joyce8/EMBER2024-capa huggingface dataset:
Function at 0x574f00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xf1ce28]
or eax, 2
mov dword [0xf1ce28], eax
mov ecx, dword [0xf1ce2c]
or ecx, 2
mov dword [0xf1ce2c], ecx
mov edx, dword [0xf1ce30]
or edx, 2
mov dword [0xf1ce30], edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.005b7340
mov ecx, dword [ebp - 0xc]
mov dword [0xf1cdec], ecx
mov edx, dword [ebp - 8]
mov dword [0xf1cdf0], edx
mov al, byte [ebp - 4]
mov byte [0xf1cdf4], al
lea ecx, [ebp - 0x10]
call fcn.005b7380
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x20]
call fcn.005b7340
mov edx, dword [ebp - 0x1c]
mov dword [0xf1cdfc], edx
mov eax, dword [ebp - 0x18]
mov dword [0xf1ce00], eax
mov cl, byte [ebp - 0x14]
mov byte [0xf1ce04], cl
lea ecx, [ebp - 0x20]
call fcn.005b7380
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x574fae
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x24], edx
jmp 0x574fb7
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [0xf1ce3c], edx
mov dword [0xf1ce40], 0
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00574af0
add esp, 0xc
cmp eax, dword [0x62f304]
jl 0x574ffa
push 1
mov edx, dword [0xfd5768]
push edx
call fcn.00587db0
add esp, 8
call fcn.00574780
mov esp, ebp
pop ebp
ret

Function at 0x5750b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xf1ce28]
or eax, 2
mov dword [0xf1ce28], eax
mov ecx, dword [0xf1ce2c]
or ecx, 0x20
mov dword [0xf1ce2c], ecx
mov edx, dword [0xf1ce2c]
or edx, 2
mov dword [0xf1ce2c], edx
mov eax, dword [0xf1ce30]
or eax, 2
mov dword [0xf1ce30], eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x10]
call fcn.005b7340
mov edx, dword [ebp - 0xc]
mov dword [0xf1cdec], edx
mov eax, dword [ebp - 8]
mov dword [0xf1cdf0], eax
mov cl, byte [ebp - 4]
mov byte [0xf1cdf4], cl
lea ecx, [ebp - 0x10]
call fcn.005b7380
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x20]
call fcn.005b7340
mov eax, dword [ebp - 0x1c]
mov dword [0xf1cdfc], eax
mov ecx, dword [ebp - 0x18]
mov dword [0xf1ce00], ecx
mov dl, byte [ebp - 0x14]
mov byte [0xf1ce04], dl
lea ecx, [ebp - 0x20]
call fcn.005b7380
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x57516b
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x24], edx
jmp 0x575174
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [0xf1ce3c], edx
mov dword [0xf1ce40], 0
mov esp, ebp
pop ebp
ret
Function at 0x577230
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x577267
xor eax, eax
jmp 0x577293
mov ecx, dword [0xfd5768]
push ecx
push 0x10000
push 0x577360
call fcn.0058f0f0
add esp, 0xc
mov byte [0xfd576c], 1
mov byte [0xfd576e], 0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x578180
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0xfda0dc], 2
jne 0x5781c8
mov dword [0xfda0dc], 0
movsx eax, word [0xfda0c4]
cmp eax, 1
jne 0x5781ac
mov eax, 1
jmp 0x57821c
movsx ecx, word [0xfda0c4]
cmp ecx, 2
jne 0x5781c1
mov eax, 0xfffffffd
jmp 0x57821c
mov eax, 0xfffffffe
jmp 0x57821c
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x5781e9
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x5781f2
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
sub edx, dword [0xfda0e0]
cmp edx, 0x927c0
jbe 0x57821a
push 0x5f71d8
push 0xfd9b28
call fcn.005cc4f5
add esp, 8
or eax, 0xffffffff
jmp 0x57821c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x5787d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0xfd576d]
test eax, eax
jne 0x5787e6
xor eax, eax
jmp 0x578873
cmp dword [0xfda0dc], 2
jne 0x57881f
mov dword [0xfda0dc], 0
movsx ecx, word [0xfda0d0]
cmp ecx, 1
jne 0x578818
mov dword [0xfda0d8], 1
mov eax, 1
jmp 0x578873
mov eax, 0xfffffffe
jmp 0x578873
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x578840
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x578849
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
sub edx, dword [0xfda0e0]
cmp edx, 0x927c0
jbe 0x578871
push 0x5f722c
push 0xfd9b28
call fcn.005cc4f5
add esp, 8
or eax, 0xffffffff
jmp 0x578873
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x5789d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0xfda0dc], 2
jne 0x578a18
mov dword [0xfda0dc], 0
movsx eax, word [0xfda0d4]
cmp eax, 1
jne 0x5789fc
mov eax, 1
jmp 0x578a6c
movsx ecx, word [0xfda0d4]
cmp ecx, 2
jne 0x578a11
mov eax, 2
jmp 0x578a6c
mov eax, 0xfffffffe
jmp 0x578a6c
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x578a39
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x578a42
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
sub edx, dword [0xfda0e0]
cmp edx, 0x927c0
jbe 0x578a6a
push 0x5f724c
push 0xfd9b28
call fcn.005cc4f5
add esp, 8
or eax, 0xffffffff
jmp 0x578a6c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x578c80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0xfda0dc], 2
jne 0x578cb3
mov dword [0xfda0dc], 0
movsx eax, word [0xfda0cc]
cmp eax, 1
jne 0x578cac
mov eax, 1
jmp 0x578d07
mov eax, 0xfffffffe
jmp 0x578d07
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x578cd4
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 4], edx
jmp 0x578cdd
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
sub edx, dword [0xfda0e0]
cmp edx, 0x927c0
jbe 0x578d05
push 0x5f7274
push 0xfd9b28
call fcn.005cc4f5
add esp, 8
or eax, 0xffffffff
jmp 0x578d07
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x57f3a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 4
jne 0x57f3c2
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
movzx ecx, byte [0xfda0ba]
test ecx, ecx
jne 0x57f485
movsx edx, word [0x120e5d4]
test edx, edx
je 0x57f3ec
movzx eax, word [0x121099c]
and eax, 8
jne 0x57f485
mov ecx, dword [0xfda0e8]
mov dword [0xfda0e4], ecx
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x57f41c
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x80c], edx
jmp 0x57f428
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x80c], eax
mov edx, dword [ebp - 0x80c]
mov dword [0xfda0e8], edx
mov eax, dword [0xfda0e8]
sub eax, dword [0xfda0e4]
cmp eax, 0x3e8
jae 0x57f480
push 3
push 4
push 0x5f72b8
call fcn.00461de0
add esp, 0xc
cmp dword [0x600c78], 0
je 0x57f474
push 0xf0
push 0x140
push 0x4a
call fcn.005af300
add esp, 0xc
mov byte [0xfda0ba], 1
jmp 0x57f589
jmp 0x57f519
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x57f4a9
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x810], edx
jmp 0x57f4b5
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x810], eax
mov edx, dword [ebp - 0x810]
sub edx, dword [0xfda0e8]
cmp edx, 0x1388
jbe 0x57f4d2
mov byte [0xfda0ba], 0
jmp 0x57f519
movsx eax, word [0x120e5d4]
test eax, eax
je 0x57f4e9
movzx ecx, word [0x121099c]
and ecx, 8
jne 0x57f519
push 3
push 4
push 0x5f72d0
call fcn.00461de0
add esp, 0xc
cmp dword [0x600c78], 0
je 0x57f517
push 0xf0
push 0x140
push 0x4a
call fcn.005af300
add esp, 0xc
jmp 0x57f589
push 0x400
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005b1720
add esp, 0xc
lea ecx, [ebp - 0x408]
push ecx
push str.P_s
lea edx, [ebp - 0x808]
push edx
call fcn.005cc4f5
add esp, 0xc
mov eax, dword [0x7d12b4]
push eax
mov ecx, dword [0x600c74]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x808]
push eax
mov ecx, 0xca9a20
call fcn.005b76d0
push eax
mov ecx, 0xca99f0
call fcn.005b76d0
push eax
mov ecx, dword [0xfd5768]
push ecx
call fcn.005867c0
add esp, 0x1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x584d40
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xfd9f68], 0
je 0x584d63
mov eax, 1
jmp 0x584e5e
mov eax, dword [str.crossgate.enix.isao.net]
mov dword [ebp - 0x34], eax
mov ecx, dword [0x5f74ac]
mov dword [ebp - 0x30], ecx
mov edx, dword [0x5f74b0]
mov dword [ebp - 0x2c], edx
mov eax, dword [0x5f74b4]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x5f74b8]
mov dword [ebp - 0x24], ecx
mov edx, dword [0x5f74bc]
mov dword [ebp - 0x20], edx
mov eax, 0x50
mov word [ebp - 0x38], ax
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [0xfd9ff0], eax
cmp dword [0xfd9ff0], 0xffffffff
jne 0x584dc3
mov eax, 0xfffffffd
jmp 0x584e5e
mov ecx, 2
mov word [ebp - 0x14], cx
movzx edx, word [ebp - 0x38]
push edx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x34]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x584e1e
lea ecx, [ebp - 0x34]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x584e11
mov edx, dword [0xfd9ff0]
push edx
call sub.WSOCK32.dll_closesocket
mov eax, 0xfffffffc
jmp 0x584e5e
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0xfd9ff0]
push edx
call sub.WSOCK32.dll_connect
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x584e59
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x584e47
jmp 0x584e59
mov eax, dword [0xfd9ff0]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, 0xfffffffb
jmp 0x584e5e
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret

Function at 0x584e70
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0xfd9f68], 0
je 0x584e91
jmp 0x584f11
push str._update_newestV2.txt
push str.GET__s_HTTP_1.0_n_n
lea eax, [ebp - 0x108]
push eax
call fcn.005cc4f5
add esp, 0xc
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x110], edx
mov eax, dword [ebp - 0x10c]
mov cl, byte [eax]
mov byte [ebp - 0x111], cl
add dword [ebp - 0x10c], 1
cmp byte [ebp - 0x111], 0
jne 0x584ec5
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x110]
mov dword [ebp - 0x118], edx
push 0
mov eax, dword [ebp - 0x118]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [0xfd9ff0]
push edx
call sub.WSOCK32.dll_send
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x584f20
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4318
call fcn.005cef50
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0xfd9f68], 0
je 0x584f4a
mov eax, 1
jmp 0x58512e
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x4118], 0
cmp dword [ebp - 0x4118], 0x40
jae 0x584f8d
mov eax, dword [ebp - 0x4118]
mov ecx, dword [0xfd9ff0]
mov dword [ebp + eax*4 - 0x4114], ecx
mov edx, dword [ebp - 0x4118]
add edx, 1
mov dword [ebp - 0x4118], edx
xor eax, eax
jne 0x584f62
lea ecx, [ebp - 8]
push ecx
push 0
push 0
lea edx, [ebp - 0x4118]
push edx
push 0
call sub.WSOCK32.dll_select
lea eax, [ebp - 0x4118]
push eax
mov ecx, dword [0xfd9ff0]
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x58512c
mov edx, dword [0x9cf378]
push edx
mov eax, dword [0x9cf374]
push eax
push str.EXE:Cg__d_d.exe:
lea ecx, [ebp - 0x4318]
push ecx
call fcn.005cc4f5
add esp, 0x10
movsx edx, word [0x62f350]
imul edx, edx, 0xc1
add edx, 0xf9cf38
push edx
movsx eax, word [0x62f350]
imul eax, eax, 0xc1
add eax, 0xf9ceb8
push eax
push str._s:_s
lea ecx, [ebp - 0x4218]
push ecx
call fcn.005cc4f5
add esp, 0x10
push 0
push 0x3fff
lea edx, [ebp - 0x4010]
push edx
mov eax, dword [0xfd9ff0]
push eax
call sub.WSOCK32.dll_recv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x585047
xor eax, eax
jmp 0x58512e
cmp dword [ebp - 0xc], 0
jle 0x5850df
mov ecx, dword [0xfd9ff4]
add ecx, dword [ebp - 0xc]
cmp ecx, 0x4000
jb 0x5850ad
mov edx, 0x3fff
sub edx, dword [0xfd9ff4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x4010]
push ecx
push 0xfd5968
call fcn.005cdfe0
add esp, 0xc
mov edx, dword [0xfd9ff4]
add edx, dword [ebp - 0xc]
mov dword [0xfd9ff4], edx
mov eax, dword [0xfd9ff4]
mov byte [eax + 0xfd5968], 0
or eax, 0xffffffff
jmp 0x58512e
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x4010]
push edx
push 0xfd5968
call fcn.005cdfe0
add esp, 0xc
mov eax, dword [0xfd9ff4]
add eax, dword [ebp - 0xc]
mov dword [0xfd9ff4], eax
mov ecx, dword [0xfd9ff4]
mov byte [ecx + 0xfd5968], 0
cmp dword [ebp - 0xc], 0
jne 0x58512c
lea edx, [ebp - 0x4218]
push edx
push 0xfd5968
call fcn.005cc790
add esp, 8
test eax, eax
je 0x585127
lea eax, [ebp - 0x4318]
push eax
push 0xfd5968
call fcn.005cc790
add esp, 8
test eax, eax
jne 0x58511e
mov eax, 0xfffffffe
jmp 0x58512e
mov eax, 1
jmp 0x58512e
or eax, 0xffffffff
jmp 0x58512e
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x593e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3c0b8
call fcn.005cef50
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x5f7914
push str.data
push 0x5f7920
lea eax, [ebp - 0x3c0b8]
push eax
call fcn.005cc4f5
add esp, 0x10
push 0x5f7928
lea ecx, [ebp - 0x3c0b8]
push ecx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 0x3c034], eax
cmp dword [ebp - 0x3c034], 0
jne 0x593eba
jmp 0x593f34
push 0x1400c
push 0x11f9f68
lea edx, [ebp - 0x3c030]
push edx
call fcn.005cc190
add esp, 0xc
push 0x28018
lea eax, [ebp - 0x3c038]
push eax
lea ecx, [ebp - 0x28020]
push ecx
push 0
push 0x1400c
lea edx, [ebp - 0x3c030]
push edx
call fcn.005b1770
add esp, 0x18
mov eax, dword [ebp - 0x3c034]
push eax
mov ecx, dword [ebp - 0x3c038]
push ecx
push 1
lea edx, [ebp - 0x28020]
push edx
call fcn.005cdb90
add esp, 0x10
cmp eax, dword [ebp - 0x3c038]
jae 0x593f25
jmp 0x593f34
mov eax, dword [ebp - 0x3c034]
push eax
call fcn.005cd459
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret

Function at 0x593f50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x500c0
call fcn.005cef50
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push str.album.dat
push str.data
push 0x5f7938
lea eax, [ebp - 0x280a8]
push eax
call fcn.005cc4f5
add esp, 0x10
push 0x5f7940
lea ecx, [ebp - 0x280a8]
push ecx
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x593fac
call fcn.00593e60
jmp 0x59403c
mov edx, dword [ebp - 8]
push edx
push 0x28018
push 1
lea eax, [ebp - 0x28028]
push eax
call fcn.005cdfc1
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005ce984
add esp, 4
test eax, eax
je 0x593fe7
mov edx, dword [ebp - 8]
push edx
call fcn.005cd459
add esp, 4
jmp 0x59403c
mov eax, dword [ebp - 8]
push eax
call fcn.005cd459
add esp, 4
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x500c0]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x28028]
push ecx
call fcn.005b1920
add esp, 0x14
cmp dword [ebp - 4], 0x1400c
je 0x594023
call fcn.00593e60
jmp 0x59403c
push 0x1400c
lea edx, [ebp - 0x500c0]
push edx
push 0x11f9f68
call fcn.005cc190
add esp, 0xc
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x594630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x5f794c
mov eax, dword [0x129029c]
mov ecx, dword [eax*4 + 0x1290274]
shl ecx, 8
add ecx, 0x128d040
push ecx
push 0x5f7958
lea edx, [ebp - 0x88]
push edx
call fcn.005cc4f5
add esp, 0x10
push 0x5f7960
lea eax, [ebp - 0x88]
push eax
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x594699
call fcn.00594f90
jmp 0x594734
mov ecx, dword [ebp - 4]
push ecx
push 0x5dc00
push 1
push 0x1060a08
call fcn.005cdfc1
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.005cd459
add esp, 4
push 0x5f7964
mov eax, dword [0x129029c]
mov ecx, dword [eax*4 + 0x1290274]
shl ecx, 8
add ecx, 0x128d040
push ecx
push 0x5f7974
lea edx, [ebp - 0x88]
push edx
call fcn.005cc4f5
add esp, 0x10
push 0x5f797c
lea eax, [ebp - 0x88]
push eax
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x594710
call fcn.00595350
jmp 0x594734
mov ecx, dword [ebp - 4]
push ecx
push 0x139480
push 1
push 0x10c08c8
call fcn.005cdfc1
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.005cd459
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret

Function at 0x594f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x5f7980
mov eax, dword [0x129029c]
mov ecx, dword [eax*4 + 0x1290274]
shl ecx, 8
add ecx, 0x128d040
push ecx
push 0x5f798c
lea edx, [ebp - 0x88]
push edx
call fcn.005cc4f5
add esp, 0x10
push 0x5f7994
lea eax, [ebp - 0x88]
push eax
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x594ff1
jmp 0x595015
mov ecx, dword [ebp - 4]
push ecx
push 0x5dc00
push 1
push 0x1060a08
call fcn.005cdb90
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.005cd459
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret

Function at 0x595350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x632b20]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x5f7998
mov eax, dword [0x129029c]
mov ecx, dword [eax*4 + 0x1290274]
shl ecx, 8
add ecx, 0x128d040
push ecx
push 0x5f79a8
lea edx, [ebp - 0x88]
push edx
call fcn.005cc4f5
add esp, 0x10
push 0x5f79b0
lea eax, [ebp - 0x88]
push eax
call fcn.005cd6b5
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5953b1
jmp 0x5953d5
mov ecx, dword [ebp - 4]
push ecx
push 0x139480
push 1
push 0x10c08c8
call fcn.005cdb90
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.005cd459
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cbcfe
mov esp, ebp
pop ebp
ret
Function at 0x598150
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x626724], 0xffffffff
je 0x598164
jmp 0x5982fe
mov eax, dword [0xcb1fd0]
push eax
mov ecx, 0xca99f0
call fcn.005b7660
test eax, eax
jge 0x598190
mov ecx, dword [0xcb1fd0]
push ecx
mov ecx, 0xca99f0
call fcn.005b7660
neg eax
mov dword [ebp - 0x10], eax
jmp 0x5981a4
mov edx, dword [0xcb1fd0]
push edx
mov ecx, 0xca99f0
call fcn.005b7660
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x5981f0
mov eax, dword [0xcb1fc8]
push eax
mov ecx, 0xca9a20
call fcn.005b7660
test eax, eax
jge 0x5981d6
mov ecx, dword [0xcb1fc8]
push ecx
mov ecx, 0xca9a20
call fcn.005b7660
neg eax
mov dword [ebp - 0x14], eax
jmp 0x5981ea
mov edx, dword [0xcb1fc8]
push edx
mov ecx, 0xca9a20
call fcn.005b7660
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jle 0x5981f5
jmp 0x5982fe
push 7
mov eax, dword [0xcb1fc8]
push eax
mov ecx, dword [0xcb1fd0]
push ecx
call fcn.00458220
add esp, 0xc
test eax, eax
jne 0x598215
jmp 0x5982fe
push 0xca99f0
mov edx, dword [0xcb1fd0]
push edx
call fcn.005b7860
add esp, 8
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp dword [ebp - 0xc]
push 0xca9a20
mov eax, dword [0xcb1fc8]
push eax
call fcn.005b7860
add esp, 8
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp dword [ebp - 4]
push ecx
fld dword [ebp - 4]
fstp dword [esp]
push ecx
fld dword [ebp - 0xc]
fstp dword [esp]
call fcn.0049cb30
add esp, 8
mov dword [ebp - 8], eax
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x598288
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x20], edx
jmp 0x598291
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov edx, dword [0x121bbd4]
add edx, 0x1f4
cmp edx, dword [ebp - 0x20]
jae 0x5982fe
mov eax, dword [ebp - 8]
push eax
mov ecx, 0xca9a20
call fcn.005b76d0
push eax
mov ecx, 0xca99f0
call fcn.005b76d0
push eax
mov ecx, dword [0xfd5768]
push ecx
call fcn.00585960
add esp, 0x10
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp eax, 0x35a4e900
jbe 0x5982ec
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x35a4e900
div ecx
mov dword [ebp - 0x24], edx
jmp 0x5982f5
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [0x121bbd4], edx
mov esp, ebp
pop ebp
ret