joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3670
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x6cd498]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x108]
mov dword [ebp - 0x40c], ecx
push eax
push 0x100
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x109], 0x5c
je 0x4d36cf
push 0x69427c
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.005ee36d
add esp, 0xc
push str.metin2client.dat
lea eax, [ebp - 0x108]
push 0x100
push eax
call fcn.005ee36d
call fcn.0044e460
mov edi, eax
lea eax, [ebp - 0x408]
push edi
push 0x100
push eax
call fcn.005eb7a0
push 7
lea eax, [ebp - 0x408]
push str.locale_
push eax
call fcn.005eb66a
add esp, 0x24
test eax, eax
jne 0x4d3730
lea eax, [edi + 7]
push eax
lea eax, [ebp - 0x408]
push 0x100
push eax
call fcn.005eb7a0
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
push 0x1ff
lea eax, [ebp - 0x308]
push eax
push 0
push esi
lea eax, [ebp - 0x408]
push eax
call edi
cmp byte [ebp - 0x308], 0
jne 0x4d37c0
push 0x1ff
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x40c]
push dword [0x724474]
call dword [sym.imp.USER32.dll_LoadStringA]
cmp byte [ebp - 0x308], 0
jne 0x4d37c0
lea eax, [ebp - 0x108]
push eax
push 0x1ff
lea eax, [ebp - 0x308]
push eax
push 0
push esi
push 0x69429c
call edi
cmp byte [ebp - 0x308], 0
jne 0x4d37c0
push esi
lea eax, [ebp - 0x308]
push 0x200
push eax
call fcn.005eb7a0
add esp, 0xc
lea eax, [ebp - 0x40c]
mov ecx, 0x724478
push eax
call fcn.00471810
lea ecx, [ebp - 0x308]
mov esi, eax
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4d37e0
sub ecx, edx
lea eax, [ebp - 0x308]
push ecx
push eax
mov ecx, esi
call fcn.0043dc70
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0059c8be
mov esp, ebp
pop ebp
ret
Function at 0x4d5c80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63d4df
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6cd498]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push 0
call fcn.005ec52c
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add eax, esi
push eax
call fcn.004f1ef0
call fcn.004f1e90
push eax
call fcn.005ebfe5
push 1
call fcn.004f0990
push 0
push str.perf_game_update.txt
call fcn.005ed29b
add esp, 0x14
test eax, eax
jne 0x4d5cf9
push str.perf_game_update.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push str.newpatch.exe
call fcn.005ed29b
add esp, 8
test eax, eax
jne 0x4d5d20
push str.patchupdater.exe
call fcn.005ee362
add esp, 4
xor al, al
jmp 0x4d5e53
call dword [sym.imp.DevIL.dll_ilInit]
call fcn.004d6630
test eax, eax
je 0x4d5d19
push 0
call fcn.004f0940
mov eax, dword fs:[0x2c]
add esp, 4
mov esi, dword [eax]
mov eax, dword [0x75c0d4]
cmp eax, dword [esi + 0x20]
jg 0x4d5e6f
mov eax, dword [0x75c0e0]
cmp eax, dword [esi + 0x20]
jg 0x4d5ebd
call fcn.004d38a0
test al, al
jne 0x4d5d84
push 0
push 0
push str.Pack_Initialization_failed._Check_log.txt_file..
call fcn.004f07c0
add esp, 0xc
xor al, al
jmp 0x4d5e53
call fcn.00442bf0
test al, al
je 0x4d5d9b
call fcn.0044e440
push eax
call fcn.0051c240
add esp, 4
push 0x56e60
call fcn.0059c8fd
add esp, 4
mov dword [ebp - 0x44], eax
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.004524d0
mov esi, eax
mov dword [ebp - 4], 0xffffffff
push ebx
mov ecx, esi
call fcn.0050b3c0
lea ecx, [ebp - 0x40]
xor bl, bl
call fcn.00592650
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 3
call fcn.0046eb70
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 4
push eax
call fcn.00592ef0
add esp, 4
lea ecx, [ebp - 0x40]
push str.eter.python
call fcn.00592710
test al, al
je 0x4d5e10
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.004d50a0
mov bl, al
mov ecx, esi
call fcn.00454c50
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
lea ecx, [ebp - 0x40]
call sub.python27.dll_Py_Finalize
lea ecx, [ebp - 0x34]
call fcn.0046ec40
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.00592680
mov ecx, esi
call fcn.00454ca0
test esi, esi
je 0x4d5e51
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059c8be
mov esp, ebp
pop ebp
ret
push 0x75c0d4
call fcn.0059ccc9
add esp, 4
cmp dword [0x75c0d4], 0xffffffff
jne 0x4d5d52
mov ecx, 0x75c0d8
mov dword [ebp - 4], 0
call fcn.004f1f00
push 0x64b5b0
call fcn.0059cb81
push 0x75c0d4
mov dword [ebp - 4], 0xffffffff
call fcn.0059cc7f
add esp, 8
jmp 0x4d5d52
push 0x75c0e0
call fcn.0059ccc9
add esp, 4
cmp dword [0x75c0e0], 0xffffffff
jne 0x4d5d63
mov ecx, 0x75c0e8
mov dword [ebp - 4], 1
call fcn.00526610
push 0x64b5a0
call fcn.0059cb81
push 0x75c0e0
mov dword [ebp - 4], 0xffffffff
call fcn.0059cc7f
add esp, 8
jmp 0x4d5d63
Function at 0x4d7c30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6cd498]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x65d590
push 0x64
mov esi, edx
call fcn.0059d6a8
mov edi, eax
add esp, 8
test edi, edi
je 0x4d7dda
push 0x63
lea ecx, [edi + 1]
push 0
push ecx
call fcn.005d8990
add esp, 0xc
mov byte [edi], 1
lea eax, [edi + 4]
push 2
push eax
call fcn.00618af9
lea eax, [edi + 0x34]
push eax
call fcn.00618ca2
add esp, 0xc
mov dword [0x745828], edi
lea eax, [ebp - 0x48]
xorps xmm0, xmm0
movq qword [edi + 0x5c], xmm0
push 0x20
push eax
push 0xffffffffffffffff
push str.1097963443186843858
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea ecx, [ebp - 0x48]
call fcn.004dc9c0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x724480
mov dword [0x749a4c], eax
call fcn.00618b1a
add esp, 4
test eax, eax
jne 0x4d7df4
test esi, esi
je 0x4d7cee
movups xmm0, xmmword [esi]
movups xmmword [0x745810], xmm0
movq xmm0, qword [esi + 0x10]
jmp 0x4d7cf8
xorps xmm0, xmm0
movups xmmword [0x745810], xmm0
movq qword [0x745820], xmm0
xorps xmm0, xmm0
push 0x724480
movups xmmword [0x745a30], xmm0
movq qword [0x745a40], xmm0
call fcn.00618b3f
add esp, 4
cmp dword [0x749b50], 0
jne 0x4d7de4
cmp byte [str.1097963443186843858], 0
mov edx, 0x749c70
mov dword [0x749c60], 0x6cfa28
je 0x4d7d63
mov eax, str.1097963443186843858
mov esi, 1
sub esi, eax
lea ecx, [eax + esi]
cmp ecx, 0x40
jae 0x4d7d63
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp byte [eax], 0
jne 0x4d7d50
mov esi, dword [0x745828]
mov al, 1
mov byte [edx], 0
mov dword [0x749b50], 0x749c60
mov dword [0x749c68], 0x4d8080
mov dword [0x749c6c], 0x4d8090
xchg byte [esi], al
push 4
call fcn.0059c8fd
add esp, 4
lea ecx, [ebp - 0x4c]
mov dword [eax], esi
push ecx
push 0
push eax
push 0x4d8940
push 0
push 0
call fcn.005ec153
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x50], ecx
test ecx, ecx
je 0x4d7dff
cmp dword [esi + 0x60], 0
jne 0x4d7dfa
mov eax, dword [ebp - 0x4c]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059c8be
mov esp, ebp
pop ebp
ret
mov dword [0x745828], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0059c8be
mov esp, ebp
pop ebp
ret
push eax
call fcn.00618dbc
call fcn.005f4f7a
push 6
mov dword [ebp - 0x4c], 0
call fcn.00618de9
int3
Function at 0x4d8a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6cd498]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4d8ac0
test ecx, ecx
jne 0x4d8a86
push 0x4f
push str.D:_fileslerYeniSRCclientSRCdiscord_rpcconnection_win.cpp
push str.self
call fcn.005f7931
add esp, 0xc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059c8be
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x4d8a73
test edx, edx
jne 0x4d8aa0
push 0x56
push str.D:_fileslerYeniSRCclientSRCdiscord_rpcconnection_win.cpp
push str.data
jmp 0x4d8a6b
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x4d8a73
cmp dword [ebp - 8], esi
jne 0x4d8a73
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0059c8be
mov esp, ebp
pop ebp
ret 8

Function at 0x4d8ae0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6cd498]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test ebx, ebx
jne 0x4d8b23
push 0x62
push str.D:_fileslerYeniSRCclientSRCdiscord_rpcconnection_win.cpp
push str.data
call fcn.005f7931
add esp, 0xc
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059c8be
mov esp, ebp
pop ebp
ret 8
test esi, esi
jne 0x4d8b4f
push 0x67
push str.D:_fileslerYeniSRCclientSRCdiscord_rpcconnection_win.cpp
push str.self
call fcn.005f7931
add esp, 0xc
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059c8be
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
push edi
cmp eax, 0xffffffff
je 0x4d8be9
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x4d8bd6
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 8], edi
jb 0x4d8be9
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x4d8bcd
cmp edi, dword [ebp - 0xc]
je 0x4d8bb8
push 0x74
push str.D:_fileslerYeniSRCclientSRCdiscord_rpcconnection_win.cpp
push str.bytesToRead__bytesRead
call fcn.005f7931
add esp, 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059c8be
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.004d8a20
jmp 0x4d8be9
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
mov byte [esi], 0
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059c8be
mov esp, ebp
pop ebp
ret 8
Function at 0x4dd300
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x6e3468]
test eax, eax
je 0x4dd344
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x6e3468]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4dd32e
push dword [0x6e3468]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x6e346c]
mov dword [0x6e3468], 0
call dword [sym.imp.USER32.dll_SetFocus]
ret
Function at 0x4f1390
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4f1439
cmp byte [esi], 0
je 0x4f1439
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f13b0
sub ecx, edx
cmp ecx, 3
jb 0x4f13c7
cmp byte [esi + 1], 0x3a
jne 0x4f13c7
add esi, 3
mov ecx, esi
mov dword [ebp + 8], esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f13d0
sub ecx, edx
push edi
lea eax, [ecx + 1]
push eax
mov dword [ebp - 4], eax
call fcn.0059c92d
mov cl, byte [esi]
add esp, 4
mov edi, eax
test cl, cl
je 0x4f142f
push ebx
xor ebx, ebx
mov eax, esi
cmp cl, 0x2f
je 0x4f1400
cmp cl, 0x5c
jne 0x4f1422
push dword [ebp - 4]
push 0
push edi
call fcn.005d8990
push ebx
push esi
push edi
call fcn.005e1f10
add esp, 0x18
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 1]
inc eax
inc ebx
mov dword [ebp + 8], eax
test cl, cl
jne 0x4f13f6
pop ebx
push edi
call fcn.0059c936
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4f19f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
or eax, 0xffffffff
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 0x10
jb 0x4f1a82
mov ecx, edi
shr ecx, 4
push ebx
mov dword [ebp + 0xc], ecx
push esi
lea esi, [edx + 2]
mov ebx, 4
nop dword [eax + eax]
movsx ecx, byte [esi - 2]
lea esi, [esi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6bd2c0]
movsx ecx, byte [esi - 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6bd2c0]
movsx ecx, byte [esi - 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6bd2c0]
movsx ecx, byte [esi - 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6bd2c0]
sub ebx, 1
jne 0x4f1a20
add edx, 0x10
sub edi, 0x10
sub dword [ebp + 0xc], 1
jne 0x4f1a10
pop esi
pop ebx
test edi, edi
je 0x4f1aa0
movsx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x6bd2c0]
sub edi, 1
jne 0x4f1a86
not eax
pop edi
pop ebp
ret
Function at 0x4f1d70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0x80
push 3
push 0
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4f1d9b
xor eax, eax
pop edi
pop ebp
ret
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x4f1dc0
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
push ebx
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x4f1e2e
push ebx
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
push ebx
push esi
call fcn.004f19f0
add esp, 8
mov ebx, eax
test esi, esi
je 0x4f1e1e
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f27d0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x20
mov edx, edi
mov ecx, edi
shl ecx, 4
dec ebx
shr edx, 5
xor edx, ecx
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x10]
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
add ecx, eax
sub eax, 0x61c88647
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
mov ebx, dword [ebp + 0xc]
add ecx, eax
xor edx, ecx
add edi, edx
test ebx, ebx
jne 0x4f27e3
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4f2840
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0xc6ef3720
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x20
mov edx, esi
mov ecx, esi
shl ecx, 4
dec ebx
shr edx, 5
xor edx, ecx
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x10]
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebx + ecx*4]
add ecx, eax
add eax, 0x61c88647
xor edx, ecx
sub edi, edx
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebx + ecx*4]
mov ebx, dword [ebp + 0xc]
add ecx, eax
xor edx, ecx
sub esi, edx
test ebx, ebx
jne 0x4f2856
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4f3cd0
Capabilities:
Get system information on windows
Print debug messages
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x24
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [esi + 0x130], edx
test eax, eax
jne 0x4f3cf3
mov eax, dword [esi + 0x114]
mov ecx, eax
jmp 0x4f3cf9
mov ecx, dword [esi + 0x114]
mov dword [esi + 0x134], eax
add eax, edx
cmp eax, ecx
jbe 0x4f3d0e
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esi + 0x130]
xor edx, edx
mov ecx, dword [ebp - 8]
mov eax, edi
div ecx
mov eax, dword [esi + 0x134]
mov ebx, edi
push 0
mov dword [ebp + 0x10], eax
sub ebx, edx
add eax, edi
mov dword [ebp + 0xc], ecx
push eax
push 0
push 2
push 0
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, eax
mov dword [esi + 0x12c], ecx
test ecx, ecx
jne 0x4f3d72
push str.CMappedFile::Map__m_hFM_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor edx, edx
mov eax, edi
div dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
push edx
push ebx
push 0
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x138], eax
test eax, eax
jne 0x4f3db2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CMappedFile::Map__m_lpMapData__lu
call fcn.004f09c0
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
sub eax, ebx
lea ecx, [eax + edi]
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c], ecx
mov dword [eax], ecx
mov ecx, esi
push dword [esi + 0x13c]
mov dword [esi + 0x128], 0
push dword [esi + 0x134]
call fcn.004f3cb0
mov eax, dword [esi + 0x134]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f7380
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, ecx
call fcn.004f7420
push 0x104
push dword [ebp + 8]
lea eax, [edi + 8]
push eax
call fcn.005e1f10
mov ebx, dword [ebp + 0xc]
add esp, 0xc
xor eax, eax
mov ecx, connect
cmp ebx, 1
setne al
push 0
add eax, 3
push 0x80
push eax
xor eax, eax
cmp ebx, 2
push 0
sete al
lea eax, [eax*2 + 1]
push eax
mov eax, 0xc0000000
cmovne eax, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0x110], eax
cmp eax, 0xffffffff
je 0x4f7407
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0x114], eax
mov eax, 1
mov dword [edi + 4], ebx
pop edi
pop ebx
pop ebp
ret 8
mov dword [edi + 0x110], 0
xor eax, eax
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4ffd80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63f020
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6cd498]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x4c]
mov dword [esi], vtable.CNetworkStream.0
call fcn.0060c700
lea ecx, [esi + 0x60]
mov dword [ebp - 4], 0
call fcn.0051ff90
mov dword [esi + 0x5c], 0xffffffff
mov eax, esi
mov byte [esi + 0x48], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4fffe0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
call fcn.004fff70
mov eax, dword [ebp + 8]
lea esi, [edi + 0x60]
push 0
push 1
push 2
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
call sub.WS2_32.dll_socket
mov dword [edi + 0x5c], eax
cmp eax, 0xffffffff
je 0x500051
lea ecx, [ebp - 4]
mov dword [ebp - 4], 1
push ecx
push 0x8004667e
push eax
call sub.WS2_32.dll_ioctlsocket
mov ecx, esi
call fcn.0051ffb0
push eax
push esi
push dword [edi + 0x5c]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x500069
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x500069
push str.error___WSAEWOULDBLOCK
call fcn.004f0ba0
add esp, 4
mov ecx, edi
call fcn.004fff70
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
call fcn.005ec585
mov ecx, eax
add esp, 4
mov eax, dword [ebp + 0xc]
mov esi, edx
cdq
add ecx, eax
mov al, 1
mov dword [edi + 8], ecx
adc esi, edx
mov dword [edi + 0xc], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x500260
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6cd498]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
cmp eax, 0xffffffff
je 0x5003a9
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x214]
push eax
push 0
lea eax, [ebp - 0x108]
mov dword [ebp - 0x20c], 1
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x108], 1
push eax
push 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x5003a9
cmp byte [esi + 0x48], 0
lea ecx, [ebp - 0x108]
mov eax, dword [esi + 0x5c]
push ecx
push eax
jne 0x500348
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x500311
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0x48], 1
call dword [eax + 4]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059c8be
mov esp, ebp
pop ebp
ret
push 0
call fcn.005ec585
add esp, 4
cmp edx, dword [esi + 0xc]
jl 0x5003a9
jg 0x50032b
cmp eax, dword [esi + 8]
jbe 0x5003a9
mov ecx, esi
call fcn.004fff70
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059c8be
mov esp, ebp
pop ebp
ret
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x500370
mov eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x38]
jle 0x500370
mov ecx, esi
call fcn.00500630
test al, al
jne 0x500370
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x50039b
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0x5c]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x50038e
mov ecx, esi
call fcn.00500590
test al, al
je 0x50039b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x14]
call eax
test al, al
jne 0x5003a9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov ecx, esi
call fcn.004fff70
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0059c8be
mov esp, ebp
pop ebp
ret

Function at 0x500590
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
test eax, eax
jle 0x5005c8
mov edx, ecx
sub edx, eax
test edx, edx
jle 0x5005bc
mov ecx, dword [esi + 0x1c]
add eax, ecx
push edx
push eax
push ecx
call fcn.005d8360
mov ecx, dword [esi + 0x24]
add esp, 0xc
mov eax, dword [esi + 0x28]
sub ecx, eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], ecx
mov eax, dword [esi + 0x20]
sub eax, ecx
test eax, eax
jle 0x50061c
push 0
push eax
mov eax, dword [esi + 0x1c]
add eax, ecx
push eax
push dword [esi + 0x5c]
call sub.WS2_32.dll_recv
mov edi, eax
test edi, edi
jns 0x500621
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x500623
mov ecx, esi
call fcn.004424c0
test al, al
je 0x500619
mov edx, dword [esi + 0x1c]
add edx, dword [esi + 0x24]
cmp byte [esi + 0x4c], 0
je 0x500619
mov ecx, dword [esi + 0x54]
add ecx, 4
push edi
push edx
push edx
mov eax, dword [ecx]
call dword [eax + 0x20]
add dword [esi + 0x24], edi
pop edi
mov al, 1
pop esi
ret
jne 0x5005f4
pop edi
xor al, al
pop esi
ret