joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4415c0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
mov eax, dword [0x6b46b4]
push esi
xor esi, esi
test eax, eax
push edi
mov dword [esp + 0xc], 0
je 0x4415f1
mov byte [0x621f7c], 0
xor ax, ax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [0x621f7c]
test al, al
jne 0x4416d0
xor eax, eax
mov word [esp + 0x20], 0
mov ecx, 0x63
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, eax
test si, si
jne 0x4416a4
mov eax, dword [0x621f74]
test eax, eax
jne 0x44169f
lea ecx, [esp + 0xc]
push ecx
call fcn.00441540
add esp, 4
test eax, eax
jne 0x44164c
mov ax, 0xfff0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0xc]
mov eax, dword [eax]
mov cl, byte [eax]
mov dl, byte [eax + 1]
mov byte [esp + 0x15], dl
mov dl, byte [eax + 3]
mov byte [esp + 0x14], cl
mov cl, byte [eax + 2]
mov byte [esp + 0x17], dl
mov byte [esp + 0x16], cl
mov eax, dword [esp + 0x14]
mov ecx, eax
mov edx, eax
shr edx, 0x10
and ecx, 0xff0000
or ecx, edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
or edx, eax
shr ecx, 8
shl edx, 8
or ecx, edx
mov dword [0x621f78], ecx
jmp 0x4416a4
mov dword [0x621f78], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x57ad90
push 0x10400
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00449da0
mov dword [0x68c3b4], eax
mov byte [0x621f7c], 1
pop edi
mov ax, si
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x443620
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x104
push ebx
push edi
push eax
push str.maps_
push 0x68c5d0
lea ecx, [esp + 0x18]
push str._s_s_s.map
push ecx
xor bl, bl
call fcn.005c87a3
add esp, 0x14
push 0
push 0
push 3
push 0
push 1
push closesocket
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x443719
push 0
lea eax, [esp + 0xc]
push eax
push 0x800
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x443712
cmp dword [esp + 8], 0x800
jne 0x443712
cmp dword [esi], 0x68656164
jne 0x443704
cmp dword [esi + 0x7fc], 0x666f6f74
jne 0x443704
mov eax, dword [esi + 8]
test eax, eax
jl 0x443704
cmp eax, 0x18000000
jg 0x443704
lea eax, [esi + 0x20]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4436c0
sub eax, edx
cmp eax, 0x1f
ja 0x443704
cmp dword [esi + 4], 0x261
je 0x443710
lea ecx, [esp + 0xc]
mov dword [0x6bddc4], ecx
push 1
push 0x7e
push 0x89
call fcn.00582630
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop ebx
add esp, 0x104
ret
lea edx, [esp + 0xc]
mov dword [0x6bddc4], edx
jmp 0x4436e1
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop ebx
add esp, 0x104
ret
Function at 0x444000
Capabilities:
Timestomp file

Disassembly:
mov eax, dword [0x621f84]
mov ecx, dword [eax + 0x958]
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push 0
push ecx
call esi
test eax, eax
je 0x444043
mov edx, dword [0x621f84]
mov eax, dword [edx + 0x954]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x621f84]
mov edx, dword [ecx + 0x958]
push 0xffffffffffffffff
push edx
call esi
movsx esi, word [0x64729a]
imul esi, esi, 0x80c
lea eax, [esp + 8]
push eax
add esi, 0x644250
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea edi, [esi + 4]
push edi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edx, dword [esi]
push 0
push 0
push edi
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ax, word [0x64729a]
call fcn.004440a0
pop edi
mov byte [0x647298], 0
mov word [0x64729a], 0xffff
pop esi
add esp, 0x10
ret

Function at 0x4440a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x13c
push ebx
push ebp
movsx eax, ax
push esi
mov ecx, eax
push edi
imul ecx, ecx, 0x80c
push eax
push 0x647768
lea edx, [esp + 0x54]
push str._scache_03d.map
push edx
lea ebp, [ecx + 0x644250]
call fcn.005c87a3
mov eax, dword [ebp]
add esp, 0x10
xor ebx, ebx
push ebx
push ebx
lea esi, [ebp + 4]
push esi
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
cmp dword [0x6bd0f8], ebx
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], bl
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
jne 0x44410a
call fcn.00545fe0
cmp dword [0x6bd0f8], 3
jl 0x4441ba
mov edx, dword [ebp]
lea eax, [ebp + 0xc]
push eax
mov dword [esp + 0x18], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFileEx]
push edx
push eax
mov edi, 0x4445c0
xor edx, edx
mov ebx, 0x800
lea esi, [esp + 0x28]
call fcn.00443730
add esp, 0xc
lea esi, [esp + 0x13]
call fcn.004437a0
mov al, byte [esp + 0x13]
test al, al
je 0x4441f7
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
xor ebx, ebx
cmp dword [edi], 0x68656164
jne 0x44419f
cmp dword [edi + 0x7fc], 0x666f6f74
jne 0x44419f
mov eax, dword [edi + 8]
cmp eax, ebx
jl 0x44419f
cmp eax, 0x18000000
jg 0x44419f
lea eax, [edi + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x444188
sub eax, edx
cmp eax, 0x1f
ja 0x44419f
cmp dword [edi + 4], 0x261
je 0x444219
xor eax, eax
mov ecx, 0x200
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esi], ecx
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
add esp, 0x13c
ret
mov ecx, dword [ebp]
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4441f7
mov eax, dword [ebp]
push ebx
lea edx, [esp + 0x18]
push edx
push 0x800
lea edi, [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4441f7
cmp dword [esp + 0x14], 0x800
je 0x444160
push 1
lea edx, [esp + 0x50]
push 0x7e
push 0x89
mov dword [0x6bddc4], edx
call fcn.00582630
add esp, 0xc
mov dword [ebp], 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x13c
ret
Function at 0x444390
Capabilities:
Create thread

Disassembly:
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x6472c0], eax
mov eax, dword [0x6bd0f8]
test eax, eax
jne 0x4443b2
call fcn.00545fe0
cmp dword [0x6bd0f8], 3
jge 0x4443dc
lea eax, [esp]
push eax
push 0
push 0
push 0x4444d0
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6472c4], eax
pop ecx
ret
push 0
push 0
push 0
push 0x444400
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6472c4], eax
pop ecx
ret

Function at 0x4445f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, eax
mov eax, dword [0x6bd0f8]
test eax, eax
push ebp
mov ebp, dword [esp + 0x24]
jne 0x444609
call fcn.00545fe0
cmp dword [0x6bd0f8], 3
jl 0x44468a
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x18], eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x20], eax
push edi
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x3c]
push ebp
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov bl, al
test bl, bl
je 0x444655
cmp dword [esp + 8], edi
pop ebp
sete al
pop ebx
add esp, 0x18
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4446c0
mov eax, dword [esi + 0x3c]
push 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x4446b8
cmp dword [esp + 8], edi
jne 0x4446b8
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret
mov ecx, dword [esi + 0x3c]
push 0
push 0
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
test al, al
je 0x4446c2
mov eax, dword [esi + 0x3c]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x444678
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
mov al, bl
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x445400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
xor eax, eax
push 4
mov dword [0x6473b0], eax
push 0x3000
mov dword [0x6473b4], eax
push 0x1b40000
mov dword [0x6473b8], eax
push 0x40000000
mov dword [0x6473bc], eax
call esi
push 4
push 0x3000
push 0x4000
push 0
mov dword [0x6473b0], eax
mov dword [0x6473b4], 0x40440000
call esi
movsx ecx, word [0x621f88]
push 4
push 0x3000
shl ecx, 0x14
push ecx
push 0
mov dword [0x6473b8], eax
call esi
mov dword [0x6473bc], eax
mov eax, dword [0x6473b0]
test eax, eax
jne 0x44550c
mov byte [esp + 8], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.Psapi.dll
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4454e3
push str.GetMappedFileNameA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4454dc
push 0x104
lea edx, [esp + 0xc]
push edx
push 0x40000000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, byte [esp + 8]
test al, al
lea eax, [esp + 8]
jne 0x4454f4
mov eax, str.Error
push 0
push eax
push str.Cannot_allocate_required_memory._Some_other_application_has_loaded_where_Halo_needs_to_be_located.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x449de0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x108
push ebx
push esi
push edi
push 0x8000
mov byte [esp + 0x13], 1
lea esi, [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, dword [esp + 0x118]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push ebx
mov dword [esp + 0x14], eax
call edi
cmp eax, 0xffffffff
je 0x449e22
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x108
ret
lea edx, [esp + 0x14]
mov eax, ebx
sub edx, ebx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x449e30
mov cl, byte [esp + 0x14]
mov al, 0x5c
cmp cl, al
push ebp
jne 0x449e76
cmp byte [esp + 0x19], al
jne 0x449e76
lea eax, [esp + 0x1a]
push 0x5fe768
push eax
call fcn.005ca2d0
add esp, 8
test eax, eax
je 0x449ed7
inc eax
push 0x5fe768
push eax
call fcn.005ca2d0
mov esi, eax
add esp, 8
test esi, esi
je 0x449ed7
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x449e85
mov ebx, dword [esp + 0x11c]
push 0x5fe768
inc esi
push esi
call fcn.005ca2d0
mov esi, eax
add esp, 8
test esi, esi
je 0x449ec7
mov bl, byte [esi]
lea ecx, [esp + 0x18]
push ecx
mov byte [esi], 0
call edi
cmp eax, 0xffffffff
jne 0x449ebc
push 0
lea edx, [esp + 0x1c]
push edx
call ebp
test eax, eax
jne 0x449ebc
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 1
mov byte [esi], bl
je 0x449e7e
jmp 0x449ed7
cmp byte [esp + 0x13], 1
jne 0x449ed7
push 0
push ebx
call ebp
test eax, eax
jne 0x449edc
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov al, byte [esp + 0x13]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x475b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x60
mov eax, dword [0x68ccc4]
push ebx
push ebp
push esi
mov esi, eax
inc eax
cmp esi, eax
push edi
mov dword [esp + 0x10], esi
mov dword [0x68ccc4], eax
jge 0x475b46
add eax, 0xffffffe0
cmp esi, eax
jl 0x475b46
mov ebx, esi
and ebx, 0x1f
imul ebx, ebx, 0x308
add ebx, 0x68cccc
jmp 0x475b48
xor ebx, ebx
lea ebp, [ebx + 4]
mov dword [ebx], esi
mov word [ebp], 0
mov eax, dword [0x68ccc8]
mov dword [esp + 0x14], eax
xor eax, 0x69746572
lea edi, [esp + 0x14]
mov word [esp + 0x18], 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], eax
call fcn.004d39d0
mov edi, eax
test edi, edi
je 0x475c50
lea eax, [edi + 0x28]
push eax
lea eax, [esp + 0x48]
call fcn.0047cd00
add esp, 4
cmp al, 1
mov ecx, 8
jne 0x475bf8
add edi, ecx
mov edx, dword [esp + 0x44]
mov byte [esp + 0x34], al
mov eax, dword [esp + 0x48]
lea esi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
test eax, eax
sete cl
mov byte [esp + 0x35], cl
movzx ecx, word [ebp]
shl ecx, 5
lea edi, [ecx + ebx + 8]
mov ecx, 8
lea esi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [ebp]
shl ecx, 4
lea ecx, [ecx + ebx + 0x208]
mov esi, ecx
mov ecx, dword [esp + 0x34]
mov dword [esi], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
jmp 0x475c35
movzx edx, word [ebp]
shl edx, 5
lea esi, [edi + 8]
lea edi, [edx + ebx + 8]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [ebp]
or eax, 0xffffffff
shl ecx, 4
lea edx, [ecx + ebx + 0x208]
mov byte [esp + 0x24], 0
mov ecx, dword [esp + 0x24]
mov dword [edx], ecx
mov ecx, dword [esp + 0x30]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
inc word [ebp]
lea edi, [esp + 0x14]
call fcn.004d39d0
mov edi, eax
test edi, edi
jne 0x475b87
mov esi, dword [esp + 0x10]
mov ebx, esi
mov edx, ebp
call fcn.00476280
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x493c10
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov dl, byte [0x64c460]
test dl, dl
je 0x493cf2
cmp ecx, 0x100
mov edx, 0xffffffff
mov byte [esp], 0
mov byte [esp + 1], 0xff
mov word [esp + 2], dx
je 0x493c72
cmp ecx, 0x104
je 0x493c72
cmp ecx, 0x102
je 0x493c56
cmp ecx, 0x106
jne 0x493cf2
cmp eax, 0x80
mov cl, al
mov byte [esp + 1], cl
mov word [esp + 2], dx
jae 0x493c90
mov ax, word [eax*2 + 0x5fa278]
jmp 0x493c86
mov ax, word [eax*2 + 0x5fa078]
cmp ax, dx
je 0x493cf2
or cl, 0xff
mov byte [esp + 1], cl
cmp ax, dx
mov word [esp + 2], ax
jne 0x493c95
cmp cl, 0xff
je 0x493cf2
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
xor ebx, ebx
mov bx, ax
push 0x11
shr ebx, 0xf
and bl, 1
call esi
test ah, ah
jns 0x493cb9
or bl, 2
jmp 0x493cbc
and bl, 0xfd
push 0x12
call esi
test ah, ah
jns 0x493cc9
or bl, 4
jmp 0x493ccc
and bl, 0xfb
mov ax, word [0x64c564]
cmp ax, 0x40
pop esi
mov byte [esp + 4], bl
pop ebx
jge 0x493cf2
mov ecx, dword [esp]
movsx eax, ax
mov dword [eax*4 + 0x64c566], ecx
inc word [0x64c564]
pop ecx
ret

Function at 0x498200
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push esi
mov esi, 0x629b7c
lea esp, [esp]
mov eax, dword [esi - 4]
push eax
mov eax, dword [esi]
call fcn.00497fb0
add esi, 0xc
add esp, 4
cmp esi, 0x629c60
jl 0x498210
lea ecx, [esp + 4]
push ecx
push str.maps.map
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x498276
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0x34]
call fcn.00498170
test al, al
jne 0x498262
push 0x13
lea eax, [esp + 0x38]
call fcn.00497fb0
add esp, 4
lea edx, [esp + 8]
push edx
push esi
call edi
test eax, eax
jne 0x498247
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
add esp, 0x140
ret
Function at 0x499b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
cmp byte [0x815ce6], 4
mov dword [esp + 4], 0x3f800000
mov dword [esp + 8], 0x3f333333
mov dword [esp + 0xc], 0x3f333333
mov dword [esp + 0x10], 0x3f333333
jb 0x499bc9
mov al, byte [0x64dd64]
test al, al
je 0x499bc9
call fcn.004994a0
cmp eax, 0xffffffff
je 0x499bc9
mov ecx, dword [0x64dd68]
mov edx, dword [ecx + 0x34]
and eax, 0xffff
imul eax, eax, 0x124
add eax, edx
test edi, edi
push esi
mov esi, eax
mov dword [esi + 0x120], 0
mov eax, edi
jne 0x499b77
lea eax, [esp + 8]
mov ecx, dword [eax]
lea edx, [esi + 0x110]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
lea ecx, [esp + 0x20]
push ecx
mov dword [edx + 0xc], eax
mov edx, dword [esp + 0x20]
push edx
lea edi, [esi + 0xd]
push 0xfe
push edi
call fcn.005caae2
push 0x608cc0
push edi
call fcn.005ca410
add esp, 0x18
test eax, eax
setne al
mov byte [esi + 0xc], al
mov eax, edi
call fcn.00499f10
pop esi
pop edi
add esp, 0x10
ret

Function at 0x499bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
mov al, byte [0x64dd64]
test al, al
mov dword [esp + 4], 0x3f800000
mov dword [esp + 8], 0x3f333333
mov dword [esp + 0xc], 0x3f333333
mov dword [esp + 0x10], 0x3f333333
je 0x499c8c
call fcn.004994a0
cmp eax, 0xffffffff
je 0x499c8c
mov ecx, dword [0x64dd68]
mov edx, dword [ecx + 0x34]
and eax, 0xffff
imul eax, eax, 0x124
add eax, edx
test edi, edi
push esi
mov esi, eax
mov dword [esi + 0x120], 0
mov eax, edi
jne 0x499c3a
lea eax, [esp + 8]
mov ecx, dword [eax]
lea edx, [esi + 0x110]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
lea ecx, [esp + 0x20]
push ecx
mov dword [edx + 0xc], eax
mov edx, dword [esp + 0x20]
push edx
lea edi, [esi + 0xd]
push 0xfe
push edi
call fcn.005caae2
push 0x608cc0
push edi
call fcn.005ca410
add esp, 0x18
test eax, eax
setne al
mov byte [esi + 0xc], al
mov eax, edi
call fcn.00499f10
pop esi
pop edi
add esp, 0x10
ret

Function at 0x499dc0
Capabilities:
Manipulate console buffer

Disassembly:
mov al, byte [0x64dd80]
test al, al
je 0x499e66
push edi
mov edi, dword [0x64dd74]
test edi, edi
je 0x499e65
push ebx
push esi
lea esi, [edi + 0xb4]
mov eax, 0x64dc60
lea esp, [esp]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x499e18
test cl, cl
je 0x499e14
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x499e18
add eax, 2
add esi, 2
test cl, cl
jne 0x499df0
xor eax, eax
jmp 0x499e1d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop esi
pop ebx
je 0x499e4b
call fcn.0049a120
mov eax, dword [0x64dd74]
push 0xff
add eax, 0xb4
push eax
push 0x64dc60
call fcn.005c8ba0
mov edi, dword [0x64dd74]
add esp, 0xc
movsx eax, word [edi + 0x1ba]
cmp dword [0x64dd60], eax
je 0x499e65
mov dword [0x64dd60], eax
pop edi
jmp fcn.0049a220
pop edi
ret
Function at 0x49a090
Capabilities:
Manipulate console buffer

Disassembly:
mov al, byte [0x64dd80]
sub esp, 0x1c
test al, al
je 0x49a118
mov ecx, dword [0x64dc38]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x49a118
mov edx, dword [esp + 6]
mov eax, dword [0x64dc38]
push esi
dec edx
mov word [esp + 6], dx
mov word [esp + 4], 0
mov esi, dword [esp + 4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov al, byte [esp + 0x24]
test al, al
je 0x49a117
mov edx, dword [0x64dc38]
push edi
movsx edi, word [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push esi
push edi
push 0x20
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
je 0x49a116
mov ecx, dword [esp + 0x14]
mov edx, dword [0x64dc38]
lea eax, [esp + 8]
push eax
push esi
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x49a120
Capabilities:
Manipulate console buffer

Disassembly:
mov al, byte [0x64dd80]
sub esp, 0x13c
test al, al
je 0x49a217
mov eax, dword [0x64dd74]
test eax, eax
je 0x49a217
push esi
add eax, 0xb4
push eax
push 0x64dc40
push str._s__s
lea eax, [esp + 0x2c]
push 0x11e
push eax
call fcn.005c8b3d
mov ecx, dword [0x64dd74]
mov eax, 0x64dc40
add esp, 0x14
add ecx, 0xb4
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x49a177
sub eax, esi
movsx eax, ax
sub eax, ecx
lea edx, [esp + eax + 0x20]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x49a190
mov edx, dword [0x64dc38]
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x49a216
mov ecx, dword [esp + 0xa]
movsx eax, word [esp + 8]
dec ecx
lea edx, [esp + 4]
push edx
mov word [esp + 8], 0
mov word [esp + 0xa], cx
mov esi, dword [esp + 8]
push esi
push eax
mov eax, dword [0x64dc38]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
je 0x49a211
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49a1f0
lea ecx, [esp + 4]
push ecx
sub eax, edx
push esi
push eax
mov eax, dword [0x64dc38]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
call fcn.0049a220
pop esi
add esp, 0x13c
ret
Function at 0x49a220
Capabilities:
Manipulate console buffer

Disassembly:
mov al, byte [0x64dd80]
sub esp, 0x1c
test al, al
je 0x49a2c3
mov eax, dword [0x64dd74]
test eax, eax
je 0x49a2c3
mov ecx, dword [0x64dc38]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x49a2c3
mov eax, 0x64dc40
lea edx, [eax + 1]
jmp 0x49a260
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49a260
sub eax, edx
mov edx, dword [0x64dd74]
mov cx, word [edx + 0x1ba]
mov edx, dword [esp + 6]
add cx, ax
push esi
mov esi, dword [esp + 8]
push edi
movsx edi, si
mov word [esp + 8], cx
movsx ecx, cx
dec edi
cmp ecx, edi
lea eax, [edx - 1]
mov word [esp + 0xa], ax
jle 0x49a2a1
dec esi
mov word [esp + 8], si
movsx edx, dx
movsx ecx, ax
dec edx
cmp ecx, edx
pop edi
pop esi
jle 0x49a2b3
mov word [esp + 2], ax
mov edx, dword [esp]
mov eax, dword [0x64dc38]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
add esp, 0x1c
ret
Function at 0x4ac3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x6b43d8]
mov edx, dword [0x816d04]
mov ecx, eax
push ebx
and ecx, 0xffff
push ebp
shl ecx, 5
push esi
mov esi, dword [ecx + edx + 0x14]
mov dword [0x67f624], eax
mov dword [esp + 0x1c], 0x3f800000
mov eax, dword [esp + 0x1c]
mov dword [0x67f630], eax
mov dword [esp + 0x28], 0x3f666666
mov eax, dword [esp + 0x28]
mov dword [0x67f63c], eax
mov al, byte [0x6b437f]
mov dword [esp + 0x20], 0x3f666666
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], 0x3f666666
mov edx, dword [esp + 0x24]
xor ebx, ebx
cmp al, 1
push edi
mov dword [esp + 0x14], esi
mov dword [0x67f634], ecx
mov dword [0x67f638], edx
mov word [0x67f62c], 0xffff
mov word [0x67f62e], 2
mov dword [0x67f628], ebx
jne 0x4ac4dd
mov eax, dword [0x6b438c]
push ebx
xor edi, edi
call fcn.0043f2a0
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x4ac4dd
mov ecx, dword [0x6b4380]
mov ebx, dword [esp + 0x34]
push ecx
lea esi, [esp + 0x1c]
lea edi, [esp + 0x24]
call fcn.00559bc0
add word [esp + 0x26], 0xfffe
add word [esp + 0x2a], 2
push 0x7f7f7f7f
push 0
mov edi, ebx
push ebp
mov eax, edi
lea ecx, [esp + 0x30]
call fcn.0049bbc0
mov esi, dword [esp + 0x24]
add esp, 0x10
xor ebx, ebx
jmp 0x4ac4e1
mov edi, dword [esp + 0x34]
mov edx, dword [0x6b4380]
push edx
push ebx
push ebx
mov eax, edi
mov ecx, edi
call fcn.005184f0
mov al, byte [0x6b437f]
add esp, 0xc
test al, al
jne 0x4ac5f1
cmp dword [0x6b438c], 0xffffffff
je 0x4ac5f1
call fcn.00449da0
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
test dl, 1
je 0x4ac5f1
mov bp, word [esi + 6]
mov eax, dword [0x6b438c]
add bp, word [esi + 4]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
mov ebx, dword [0x6b4380]
push 0
xor edi, edi
call fcn.0043f2a0
mov ecx, eax
add esp, 4
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x4ac5f1
mov si, word [esp + 0x18]
xor edx, edx
mov dx, word [ebx]
test dx, dx
je 0x4ac5a2
mov edi, edi
mov edi, dword [esp + 0x14]
call fcn.0055afd0
test eax, eax
je 0x4ac59e
cmp ebx, dword [0x6b4384]
jae 0x4ac58e
mov dx, word [eax + 2]
add word [esp + 0x10], dx
mov dx, word [ebx + 2]
add si, word [eax + 2]
add ebx, 2
test dx, dx
jne 0x4ac570
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
movsx eax, word [edx + 6]
movsx edx, word [edx + 2]
mov ebx, dword [esp + 0x10]
add eax, edx
cdq
sub eax, edx
sar si, 1
sar eax, 1
push 0xffffffffffffffff
push 0
push ecx
add ebp, 0x78
lea ecx, [esp + 0x2c]
sub eax, esi
add eax, ebx
mov word [esp + 0x2e], ax
mov eax, dword [esp + 0x2e]
inc eax
mov word [esp + 0x32], ax
xor eax, eax
mov word [esp + 0x2c], 0x78
mov word [esp + 0x30], bp
call fcn.0049bbc0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret