esi, esi
push edi
mov dword [esp + 0xc], edx
je 0x52cd8f
cmp byte [esi + 0x5c], 0x77
jne 0x52cd8f
mov dword [esi + 4], ebx
mov eax, dword [esi + 0x10]
mov edi, 0x4000
sub edi, eax
je 0x52cd31
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call fcn.0058b709
add esp, 0x10
cmp eax, edi
jne 0x52cd73
mov edx, dword [esi + 0x48]
mov dword [esi + 0x10], 0x4000
mov dword [esi + 0xc], edx
test ebx, ebx
jne 0x52cd7e
mov edx, dword [esp + 0xc]
mov ecx, esi
call fcn.0052d890
test edi, edi
mov dword [esi + 0x38], eax
jne 0x52cd4f
cmp eax, 0xfffffffb
jne 0x52cd4f
mov dword [esi + 0x38], edi
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x52cd60
cmp dword [esi + 0x38], 1
je 0x52cd60
xor ebx, ebx
jmp 0x52cd65
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x52cd01
cmp eax, 1
jne 0x52cd7e
jmp 0x52cd01
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
pop ecx
ret
mov esi, dword [esi + 0x38]
pop edi
mov eax, esi
dec eax
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebx
pop ecx
ret
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
pop ecx
ret
Function at 0x52e8b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
mov eax, ecx
jne 0x52e8bb
xor eax, eax
ret 4
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp esi, 8
not eax
jb 0x52e9ba
push edi
mov edi, esi
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x637300]
sub esi, 8
xor eax, ebx
inc edx
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov ecx, dword [ecx*4 + 0x637300]
shr eax, 8
xor ecx, eax
inc edx
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov eax, dword [eax*4 + 0x637300]
shr ecx, 8
xor eax, ecx
inc edx
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov ecx, dword [ecx*4 + 0x637300]
shr eax, 8
xor ecx, eax
inc edx
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov eax, dword [eax*4 + 0x637300]
shr ecx, 8
xor eax, ecx
inc edx
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov ecx, dword [ecx*4 + 0x637300]
shr eax, 8
xor ecx, eax
inc edx
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov eax, dword [eax*4 + 0x637300]
shr ecx, 8
xor eax, ecx
inc edx
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x637300]
xor eax, ecx
inc edx
dec edi
jne 0x52e8d2
pop edi
test esi, esi
je 0x52e9dc
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x637300]
xor eax, ecx
inc edx
dec esi
jne 0x52e9be
pop esi
pop ebx
not eax
ret 4
Function at 0x534030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x200
push ebp
push esi
push 0xff
lea eax, [esp + 0x10d]
push 0
push eax
mov ebp, ecx
mov byte [esp + 0x114], 0
call fcn.0058ac30
mov esi, dword [esp + 0x218]
add esp, 0xc
cmp byte [esi], 0
je 0x53412c
lea edx, [esp + 8]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x534071
lea ecx, [esp + 8]
push ecx
call fcn.0058b0cc
lea eax, [esp + 0xc]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x534091
sub eax, edx
cmp byte [esp + eax + 7], 0x5c
je 0x5340db
xor eax, eax
jmp 0x5340b0
mov cl, byte [esp + eax + 8]
mov byte [esp + eax + 0x108], cl
add eax, 1
test cl, cl
jne 0x5340b0
push edi
lea edi, [esp + 0x10c]
add edi, 0xffffffff
lea ecx, [ecx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x5340d0
pop edi
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x534109
push esi
push str.Path__s_does_not_exist
push eax
push ebp
call fcn.00533f30
add esp, 0x10
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x200
ret 8
test al, 0x10
jne 0x534131
push esi
push str.Path__s_is_not_a_directory
push 0xffffffffffffffff
push ebp
call fcn.00533f30
add esp, 0x10
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x200
ret 8
mov byte [esp + 8], 0
mov edx, dword [esp + 0x210]
lea eax, [esp + 8]
mov ecx, eax
sub edx, ecx
add edx, 4
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x534143
pop esi
xor eax, eax
pop ebp
add esp, 0x200
ret 8
Function at 0x536240
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
mov esi, ecx
call fcn.00535de0
test eax, eax
je 0x536274
lea eax, [esi + 0x14]
push eax
push edi
push str.Could_not_locate__s_in_MAS_file__s
push 0xfffffffffffffffe
push esi
call fcn.00533f30
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
mov edi, dword [esi + 0x120]
shl edi, 8
add edi, dword [esi + 0x124]
push ebx
mov eax, dword [edi + 0xf4]
push ebp
mov dword [esp + 0x14], eax
mov ebp, dword [edi + 0xf8]
push eax
call fcn.00587be5
push ebp
mov dword [esp + 0x18], eax
call fcn.00587be5
mov ecx, dword [esi + 0x13c]
add esp, 8
test byte [edi], 0x10
mov ebx, eax
push ecx
je 0x536349
push ebp
push 1
push ebx
call fcn.0058ba27
add esp, 0x10
cmp eax, ebp
je 0x5362ff
mov edx, dword [esp + 0x10]
push edx
call fcn.0058881a
push ebx
call fcn.0058881a
mov ecx, dword [esp + 0x24]
lea eax, [esi + 0x14]
push eax
push ecx
push str.Error_reading_compressed_file__s_from_MAS_file__s
push 0xffffffffffffffff
push esi
call fcn.00533f30
add esp, 0x1c
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
mov edi, dword [esp + 0x10]
push ebp
push ebx
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.005a8bc0
test eax, eax
je 0x53639c
push edi
call fcn.0058881a
push ebx
call fcn.0058881a
mov eax, dword [esp + 0x24]
lea edx, [esi + 0x14]
push edx
push eax
push str.Error_decompressing_file__s_from_MAS_file__s
push 0xffffffffffffffff
push esi
call fcn.00533f30
add esp, 0x1c
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push 1
push eax
call fcn.0058ba27
add esp, 0x10
cmp eax, dword [esp + 0x14]
je 0x536398
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0058881a
push ebx
call fcn.0058881a
mov eax, dword [esp + 0x24]
lea edx, [esi + 0x14]
push edx
push eax
push str.Error_reading_file__s_from_MAS_file__s
push 0xffffffffffffffff
push esi
call fcn.00533f30
add esp, 0x1c
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
mov edi, dword [esp + 0x10]
push ebx
call fcn.0058881a
push 0x10
call fcn.00588cb9
xor ecx, ecx
add esp, 8
cmp eax, ecx
je 0x5363d0
pop ebp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x10]
pop ebx
mov dword [eax], edi
pop edi
mov dword [eax + 8], ecx
pop esi
add esp, 8
ret 4
mov ecx, dword [esp + 0x14]
pop ebp
xor eax, eax
pop ebx
mov dword [eax], edi
pop edi
mov dword [eax + 8], ecx
pop esi
add esp, 8
ret 4