joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4142c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ecx + 4]
xorps xmm0, xmm0
push esi
push edi
push eax
movups xmmword [ebp - 0x27], xmm0
push str.SELECT_top_1__FROM_EventAuction_WHERE_AuctionIndex_d
push 0x446e50
mov edi, edx
mov word [ebp - 7], 0
movups xmmword [ebp - 0x17], xmm0
mov byte [ebp - 5], 0
mov dword [ebp - 0x28], 0xdf724c1
mov byte [ebp - 0x22], 0
mov word [ebp - 0x24], ax
call fcn.0041ad10
add esp, 0xc
test al, al
je 0x414436
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x414436
push str.CurrentBid
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x414340
or eax, eax
jmp 0x414351
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
push str.CurrentAccount
mov dword [ebp - 8], eax
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x414377
xorps xmm0, xmm0
mov word [ebp - 0x19], 0
movq qword [ebp - 0x21], xmm0
mov byte [ebp - 0x17], 0
jmp 0x414390
shl eax, 0xd
push 0xa
add eax, 0x447a7e
push eax
lea eax, [ebp - 0x21]
push 0xb
push eax
call fcn.0042752d
add esp, 0x10
push str.CurrentName
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x4143b3
xorps xmm0, xmm0
mov word [ebp - 0xe], 0
movq qword [ebp - 0x16], xmm0
mov byte [ebp - 0xc], 0
jmp 0x4143cc
shl eax, 0xd
push 0xa
add eax, 0x447a7e
push eax
lea eax, [ebp - 0x16]
push 0xb
push eax
call fcn.0042752d
add esp, 0x10
push str.Ended
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x4143fb
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov byte [ebp - 0x22], 2
jmp 0x414450
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
mov esi, eax
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov byte [ebp - 0x22], 1
test esi, esi
je 0x414450
mov byte [ebp - 0x22], 2
jmp 0x414450
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 0x24
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0041c350
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041dc7d
mov esp, ebp
pop ebp
ret
Function at 0x4152d0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
movzx eax, byte [esi + 0x14]
lea ecx, [esi + 6]
push eax
movzx eax, word [esi + 0x12]
push eax
push ecx
push str.SELECT__FROM_CustomItemBank_WHERE_AccountID_s_and_ItemIndex_d_and_ItemLevel_d
push 0x446e50
call fcn.0041ad10
add esp, 0x14
test al, al
je 0x41534a
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x41534a
push dword [0x446e5c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call edi
mov ebx, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call ebx
movzx eax, byte [esi + 0x14]
push eax
movzx eax, word [esi + 0x12]
push eax
lea eax, [esi + 6]
push eax
push dword [esi + 0x18]
push str.Update_CustomItemBank_SET_ItemCountItemCount_d_WHERE_AccountID_s_and_ItemIndex_d_and_ItemLevel_d
jmp 0x41537e
push dword [0x446e5c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call edi
mov ebx, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call ebx
push dword [esi + 0x18]
movzx eax, byte [esi + 0x14]
push eax
movzx eax, word [esi + 0x12]
push eax
lea eax, [esi + 6]
push eax
push str.INSERT_INTO_CustomItemBank__AccountID_ItemIndex_ItemLevel_ItemCount__VALUES___s__d__d__d_
push 0x446e50
call fcn.0041ad10
add esp, 0x18
push dword [0x446e5c]
call edi
push 2
push dword [0x446e5c]
call ebx
mov ax, word [esi + 4]
xorps xmm0, xmm0
mov cl, byte [esi + 0x14]
movzx edx, word [esi + 0x12]
movups xmmword [ebp - 0x17], xmm0
mov word [ebp - 0x14], ax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
movzx eax, cl
push eax
push edx
lea eax, [esi + 6]
mov word [ebp - 7], 0
push eax
push str.SELECT__FROM_CustomItemBank_WHERE_AccountID_s_and_ItemIndex_d_and_ItemLevel_d
push 0x446e50
mov byte [ebp - 5], 0
mov dword [ebp - 0x18], 0x36f714c1
mov word [ebp - 0x12], dx
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xf], 0
call fcn.0041ad10
add esp, 0x14
test al, al
je 0x415441
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x415441
push str.ItemCount
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x415419
or eax, eax
jmp 0x41542a
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
push dword [0x446e5c]
mov dword [ebp - 8], eax
call edi
push 2
push dword [0x446e5c]
call ebx
jmp 0x41545a
push dword [0x446e5c]
call edi
push 2
push dword [0x446e5c]
call ebx
mov dword [ebp - 8], 0xffffffff
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call fcn.0041c350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415750
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ecx + 4]
xorps xmm0, xmm0
push ebx
movups xmmword [ebp - 0x1b], xmm0
mov word [ebp - 0x18], ax
movzx eax, word [ecx + 6]
push esi
push edi
mov word [ebp - 0x16], ax
lea eax, [ecx + 8]
push eax
push str.SELECT_top_1__FROM_CustomBattlePassData_WHERE_Name_s
push 0x446e50
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xb], 0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x1c], 0x41f718c1
call fcn.0041ad10
mov esi, dword [sym.imp.ODBC32.dll_SQLFetch]
add esp, 0xc
test al, al
je 0x41582a
push dword [0x446e5c]
call esi
cmp ax, 0x64
je 0x41582a
push str.StarCount
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x4157d9
or eax, eax
jmp 0x4157ea
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
push str.StarUsed
mov dword [ebp - 0x14], eax
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x415800
or eax, eax
jmp 0x415811
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
push dword [0x446e5c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
mov dword [ebp - 0x10], eax
call edi
mov ebx, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
jmp 0x415877
push dword [0x446e5c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call edi
mov ebx, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call ebx
mov eax, dword [ebp - 0x20]
add eax, 8
push eax
push str.INSERT_INTO_CustomBattlePassData__Name__VALUES___s_
push 0x446e50
call fcn.0041ad10
add esp, 0xc
push dword [0x446e5c]
call edi
push 2
push dword [0x446e5c]
call ebx
mov ecx, dword [ebp - 0x20]
xorps xmm0, xmm0
movq qword [ebp - 0xc], xmm0
movzx eax, word [ecx + 6]
push eax
lea eax, [ecx + 8]
push eax
push str.SELECT__FROM_CustomBattlePassReward_WHERE_Name_s_and_BattleType_d
push 0x446e50
call fcn.0041ad10
add esp, 0x10
test al, al
je 0x4158f9
push dword [0x446e5c]
call esi
cmp ax, 0x64
je 0x4158f9
nop dword [eax]
push str.BattleSlot
call fcn.0041af60
cmp eax, 0xffffffff
je 0x4158eb
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
dec eax
add esp, 4
cmp eax, 7
ja 0x4158eb
mov byte [ebp + eax - 0xc], 1
push dword [0x446e5c]
call esi
cmp ax, 0x64
jne 0x4158c0
push dword [0x446e5c]
call edi
push 2
push dword [0x446e5c]
call ebx
movzx eax, byte [ebp - 0x1b]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call fcn.0041c350
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041dc7d
mov esp, ebp
pop ebp
ret
Function at 0x415930
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
push edi
xorps xmm0, xmm0
mov word [ebp - 0xb], 0
movups xmmword [ebp - 0x23], xmm0
mov ax, word [esi + 4]
lea edi, [esi + 0xc]
push dword [esi + 8]
movq qword [ebp - 0x13], xmm0
push edi
push str.SELECT_top_1__FROM_CustomBattlePassData_WHERE_Name_s_and_StarCount____d
push 0x446e50
mov byte [ebp - 9], 0
mov dword [ebp - 0x24], 0x42f71cc1
mov word [ebp - 0x20], ax
mov byte [ebp - 0x1e], 0
call fcn.0041ad10
add esp, 0x10
test al, al
je 0x415a9d
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x415a9d
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
lea eax, [esi + 7]
mov dword [ebp - 4], eax
lea ebx, [esi + 6]
movzx eax, byte [eax]
push eax
movzx eax, byte [ebx]
push eax
push edi
push str.SELECT_top_1__FROM_CustomBattlePassReward_WHERE_Name_s_and_BattleType_d_and_BattleSlot_d
push 0x446e50
call fcn.0041ad10
add esp, 0x14
test al, al
je 0x415a13
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x415a13
push dword [0x446e5c]
mov eax, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call eax
mov eax, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call eax
jmp 0x415ac4
push dword [0x446e5c]
mov eax, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
mov byte [ebp - 0x1e], 1
call eax
mov eax, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call eax
movzx eax, byte [esi + 7]
push eax
movzx eax, byte [ebx]
push eax
push edi
push str.INSERT_INTO_CustomBattlePassReward__Name_BattleType_BattleSlot__VALUES___s__d__d_
push 0x446e50
call fcn.0041ad10
add esp, 0x14
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov eax, dword [esi + 8]
push edi
push eax
push eax
push str.Update_CustomBattlePassData_SET_StarCountStarCount__d__StarUsedStarUsed_d_WHERE_Name_s
push 0x446e50
call fcn.0041ad10
add esp, 0x14
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
jmp 0x415abe
push dword [0x446e5c]
mov byte [ebp - 0x1e], 3
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
lea ebx, [esi + 6]
lea eax, [esi + 7]
mov dword [ebp - 4], eax
mov al, byte [ebx]
mov ecx, dword [ebp - 4]
movq xmm0, qword [edi]
mov byte [ebp - 0x1d], al
push 0x1c
mov al, byte [ecx]
mov byte [ebp - 0x1c], al
mov eax, dword [esi + 8]
mov dword [ebp - 0x18], eax
mov ax, word [edi + 8]
mov word [ebp - 0xc], ax
mov al, byte [edi + 0xa]
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
movq qword [ebp - 0x14], xmm0
call fcn.0041c350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415b10
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
xorps xmm0, xmm0
mov byte [ebp - 7], 0
movq qword [ebp - 0xf], xmm0
mov dword [ebp - 0x10], 0x45f70ac1
mov ax, word [edi + 4]
lea edx, [edi + 9]
mov cl, byte [edi + 7]
mov word [ebp - 0xc], ax
mov al, byte [edi + 6]
mov byte [ebp - 9], al
movzx eax, al
push eax
movzx eax, cl
push eax
push edx
push str.SELECT_top_1__FROM_CustomDailyReward_WHERE_AccountID_s_and_Day_d_and_Month_d
push 0x446e50
mov byte [ebp - 8], cl
mov byte [ebp - 0xa], 2
call fcn.0041ad10
add esp, 0x14
test al, al
je 0x415b9c
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x415b9c
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
jmp 0x415c9e
push dword [0x446e5c]
mov ebx, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
call ebx
mov esi, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call esi
mov cl, byte [edi + 7]
movzx eax, byte [edi + 6]
push eax
cmp cl, 0x20
jne 0x415c6e
lea eax, [edi + 9]
push eax
push str.SELECT_count___FROM_CustomDailyReward_WHERE_AccountID_s_AND_Month_d
push 0x446e50
call fcn.0041ad10
add esp, 0x10
test al, al
je 0x415c8c
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x415c8c
push 0x447a7e
call fcn.0042417e
add esp, 4
mov esi, eax
push dword [0x446e5c]
call ebx
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
movzx ecx, byte [edi + 8]
cmp esi, ecx
jl 0x415c68
movzx eax, byte [edi + 6]
push eax
movzx eax, byte [edi + 7]
push eax
lea eax, [edi + 9]
mov byte [ebp - 0xa], 1
push eax
push str.INSERT_INTO_CustomDailyReward__AccountID_Day_Month__VALUES___s__d__d_
push 0x446e50
call fcn.0041ad10
add esp, 0x14
push dword [0x446e5c]
call ebx
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
jmp 0x415c9e
mov byte [ebp - 0xa], 4
jmp 0x415c9e
movzx eax, cl
push eax
lea eax, [edi + 9]
mov byte [ebp - 0xa], 1
push eax
push str.INSERT_INTO_CustomDailyReward__AccountID_Day_Month__VALUES___s__d__d_
push 0x446e50
call fcn.0041ad10
add esp, 0x14
push dword [0x446e5c]
call ebx
push 2
push dword [0x446e5c]
call esi
push 0xa
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call fcn.0041c350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418500
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push edi
push 0x27
lea eax, [ebp - 0x27]
push 0
push eax
call fcn.0041f490
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x28], 0x21128c1
mov word [ebp - 0xc], 0
mov dword [ebp - 8], 0
movzx eax, word [ecx + 4]
movq xmm0, qword [ecx + 6]
mov word [ebp - 0x24], ax
movzx eax, word [ecx + 0xe]
mov word [ebp - 0x1a], ax
mov al, byte [ecx + 0x10]
add ecx, 0x11
mov byte [ebp - 0x18], al
push ecx
movq qword [ebp - 0x22], xmm0
movzx eax, word [ecx + 8]
movq xmm0, qword [ecx]
mov word [ebp - 0xf], ax
mov al, byte [ecx + 0xa]
push str.SELECT_Family_FROM_Gens_Rank_WHERE_Name_s
push 0x446e50
mov dword [ebp + 8], ecx
movq qword [ebp - 0x17], xmm0
mov byte [ebp - 0xd], al
mov dword [ebp - 4], 0
call fcn.0041ad10
add esp, 0xc
test al, al
je 0x418698
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x418698
push str.Family
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x4185b7
or ebx, eax
jmp 0x4185ca
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
mov ebx, eax
push dword [0x446e5c]
mov edi, dword [sym.imp.ODBC32.dll_SQLCloseCursor]
mov byte [ebp - 0xb], bl
call edi
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
movzx eax, bl
push eax
push dword [ebp + 8]
push str.EXEC_WZ_GetCharacterGensInfo__s__d
push 0x446e50
call fcn.0041ad10
add esp, 0x10
test al, al
je 0x41867f
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFetch]
cmp ax, 0x64
je 0x41867f
push str.Rank
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x41862b
or eax, eax
jmp 0x41863c
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
push str.Contribution
mov dword [ebp - 8], eax
call fcn.0041af60
cmp eax, 0xffffffff
jne 0x418652
or eax, eax
jmp 0x418663
shl eax, 0xd
add eax, 0x447a7e
push eax
call fcn.0042417e
add esp, 4
push dword [0x446e5c]
mov dword [ebp - 4], eax
call edi
mov eax, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call eax
jmp 0x4186b6
push dword [0x446e5c]
call edi
mov eax, dword [sym.imp.ODBC32.dll_SQLFreeStmt]
push 2
push dword [0x446e5c]
call eax
jmp 0x4186b2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLCloseCursor]
push 2
push dword [0x446e5c]
call dword [sym.imp.ODBC32.dll_SQLFreeStmt]
mov byte [ebp - 0xc], 1
push 0x28
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
call fcn.0041c350
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41a0d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push edi
test eax, eax
js 0x41a2ba
cmp eax, dword [ecx + 0x218]
jge 0x41a2ba
imul edi, eax, 0x214
add edi, ecx
cmp dword [edi + 4], 0
je 0x41a2ba
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x816]
cmp eax, dword [edi + 0x108]
jne 0x41a14f
movzx eax, word [ebp - 0x81a]
cmp eax, dword [edi + 0x10c]
jne 0x41a14f
movzx eax, word [ebp - 0x81c]
cmp eax, dword [edi + 0x110]
je 0x41a20e
push dword [edi + 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, word [ebp - 0x816]
lea esi, [edi + 0x114]
movzx ecx, word [ebp - 0x81a]
movzx eax, word [ebp - 0x81c]
push edx
push ecx
push eax
mov dword [edi + 0x110], eax
lea eax, [edi + 8]
push eax
push str.._s_04d__02d__02d.txt
push esi
mov dword [edi + 0x108], edx
mov dword [edi + 0x10c], ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0x214], eax
cmp eax, 0xffffffff
jne 0x41a1d9
mov dword [edi + 4], 0
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041dc7d
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41a20e
push dword [edi + 0x214]
mov dword [edi + 4], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041dc7d
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.0041f490
add esp, 0xc
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x80c]
push 0x400
push eax
call fcn.0041a2e0
add esp, 0x14
lea eax, [ebp - 0x40c]
push 0x400
push 0
push eax
call fcn.0041f490
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
movzx eax, word [ebp - 0x810]
push eax
movzx eax, word [ebp - 0x812]
push eax
movzx eax, word [ebp - 0x814]
push eax
lea eax, [ebp - 0x40c]
push str._02d:_02d:_02d__s_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x40c]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a294
push 0
lea eax, [ebp - 0x820]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x40c]
push eax
push dword [edi + 0x214]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0041dc7d
mov esp, ebp
pop ebp
ret
Function at 0x41a400
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
push 0x100
lea ebx, [esi + 0xc]
push ebx
call fcn.0042138d
add esp, 0xc
push 0
push 0x20
push 3
push 0
push 1
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41a458
push ebx
lea eax, [esi + 0x218]
push str.__s__Could_not_open_file
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x41a47b
push eax
call fcn.0041df3d
add esp, 4
mov dword [esi + 4], 0
push dword [esi + 8]
call fcn.0041df42
add esp, 4
mov dword [esi + 4], eax
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push 0
push ecx
push dword [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41a4cb
push ebx
lea eax, [esi + 0x218]
push str.__s__Could_not_read_file
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
mov dword [esi + 0x214], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41b830
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x446040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
jmp 0x41b856
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
jmp 0x41b86f
mov eax, dword [0x446d78]
test eax, eax
jne 0x41b95e
imul edi, eax, 0x214
inc eax
push 0x4423f8
push 0x100
mov dword [0x446d78], eax
add edi, 0x446b64
lea ebx, [edi + 4]
mov dword [edi], 1
push ebx
call fcn.0042138d
add esp, 0xc
cmp dword [edi], 0
je 0x41b95e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x12]
lea esi, [edi + 0x110]
movzx ecx, word [ebp - 0x16]
movzx eax, word [ebp - 0x18]
push edx
push ecx
push eax
push ebx
push str.._s_04d__02d__02d.txt
push esi
mov dword [edi + 0x104], edx
mov dword [edi + 0x108], ecx
mov dword [edi + 0x10c], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [edi + 0x210], eax
cmp eax, 0xffffffff
jne 0x41b93a
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041dc7d
mov esp, ebp
pop ebp
ret 4
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x41b95e
push dword [edi + 0x210]
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041dc7d
mov esp, ebp
pop ebp
ret 4
Function at 0x41c070
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, ecx
mov eax, dword [edi + 0x70]
test eax, eax
je 0x41c096
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x70]
call ebx
mov dword [edi + 0x70], 0
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x41c0a7
push eax
call ebx
mov dword [edi + 0x6c], 0
push esi
lea ecx, [edi + 0x38]
call fcn.0041b3d0
lea esi, [edi + 0x14]
mov ebx, 8
mov eax, dword [esi]
test eax, eax
je 0x41c0d5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
add esi, 4
sub ebx, 1
jne 0x41c0b8
mov eax, dword [edi + 0x10]
pop esi
test eax, eax
je 0x41c101
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [edi + 0x10], 0
jmp 0x41c107
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 8]
test eax, eax
je 0x41c118
push eax
call ebx
mov dword [edi + 8], 0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x41c12e
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 4], 0xffffffff
pop edi
pop ebx
ret