joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4daebf
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x6b437c
push 4
push ebx
push ebx
push 1
lea ecx, [ebp - 0x488]
call fcn.0043cc82
mov ecx, esi
mov dword [ebp - 0x488], 0x690ab4
call fcn.005c0f42
push eax
lea ecx, [ebp - 0x488]
call fcn.00465d32
cmp eax, 1
jne 0x4db0e3
lea eax, [esi + 0x20]
push str.set_soundplan_path
mov ecx, eax
mov dword [ebp - 0x490], eax
call fcn.005cfc5e
mov esi, eax
test esi, esi
je 0x4daf4b
mov edx, dword [esi]
lea eax, [ebp - 0x40c]
push eax
mov ecx, esi
call dword [edx + 0x3c]
mov edx, dword [esi]
mov ecx, esi
push 0xff333333
call dword [edx + 0x54]
lea eax, [ebp - 0x40c]
mov esi, 0x735bd4
push eax
mov ecx, esi
call fcn.004195af
call fcn.00418f81
push eax
lea ecx, [ebp - 0x494]
call fcn.0041775d
call fcn.00418f81
push eax
lea ecx, [ebp - 0x48c]
call fcn.0041775d
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x494]
call fcn.004195af
push esi
push str._sound_
lea eax, [ebp - 0x49c]
push 0x735a88
push eax
call fcn.004227e4
add esp, 0xc
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004227ad
add esp, 0xc
lea ecx, [ebp - 0x48c]
push eax
call fcn.00418bac
mov ecx, dword [ebp - 0x498]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 0x49c]
add ecx, 0xfffffff0
call fcn.00419521
mov esi, dword [ebp - 0x48c]
mov edi, dword [ebp - 0x494]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [0x735bd4]
push ecx
add eax, 0xfffffff0
mov ebx, esp
push eax
call fcn.00418dea
add eax, 0x10
mov ecx, esp
push 0x68c444
mov dword [ebx], eax
call fcn.004177e7
push ecx
mov ecx, esp
push str.SoundPack
call fcn.004177e7
mov ecx, 0x735bd8
call fcn.004fdb1b
mov ecx, dword [ebp - 0x490]
push str.set_soundplan_path
call fcn.005cfc5e
test eax, eax
je 0x4db04b
add eax, 0xfffffff8
jmp 0x4db04d
xor eax, eax
mov dword [ebp - 0x48c], eax
test eax, eax
je 0x4db0d3
push 0x278
call fcn.00609934
pop ecx
test eax, eax
je 0x4db071
mov ecx, eax
call fcn.0043dc51
mov ebx, eax
jmp 0x4db073
xor ebx, ebx
mov eax, dword [ebx]
mov ecx, ebx
push 0x1e
call dword [eax + 0xf8]
mov eax, dword [ebx]
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, ebx
call dword [eax + 0x3c]
mov eax, dword [ebx]
mov ecx, ebx
push dword [0x735bd4]
call dword [eax + 0x170]
mov ecx, dword [ebp - 0x48c]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [ebp - 0x48c]
push 0
lea ebx, [ecx + 0x368]
mov eax, dword [ebx]
add eax, 8
mov dword [ebp - 0x490], eax
mov eax, dword [ecx]
call dword [eax + 0xc]
dec eax
mov ecx, ebx
push eax
mov eax, dword [ebp - 0x490]
call dword [eax]
lea ecx, [esi - 0x10]
call fcn.00419521
lea ecx, [edi - 0x10]
call fcn.00419521
cmp dword [ebp - 0x474], 0
je 0x4db0f7
push dword [ebp - 0x474]
call fcn.005a5954
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4dbae0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00418e45
mov eax, dword [ebp + 8]
mov byte [ebp - 1], 0
cmp dword [eax - 4], 1
jle 0x4dbb0b
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00418f15
mov eax, dword [ebp + 8]
push 0xfde9
push eax
call fcn.00507e2a
pop ecx
pop ecx
push dword [ebp + 8]
mov esi, eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4dbb65
lea edi, [ebx + 0x4c]
push edi
push esi
call sub.pcmasterdata.dll_sqlite3_open
pop ecx
pop ecx
test eax, eax
jne 0x4dbbf6
cmp byte [ebx + 4], al
je 0x4dbb5c
push dword [ebx + 0x48]
lea eax, [ebx + 5]
push eax
push dword [edi]
call sub.pcmasterdata.dll_sqlite3_key
add esp, 0xc
test eax, eax
jne 0x4dbbf6
mov byte [ebp - 1], 1
jmp 0x4dbbea
lea ecx, [ebp - 0x24]
call fcn.00417833
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov edi, esp
push eax
call fcn.00418dea
add eax, 0x10
pop ecx
mov dword [edi], eax
lea ecx, [ebp - 0x24]
lea eax, [ebp - 8]
push eax
call fcn.00419083
lea eax, [ebp - 8]
push eax
call fcn.0045f600
lea edi, [ebx + 0x4c]
push edi
push esi
call sub.pcmasterdata.dll_sqlite3_open
add esp, 0xc
test eax, eax
jne 0x4dbbc6
cmp byte [ebx + 4], al
je 0x4dbbc2
push dword [ebx + 0x48]
lea eax, [ebx + 5]
push eax
push dword [edi]
call sub.pcmasterdata.dll_sqlite3_rekey
add esp, 0xc
test eax, eax
jne 0x4dbbc6
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.00419521
lea ecx, [ebp - 0x24]
call fcn.00418dd0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00419521
cmp byte [ebp - 1], 0
je 0x4dbbf6
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x58]
call fcn.00418bac
lea ecx, [ebp - 0xc]
call fcn.00447a37
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00419521
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e6873
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
push edi
push eax
call fcn.0060b7a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x8026
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x4e68c6
lea eax, [ebp - 0x20c]
push eax
jmp 0x4e68cb
push 0x6809b0
call fcn.004177e7
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00609802
mov esp, ebp
pop ebp
ret 4

Function at 0x4e6bc5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ecx + 4]
or eax, 0x20019
push eax
push 0
push dword [ecx + 0x10]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4e6bf9
mov esi, dword [ebp + 0xc]
jmp 0x4e6c2b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
test eax, eax
push dword [ebp - 8]
cmovne ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00419521
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4e6c3f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ecx + 4]
or eax, 0x20019
push eax
push 0
push dword [ecx + 0x10]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4e6c73
mov esi, dword [ebp + 0xc]
jmp 0x4e6ca5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
test eax, eax
push dword [ebp - 8]
cmovne ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00419521
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4e6cb9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ecx + 4]
or eax, 0x20019
push eax
push 0
push dword [ecx + 0x10]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4e6ced
mov esi, dword [ebp + 0xc]
jmp 0x4e6d1f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
test eax, eax
push dword [ebp - 8]
cmovne ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00419521
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4e6d33
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
lea ecx, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push str.HKEY_LOCAL_MACHINE
call fcn.004229b4
test eax, eax
jne 0x4e6e2c
lea eax, [ebp - 0xa8]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e6e2c
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], 0x208
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
push 0
push ebx
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4e6e2c
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0xb0]
call fcn.004177e7
mov esi, dword [ebp - 0xb0]
cmp dword [esi - 0xc], 0
jle 0x4e6e16
add esi, 0xfffffff0
push esi
call fcn.00418dea
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00419521
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00419521
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
jmp 0x4e6e54
push 0x6809b0
mov ecx, edi
call fcn.004177e7
lea ecx, [esi - 0x10]
call fcn.00419521
jmp 0x4e6e38
push 0x6809b0
mov ecx, edi
call fcn.004177e7
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret
Function at 0x4e6e6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 4
pop eax
xor esi, esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], esi
call fcn.004191ed
test eax, eax
mov edx, 0x100
mov ecx, esi
lea eax, [ebp - 4]
push eax
cmovne ecx, edx
or ecx, 0x20019
push ecx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e6ed3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00419521
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00419521
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e6ef3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x808], 1
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov word [ebp - 0x804], ax
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x810], 0x400
mov esi, esp
push eax
call fcn.00418dea
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.0047b377
xor esi, esi
mov dword [ebp - 0x808], eax
inc esi
cmp eax, esi
je 0x4e6f82
cmp eax, 2
je 0x4e6f82
cmp eax, 7
je 0x4e6f82
mov esi, dword [ebp + 0x10]
add esi, 0xfffffff0
push esi
call fcn.00418dea
pop ecx
mov ecx, dword [ebp + 0xc]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, esi
jmp 0x4e7008
lea eax, [ebp - 0x80c]
push eax
mov eax, dword [ebx + 4]
or eax, 0x20019
push eax
push 0
push dword [ebx + 0x10]
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebx], eax
test eax, eax
jne 0x4e6f5e
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x80c]
xor ecx, ecx
mov dword [ebx], eax
test eax, eax
cmovne esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4e6f5e
lea eax, [ebp - 0x804]
mov ecx, edi
push eax
call fcn.004177e7
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e7022
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x438]
or dword [ebp - 0x438], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x80
push 3
push 1
push SysReAllocString
push eax
call fcn.004dba98
push 0x400
xor ebx, ebx
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.0060b7a0
add esp, 0xc
push ebx
lea eax, [ebp - 0x43c]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x43c]
je 0x4e715e
xor eax, eax
mov dword [ebp - 0x408], 7
mov word [ebp - 0x41c], ax
lea ecx, [ebp - 0x434]
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x40c], ebx
push eax
mov dword [ebp - 0x420], 0xf
mov dword [ebp - 0x424], ebx
mov byte [ebp - 0x434], bl
call fcn.0041fbf6
push ebx
lea eax, [ebp - 0x41c]
push eax
sub esp, 0x18
lea eax, [ebp - 0x434]
mov ecx, esp
push eax
call fcn.0041c7de
call fcn.00457246
add esp, 0x20
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x408], 8
mov ecx, esi
cmovae eax, dword [ebp - 0x41c]
push eax
call fcn.004228d4
push 0x400
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.0060b7a0
add esp, 0xc
lea ecx, [ebp - 0x434]
push ebx
push 1
call fcn.0041f932
push ebx
push 1
lea ecx, [ebp - 0x41c]
call fcn.0050e2c3
jmp 0x4e7075
cmp dword [ebp - 0x438], 0xffffffff
je 0x4e7173
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret

Function at 0x4e7186
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40c]
or dword [ebp - 0x40c], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x80
push 3
push 1
push SysReAllocString
push eax
call fcn.004dba98
mov edi, 0x401
lea eax, [ebp - 0x408]
push edi
xor ebx, ebx
push ebx
push eax
call fcn.0060b7a0
add esp, 0xc
lea eax, [ebp - 0x410]
push ebx
push eax
push 0x400
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e7242
cmp dword [ebp - 0x410], ebx
je 0x4e7242
mov byte [ebp - 8], bl
cmp byte [ebp - 0x408], bl
jne 0x4e7216
mov eax, ebx
jmp 0x4e7223
lea eax, [ebp - 0x408]
push eax
call fcn.006182a0
pop ecx
push eax
lea eax, [ebp - 0x408]
mov ecx, esi
push eax
call fcn.0041fabd
push edi
lea eax, [ebp - 0x408]
push ebx
push eax
call fcn.0060b7a0
jmp 0x4e71d8
cmp dword [ebp - 0x40c], 0xffffffff
pop edi
pop esi
pop ebx
je 0x4e725a
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.00609802
mov esp, ebp
pop ebp
ret
Function at 0x4e79cd
Capabilities:
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x7286bc]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x288], ecx
push ebx
mov byte [ebp - 0x18], al
push esi
push edi
mov dword [ebp - 0x284], eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0063f29a
add esp, 0xc
push 0x11
push 2
pop esi
push esi
push esi
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call ebx
and dword [ebp - 0x224], 0
xor eax, eax
push 4
mov word [ebp - 0x226], ax
lea eax, [ebp - 0x27c]
push eax
push 0x1005
push 0xffff
mov word [ebp - 0x228], si
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push edi
mov dword [ebp - 0x280], 0x10
mov dword [ebp - 0x27c], 0x1388
call esi
push 4
lea eax, [ebp - 0x27c]
push eax
push 0x1006
push 0xffff
push edi
call esi
push 0x30
xor esi, esi
lea eax, [ebp - 0x258]
push esi
push eax
call fcn.0060b7a0
mov ecx, dword [ebp - 0x288]
lea eax, [ebp - 0x230]
add esp, 0xc
mov byte [ebp - 0x258], 0x1b
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00504fd8
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x7b
mov dword [ebp - 0x224], eax
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp - 0x280]
mov word [ebp - 0x226], ax
lea eax, [ebp - 0x228]
push eax
push esi
push 0x30
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.WS2_32.dll_sendto]
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x228]
push eax
push esi
push 0x200
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
call ebx
test esi, esi
jle 0x4e7b95
mov esi, dword [ebp - 0x288]
lea eax, [ebp - 0x29c]
xor ebx, ebx
mov ecx, esi
push ebx
push eax
lea eax, [ebp - 0x1f8]
push eax
call fcn.00504f43
push ebx
lea eax, [ebp - 0x29c]
mov ecx, esi
push eax
lea eax, [ebp - 0x1f0]
push eax
call fcn.00504f43
lea eax, [ebp - 0x28c]
mov ecx, esi
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.00504fd8
lea eax, [ebp - 0x28c]
mov ecx, esi
push eax
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00461fc0
test eax, eax
setne byte [ebp - 0x284]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00419521
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x284]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00609802
mov esp, ebp
pop ebp
ret 4

Function at 0x4e7d9e
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [ecx - 0x364]
neg esi
sbb esi, esi
and esi, eax
cmp byte [ecx + 0x1c], 0
jne 0x4e7dd0
push esi
push 0
push 0x499981
call fcn.006423a8
push esi
push 0
push 0x498d0d
call fcn.006423a8
add esp, 0x18
pop esi
ret
Function at 0x4e7fa8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
lea eax, [ecx - 0x7dd]
cmp eax, 0x16
ja 0x4e81a6
cmp dword [ebx + 0x374], ecx
je 0x4e8076
mov dword [ebx + 0x374], ecx
call fcn.00418f81
push eax
lea ecx, [ebp + 8]
call fcn.0041775d
push dword [ebx + 0x374]
lea eax, [ebp + 8]
push dword [0x735a84]
push str._s_d.xml
push eax
call fcn.0041a1e9
mov esi, dword [ebp + 8]
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e8022
push esi
call fcn.0047cda5
pop ecx
test edx, edx
ja 0x4e8045
jb 0x4e8022
cmp eax, 0xbb8
jae 0x4e8045
mov ax, word [ebx + 0x374]
mov ecx, 0x713
push 0
push esi
sub ax, cx
movzx eax, ax
push 0x69d7fc
push eax
call fcn.004ea0d5
add esp, 0x10
push ecx
mov ecx, esp
push str.Taboo
call fcn.004177e7
push ecx
add esi, 0xfffffff0
mov edi, esp
push esi
call fcn.00418dea
pop ecx
add eax, 0x10
lea ecx, [ebx + 0x2c0]
mov dword [edi], eax
call fcn.004a6e35
mov ecx, esi
call fcn.00419521
call fcn.00418f81
push eax
lea ecx, [ebp - 4]
call fcn.0041775d
call fcn.00418f81
push eax
lea ecx, [ebp + 8]
call fcn.0041775d
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push dword [ebp + 0xc]
push str.d_02d_02d
push eax
call fcn.0041a1e9
add esp, 0xc
mov ecx, esp
push 0x69d818
call fcn.004177e7
mov eax, dword [ebp - 4]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp + 0x10], eax
call fcn.00418dea
pop ecx
add eax, 0x10
lea ecx, [ebp + 0xc]
mov dword [esi], eax
lea eax, [ebx + 0x2c0]
push ecx
mov ecx, eax
mov dword [ebp - 4], eax
call fcn.004987e3
push eax
lea ecx, [ebp + 8]
call fcn.00418bac
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov esi, dword [ebp + 8]
mov edi, 0x68f170
cmp dword [esi - 0xc], 0
jne 0x4e810f
push edi
lea ecx, [ebp + 8]
call fcn.004195af
mov esi, dword [ebp + 8]
push 0x69d81c
lea ecx, [ebx + 0x20]
call fcn.005cfc5e
test eax, eax
je 0x4e8128
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx + 0x3c]
push ecx
mov ecx, esp
push 0x69d83c
call fcn.004177e7
push ecx
mov esi, esp
push dword [ebp + 0x10]
call fcn.00418dea
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 4]
mov dword [esi], eax
lea eax, [ebp + 0xc]
push eax
call fcn.004987e3
push eax
lea ecx, [ebp + 8]
call fcn.00418bac
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00419521
mov esi, dword [ebp + 8]
cmp dword [esi - 0xc], 0
jne 0x4e817b
push edi
lea ecx, [ebp + 8]
call fcn.004195af
mov esi, dword [ebp + 8]
push 0x69d840
lea ecx, [ebx + 0x20]
call fcn.005cfc5e
test eax, eax
je 0x4e8194
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx + 0x3c]
lea ecx, [esi - 0x10]
call fcn.00419521
mov ecx, dword [ebp + 0x10]
call fcn.00419521
jmp 0x4e81dd
push 0x69d81c
lea ecx, [ebx + 0x20]
call fcn.005cfc5e
mov edi, 0x68f170
test eax, eax
je 0x4e81c4
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 0x3c]
push 0x69d840
lea ecx, [ebx + 0x20]
call fcn.005cfc5e
test eax, eax
je 0x4e81dd
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 0x3c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc