joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2f20
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x58f238
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c2f53
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x20], 0
call edi
test eax, eax
je 0x4c2f98
cmp dword [esp + 0x10], 0x61208
jne 0x4c2f98
push 0
lea edx, [esp + 0x10]
push edx
push 0xac
add ebx, 4
push ebx
push esi
call edi
test eax, eax
jne 0x4c2fa8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
cmp dword [esp + 0xc], 0xac
push esi
ja 0x4c2f99
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x4c2fd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c3036
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0x61208
call edi
push 0
lea edx, [esp + 0x14]
push edx
push 0xac
add ebx, 4
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4e9a30
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e9af2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x2c]
push edx
push esi
call edi
test eax, eax
je 0x4e9a85
cmp dword [esp + 0x20], 0x6060801
je 0x4e9a95
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
push 0
lea eax, [esp + 0x10]
push eax
push 0xc
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
push esi
test eax, eax
je 0x4e9a86
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx + 0x1c], 0
je 0x4e9af1
mov ecx, dword [0x6b419c]
test ecx, ecx
je 0x4e9af1
mov edx, dword [esp + 0x14]
push edx
call fcn.0048d660
mov eax, dword [esp + 0x10]
mov ecx, dword [0x6b419c]
push eax
call fcn.0048ca20
fld dword [esp + 0x18]
push 0
push ecx
fstp dword [esp]
push 0
mov ecx, 0x6e14e0
call fcn.0053c4b0
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4e9b00
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [0x6b419c]
sub esp, 0x14
test ecx, ecx
je 0x4e9b94
push esi
call fcn.0048d650
fld dword [0x6e1520]
mov edx, dword [esp + 0x1c]
push 0
push 0x80
push 2
push 0
mov dword [esp + 0x20], eax
mov eax, dword [0x6b419c]
mov cx, word [eax + 0x688]
fstp dword [esp + 0x24]
push 0
push 0x40000000
push edx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e9b93
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x10]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x1c], 0x6060801
call edi
push 0
lea edx, [esp + 0x10]
push edx
push 0xc
lea eax, [esp + 0x1c]
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x14
ret 4
Function at 0x4eaa10
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push esi
mov esi, ecx
test ebx, ebx
je 0x4eaaeb
push ebp
push edi
push 0
mov ecx, 0x6e1e08
call fcn.00548dc0
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x14]
push str._sData
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
push 0
lea ecx, [esp + 0x14]
push ecx
call ebp
mov edx, dword [esi + 0x18]
push edx
push 0
mov ecx, 0x6e1e08
call fcn.00548dc0
push eax
lea eax, [esp + 0x18]
push str._sData_d
push eax
call edi
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
call ebp
test bl, 1
je 0x4eaab7
mov eax, dword [esi + 0x18]
push eax
push eax
push 0
mov ecx, 0x6e1e08
call fcn.00548dc0
push eax
lea edx, [esp + 0x1c]
push str._sData_d_d.UII
push edx
call edi
add esp, 0x14
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.004ea3a0
test bl, 2
je 0x4eaae9
mov eax, dword [esi + 0x18]
push eax
push eax
push 0
mov ecx, 0x6e1e08
call fcn.00548dc0
push eax
lea ecx, [esp + 0x1c]
push str._sData_d_d.UIS
push ecx
call edi
add esp, 0x14
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004e9b00
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x104
ret 4
Function at 0x4fe100
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x5923fc
push eax
mov esi, ecx
xor bl, bl
call fcn.00561622
mov edi, eax
add esp, 8
test edi, edi
je 0x4fe1cd
push edi
push pe_nt_image_headers32
lea ecx, [esi + 0x14]
push 1
push ecx
call fcn.00561bf5
add esp, 0x10
cmp eax, 0x118
jne 0x4fe19b
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x11c]
lea ecx, [eax + edx*2]
cmp dword [esi + 0x120], ecx
jne 0x4fe19b
mov edx, dword [esi + 0x124]
push edx
call fcn.00560ab8
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
je 0x4fe19b
push ebp
mov ebp, dword [esi + 0x124]
push edi
push ebp
push 1
push eax
call fcn.00561bf5
add esp, 0x10
cmp ebp, eax
jne 0x4fe19a
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x11c]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebp
mov bl, 1
pop ebp
push edi
call fcn.00561321
add esp, 4
test bl, bl
jne 0x4fe1bf
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4fe1bf
push eax
call fcn.005617db
add esp, 4
mov dword [esi + 0x10], 0
pop edi
mov byte [esi + 0x128], bl
pop esi
mov al, bl
pop ebx
ret 4
pop edi
pop esi
xor al, al
pop ebx
ret 4

Function at 0x4ff710
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x500eb0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
push edi
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x500ff0
cmp byte [edi + 0x49], 0
je 0x500ff0
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
jne 0x500edf
xor al, al
pop edi
add esp, 0x20
ret
mov ecx, 0xf
xor eax, eax
mov byte [esp + 8], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 8
cmp ecx, 0x10
jae 0x500f08
lea eax, [esp + 8]
push ebx
push ebp
mov byte [eax + 8], 0
lea ebx, [edi + 0x4c]
push esi
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
lea ebx, [ebx]
mov edx, eax
cmp ebp, 0x10
jae 0x500f2d
lea edx, [esp + 0x14]
mov eax, edx
add edx, dword [esp + 0x24]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push edx
push eax
mov eax, dword [esi + 0x18]
push ebx
call eax
sub eax, 0
je 0x500f67
dec eax
je 0x500f6b
sub eax, 2
lea ecx, [esp + 0x14]
je 0x500fe1
call fcn.00428940
pop esi
pop ebp
pop ebx
xor al, al
pop edi
add esp, 0x20
ret
mov byte [edi + 0x49], 0
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov ecx, eax
cmp ebp, 0x10
jae 0x500f7e
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x10]
sub esi, ecx
je 0x500fab
cmp ebp, 0x10
jae 0x500f8f
lea eax, [esp + 0x14]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.005614ec
add esp, 0x10
cmp esi, eax
jne 0x500fca
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
cmp byte [edi + 0x49], 0
je 0x500fdd
test esi, esi
jne 0x500f20
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.00500ce0
jmp 0x500f12
lea ecx, [esp + 0x14]
call fcn.00428940
pop esi
pop ebp
pop ebx
xor al, al
pop edi
add esp, 0x20
ret
lea ecx, [esp + 0x14]
call fcn.00428940
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
add esp, 0x20
ret
mov al, 1
pop edi
add esp, 0x20
ret

Function at 0x502d70
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x100
push 0xff
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push 0x5c
push ecx
call fcn.00563b90
mov byte [eax + 1], 0
mov eax, dword [esp + 0x118]
add esp, 8
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x502da3
push esi
push edi
lea edi, [esp + 8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x502db3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x110]
push 0xff
mov ecx, eax
mov eax, dword [esp + 0x11c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x11c]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
add esp, 0x100
ret
Function at 0x503f40
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 8]
mov dword [esi], vtable.PingManager.0
push edi
xor edi, edi
push 0x1e
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.004f53b0
push edi
push edi
push edi
push 0x503ee0
push edi
push edi
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], edi
call fcn.00563e9a
add esp, 0x18
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x5040b0
Capabilities:
Create raw socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x194
push esi
xor eax, eax
push 0x18e
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00561170
add esp, 0xc
lea edx, [esp + 8]
push edx
push 0x102
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x5040f0
xor al, al
pop esi
add esp, 0x194
ret
push 1
push 3
push 2
call sub.WSOCK32.dll_socket
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x5040e6
push 4
lea ecx, [esp + 8]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x18], 0x7d0
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x5040e6
mov eax, dword [esi + 4]
push 4
lea edx, [esp + 8]
push edx
push 0x1005
push 0xffff
push eax
mov dword [esp + 0x18], 0x7d0
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
setne al
pop esi
add esp, 0x194
ret
Function at 0x50bcc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x20c
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
push esi
call ecx
test eax, eax
je 0x50bcfe
push 0x7c9
mov ecx, 0x6b6198
call fcn.004c4980
push eax
push 0x1d
push 0x6b6198
call fcn.004c5ad0
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x20c
ret
mov eax, dword [0x6df2fc]
mov dword [esp + 4], 0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0x593798
push eax
mov eax, dword [ecx + 0x134]
call eax
test eax, eax
je 0x50bcf4
cmp dword [esi + 0xc], 0
jne 0x50bd65
push 0x5937a8
mov ecx, esi
call fcn.0050c0e0
test eax, eax
jns 0x50bd49
push 0x7ca
jmp 0x50bcda
mov ecx, dword [esi]
mov edx, dword [ecx + 0xc]
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
push esi
call edx
cmp dword [esi + 0xc], 0
je 0x50be28
mov eax, dword [esi]
mov ecx, dword [eax + 0x40]
push 0x3c
push 0x1e
push esi
call ecx
mov ecx, esi
call fcn.0050bbf0
push 0
mov ecx, 0x6e1e08
call fcn.00548dc0
push eax
lea edx, [esp + 0xc]
push str._sScreenShot
push edx
call fcn.00561680
add esp, 0xc
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x50bdbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x50bdbf
push 0x7cc
jmp 0x50bcda
push 0x104
lea ecx, [esp + 0x110]
push ecx
push 0x5937e8
push str.Capture
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.0050b9b0
lea eax, [esp + 0x10c]
push eax
push 0x7cd
mov ecx, 0x6b6198
call fcn.004c4980
push eax
push 0x1d
push 0x6b6198
call fcn.004c5ad0
mov ecx, dword [esp + 0x14]
add esp, 0x10
push ecx
push 4
push 0
lea edx, [esp + 0x118]
push edx
push esi
call fcn.0050ba20
test eax, eax
js 0x50bcf4
mov eax, 1
pop esi
add esp, 0x20c
ret

Function at 0x50c480
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push esi
test eax, eax
jne 0x50c4d3
mov eax, dword [esp + 8]
push 0x593ae0
push eax
call fcn.00561622
mov esi, eax
add esp, 8
test esi, esi
je 0x50c509
mov edx, dword [esp + 0xc]
mov eax, edx
push edi
lea edi, [eax + 1]
jmp 0x50c4b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x50c4b0
push esi
sub eax, edi
push 1
push eax
push edx
call fcn.005614ec
push esi
call fcn.00561321
add esp, 0x14
pop edi
xor eax, eax
pop esi
ret 0xc
cmp eax, 1
jne 0x50c509
mov ecx, dword [esp + 8]
push 0x593ae4
push ecx
call fcn.00561622
mov esi, eax
add esp, 8
test esi, esi
je 0x50c509
mov edx, dword [esp + 0xc]
push edx
push 0x593ae8
push esi
call fcn.005625a1
push esi
call fcn.00561321
add esp, 0x10
xor eax, eax
pop esi
ret 0xc
Function at 0x50db70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x200
push esi
push edi
mov edi, dword [esp + 0x20c]
mov esi, ecx
test edi, edi
jne 0x50db92
pop edi
xor eax, eax
pop esi
add esp, 0x200
ret 4
push 0x593b74
push edi
call fcn.00561622
lea edx, [esi + 0x30]
add esp, 8
mov dword [esi + 4], eax
mov eax, edi
sub edx, edi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x50dbb0
mov eax, dword [esi + 4]
test eax, eax
je 0x50db85
push ebx
push ebp
push 2
push 0
push eax
call fcn.00563fc4
mov eax, dword [esi + 4]
push eax
call fcn.0056430c
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
mov ebx, eax
call fcn.00563fc4
add esp, 0x1c
mov ecx, esi
call fcn.0050d130
mov edx, dword [esi + 4]
push edx
push 1
lea edi, [esi + 0x18]
push 0xc
push edi
call fcn.00561bf5
mov eax, dword [edi]
sub eax, dword [esi + 0x1c]
add esp, 0x10
sub eax, dword [esi + 0x20]
lea ecx, [esi + 0x148]
push eax
call fcn.0055ae00
test eax, eax
jne 0x50dc62
push eax
push 0x38
push 0x593b90
call fcn.00513100
mov ecx, dword [esp + 0x220]
push ecx
lea edx, [esp + 0x20]
push str.Bin_File_Version_Error_____s
push edx
call fcn.00561680
add esp, 0x18
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x200
ret 4
lea ecx, [esi + 0x148]
call fcn.0055ade0
test eax, eax
je 0x50dd1e
lea edi, [ebx - 0xe]
push edi
call fcn.00560ab8
add esp, 4
mov dword [esi + 0x28], eax
test eax, eax
jne 0x50dca7
push eax
push 0x49
push 0x593be0
call fcn.00513100
add esp, 0xc
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x200
ret 4
push edi
push 0
push eax
call fcn.00561170
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 4]
add esp, 0xc
push ecx
push edi
push edx
push eax
lea ecx, [esi + 0x148]
call fcn.0055b0a0
test eax, eax
jne 0x50dcf6
mov ecx, dword [esp + 0x214]
push ecx
lea edx, [esp + 0x14]
push str.File_Open_Error_:__s
push edx
call fcn.00561680
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x18]
jmp 0x50dc4a
mov ecx, dword [esi + 4]
push ecx
call fcn.00561321
add esp, 4
pop ebp
pop ebx
mov eax, 1
pop edi
mov dword [esi + 4], 0
mov dword [esi + 0x2c], eax
pop esi
add esp, 0x200
ret 4
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esi + 0x24]
push 1
push eax
call fcn.00561bf5
mov eax, dword [esi + 0x20]
add esp, 0x10
test eax, eax
je 0x50dd55
push eax
call fcn.00560ab8
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x20]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x28], eax
call fcn.00561bf5
add esp, 0x14
mov eax, dword [esi + 4]
push eax
push 1
lea ecx, [esi + 0x25]
push 1
push ecx
call fcn.00561bf5
mov edx, dword [esi + 4]
push edx
call fcn.00561321
add esp, 0x14
mov ecx, esi
mov dword [esi + 4], 0
call fcn.0050d5a0
test eax, eax
je 0x50dc53
call fcn.0050d0f0
test eax, eax
je 0x50dc53
pop ebp
pop ebx
mov eax, 1
pop edi
mov dword [esi + 0x2c], eax
pop esi
add esp, 0x200
ret 4
Function at 0x511450
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x110
push ebx
push esi
mov esi, dword [esp + 0x11c]
lea edx, [esp + 0x18]
mov ebx, ecx
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x511470
movsx eax, byte [esi]
push eax
call fcn.005646aa
add esp, 4
test eax, eax
je 0x5114ef
lea ecx, [esp + 0x18]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x5114a5
pop esi
pop ebx
add esp, 0x110
ret 8
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp dword [eax], edi
je 0x5114ee
nop
movsx edx, word [esi + 0xa]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00562a30
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x20]
push 0x593ec0
push eax
call fcn.00561680
mov ecx, dword [esi + 0xc]
inc edi
lea eax, [ecx + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x5114b0
pop edi
lea edx, [esp + 0x18]
push edx
push 0x20
push 0x6c3018
call fcn.005645f5
mov eax, dword [0x6c3058]
mov esi, dword [esp + 0x12c]
imul eax, eax, 0x58
add esp, 0xc
cmp si, word [eax + 0x6de3b0]
jne 0x511537
cmp dword [0x6c3038], 0
je 0x511537
cmp dword [0x6c3054], 0
jne 0x511537
mov ecx, 0x6c3038
call fcn.005048c0
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
pop esi
pop ebx
mov eax, ecx
add esp, 0x110
ret 8

Function at 0x5115d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, dword [esp + 0x34]
mov bl, 0x53
push edi
mov edi, ecx
cmp byte [esi + 1], bl
jb 0x5115f7
push 0
push 0xb6
push 0x593ec4
call fcn.00513100
add esp, 0xc
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x56734661
mov dword [esp + 0x10], 0x31313561
mov byte [esp + 0x14], 0x41
mov byte [esp + 0x15], bl
mov dword [esp + 0x16], 0x61637646
mov byte [esp + 0x1a], 0x4d
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], bl
mov dword [esp + 0x1d], 0x40215e59
mov dword [esp + 0x21], 0x5a767324
mov dword [esp + 0x25], 0x26317241
mov dword [esp + 0x29], 0x2a21405e
mov dword [esp + 0x2d], 0x786673
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x511654
mov ebx, dword [esp + 0x3c]
sub eax, ecx
mov ecx, eax
xor edx, edx
push ebp
lea ebp, [ecx - 1]
mov eax, ebx
div ebp
dec ecx
pop ebp
mov al, byte [esp + edx + 0xc]
xor byte [esi + 1], al
xor edx, edx
mov eax, ebx
div ecx
mov cl, byte [esp + edx + 0xc]
xor byte [esi + 2], cl
mov dl, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x5116ac
mov edi, dword [edi + 0x114]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push ebx
push esi
push eax
push edi
call edx
pop edi
pop esi
pop ebx
add esp, 0x28
ret 8
Function at 0x512bd0
Capabilities:
Get file size

Disassembly:
sub esp, 0x39c
push 0x1ff
lea eax, [esp + 0x119]
push 0
push eax
mov byte [esp + 0x120], 0
call fcn.00561170
mov eax, dword [esp + 0x3b4]
mov ecx, dword [esp + 0x3b0]
mov edx, dword [esp + 0x3ac]
add esp, 0xc
test eax, eax
je 0x512c28
push eax
push ecx
push edx
lea eax, [esp + 0x120]
push str._s_line:_d__msg:_s_
push eax
call fcn.00561680
add esp, 0x14
jmp 0x512c3f
push ecx
push edx
lea eax, [esp + 0x11c]
push str._s_line:_d_
push eax
call fcn.00561680
add esp, 0x10
push 0xff
lea ecx, [esp + 0x19]
push 0
push ecx
mov byte [esp + 0x20], 0
call fcn.00561170
add esp, 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0xa]
movzx ecx, word [esp + 6]
movzx edx, word [esp + 4]
push eax
push ecx
push edx
lea eax, [esp + 0x20]
push str.._Log_Debug__4d_02d_02d.txt
push eax
call fcn.00561680
add esp, 0x14
cmp dword [0x6c4c90], 0
jne 0x512d73
push esi
push edi
push 0
lea ecx, [esp + 0x320]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x512d00
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x1c]
push 0x59419c
push eax
call fcn.00561622
mov esi, eax
add esp, 8
test esi, esi
je 0x512d71
call fcn.00512470
push eax
lea ecx, [esp + 0x120]
push ecx
push 0x5941a0
push esi
call fcn.005625a1
push esi
call fcn.00561321
add esp, 0x14
pop edi
pop esi
add esp, 0x39c
ret
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
ja 0x512d67
lea eax, [esp + 0x1c]
push 0x5941ac
push eax
call fcn.00561622
mov esi, eax
add esp, 8
test esi, esi
je 0x512d71
call fcn.00512470
push eax
lea ecx, [esp + 0x120]
push ecx
push str._stime:_s_n
push esi
call fcn.005625a1
push esi
call fcn.00561321
add esp, 0x14
pop edi
pop esi
add esp, 0x39c
ret
mov dword [0x6c4c90], 1
pop edi
pop esi
add esp, 0x39c
ret
Function at 0x513100
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x29c
cmp dword [0x6c4a58], 0
je 0x51315c
mov ecx, dword [esp + 0x2a4]
mov edx, dword [esp + 0x2a0]
push eax
push ecx
push edx
push 0x594038
push 0x6c4958
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6c4958
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x5132d3
int3
mov ecx, dword [esp + 0x2a0]
lea edx, [esp + 0x114]
test eax, eax
je 0x513188
push eax
mov eax, dword [esp + 0x2a8]
push eax
push ecx
push 0x594064
push edx
call fcn.00561680
add esp, 0x14
jmp 0x51319f
mov eax, dword [esp + 0x2a4]
push eax
push ecx
push 0x59407c
push edx
call fcn.00561680
add esp, 0x10
push 0xff
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.00561170
add esp, 0xc
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0xa]
movzx eax, word [esp + 6]
movzx ecx, word [esp + 4]
push edx
push eax
push ecx
lea edx, [esp + 0x20]
push str.._Log_Assert__4d_02d_02d.txt
push edx
call fcn.00561680
add esp, 0x14
cmp dword [0x6c4cb8], 0
jne 0x5132d3
push esi
push edi
push 0
lea eax, [esp + 0x220]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x513260
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1c]
push 0x5940ac
push edx
call fcn.00561622
mov esi, eax
add esp, 8
test esi, esi
je 0x5132d1
call fcn.00512470
push eax
lea eax, [esp + 0x120]
push eax
push 0x5940b0
push esi
call fcn.005625a1
push esi
call fcn.00561321
add esp, 0x14
pop edi
pop esi
add esp, 0x29c
ret
lea ecx, [esp + 8]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
ja 0x5132c7
lea edx, [esp + 0x1c]
push 0x5940bc
push edx
call fcn.00561622
mov esi, eax
add esp, 8
test esi, esi
je 0x5132d1
call fcn.00512470
push eax
lea eax, [esp + 0x120]
push eax
push 0x5940c0
push esi
call fcn.005625a1
push esi
call fcn.00561321
add esp, 0x14
pop edi
pop esi
add esp, 0x29c
ret
mov dword [0x6c4cb8], 1
pop edi
pop esi
add esp, 0x29c
ret