joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42acb8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x42ace5
push 3
mov ecx, dword [ebp - 4]
call fcn.0042b6c0
mov dword [ebp - 0x10], eax
jmp 0x42acec
mov dword [ebp - 0x10], 0
movsx eax, byte [0x5bd61c]
test eax, eax
je 0x42ad02
push 0x5bd61c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
movsx ecx, byte [0x5bd71c]
test ecx, ecx
je 0x42ad18
push 0x5bd71c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret

Function at 0x42ae22
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [ebp + 8]
push eax
call fcn.005997d0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00599938
add esp, 8
push 0x5be71c
mov eax, dword [ebp - 4]
lea ecx, [ebp + eax - 0x10b]
push ecx
call fcn.00599938
add esp, 8
push 0
push 0x8000
lea edx, [ebp - 0x108]
push edx
call fcn.0059a3c7
add esp, 0xc
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
jne 0x42ae8f
jmp 0x42afac
mov eax, dword [ebp - 0x114]
push eax
call fcn.0059a0ff
add esp, 4
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
push ecx
call fcn.0059a75e
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x11c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.0059a189
add esp, 0xc
mov edx, dword [ebp - 0x114]
push edx
call fcn.0059a01f
add esp, 4
mov dword [ebp - 0x10c], 0x5be720
mov eax, dword [ebp - 0x10c]
push eax
call fcn.005997d0
add esp, 4
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x110], 0
jmp 0x42af19
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp - 0x110]
cmp edx, dword [ebp - 0x11c]
jge 0x42af55
mov eax, dword [ebp - 0x110]
cdq
idiv dword [ebp - 0x118]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x10c]
mov al, byte [eax]
sub al, byte [ecx + edx]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x110]
mov byte [ecx], al
jmp 0x42af0a
push 0x5be7cc
mov edx, dword [ebp + 8]
push edx
call fcn.00599fd6
add esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x42afa0
mov eax, dword [ebp - 0x120]
push eax
push 1
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0059ac26
add esp, 0x10
mov eax, dword [ebp - 0x120]
push eax
call fcn.00599eec
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.0059a7ea
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x433570
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov dword [ebp - 0x204], 0
lea eax, [ebp - 0x100]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x100]
push edx
push str._s_s
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x5bea04
lea ecx, [ebp - 0x200]
push ecx
call fcn.00599fd6
add esp, 8
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
je 0x4335f4
mov edx, dword [ebp - 0x204]
push edx
call fcn.00599eec
add esp, 4
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x80
push 0x8119
mov ecx, dword [ebp + 8]
push ecx
call fcn.0059a3c7
add esp, 0xc
mov dword [0x5d4c18], eax
cmp dword [0x5d4c18], 0xffffffff
jne 0x433624
xor al, al
jmp 0x43364d
push str.___________________________________________________________________________r_n
call fcn.00433782
add esp, 4
push str.____Logging_System_turn_on._r_n
call fcn.00433782
add esp, 4
push str.____mark__r_n
call fcn.00433782
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x479b19
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
mov dword [ebp - 0x4c], ecx
cmp dword [ebp + 8], 0
je 0x479b31
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x479b38
xor eax, eax
jmp 0x479d57
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x9c]
test edx, edx
jne 0x479b4d
xor eax, eax
jmp 0x479d57
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
shl ecx, 0x10
mov edx, dword [ebp + 8]
add ecx, dword [edx + 0xc]
push ecx
mov ecx, dword [ebp - 0x4c]
call fcn.00479e51
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x98], 1
cmp dword [ebp - 4], 0xffffffff
jne 0x479d35
mov ecx, dword [ebp - 0x4c]
call fcn.00479e9e
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x90], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x90], 0xffffffff
jne 0x479bb4
mov ecx, dword [ebp - 0x4c]
call fcn.00479ee7
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x90], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x90], 0xffffffff
je 0x479d33
mov al, byte [0x5d8120]
mov byte [ebp - 0x48], al
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x9c]
cmp edx, 0x20e
je 0x479c29
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0x9c]
cmp ecx, 0x211
je 0x479c29
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x9c]
cmp eax, 0x214
je 0x479c29
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x9c]
cmp edx, 0x217
jne 0x479c30
mov dword [ebp - 8], 1
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0x9c]
cmp ecx, 0x20f
je 0x479c77
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x9c]
cmp eax, 0x212
je 0x479c77
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x9c]
cmp edx, 0x215
je 0x479c77
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0x9c]
cmp ecx, 0x218
jne 0x479c7e
mov dword [ebp - 8], 2
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x9c]
cmp eax, 0x210
je 0x479cc4
mov ecx, dword [ebp + 8]
movsx edx, word [ecx + 0x9c]
cmp edx, 0x213
je 0x479cc4
mov eax, dword [ebp + 8]
movsx ecx, word [eax + 0x9c]
cmp ecx, 0x216
je 0x479cc4
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x9c]
cmp eax, 0x219
jne 0x479ccb
mov dword [ebp - 8], 3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.00479dc5
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x10
push edx
call fcn.005996e0
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
shl ecx, 0x10
mov edx, dword [ebp + 8]
add ecx, dword [edx + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x90]
imul edx, edx, 0xc
mov eax, dword [0x9362b8]
mov dword [eax + edx + 8], ecx
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x4364a1
call fcn.0059b5ef
add esp, 0xc
jmp 0x479d52
mov edx, dword [ebp + 8]
movsx eax, word [edx + 0x9c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.00479d5e
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a9170
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
lea eax, [ebp - 0x24]
push eax
push 0x5c3130
call fcn.0059ae17
add esp, 8
test eax, eax
jne 0x4a91b8
push 0x5c3140
lea ecx, [ebp - 0x26c]
push ecx
call fcn.00599938
add esp, 8
push 0x5c3150
lea edx, [ebp - 0x16c]
push edx
call fcn.00599938
add esp, 8
jmp 0x4a91ea
mov dword [0x5d8174], 1
push str.PEVOLauncher.exe
lea eax, [ebp - 0x26c]
push eax
call fcn.00599938
add esp, 8
push str.EVOLauncher.exe
lea ecx, [ebp - 0x16c]
push ecx
call fcn.00599938
add esp, 8
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x16c]
push eax
call fcn.0059ae17
add esp, 8
test eax, eax
jne 0x4a925c
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x26c]
push edx
call fcn.0059ae17
add esp, 8
test eax, eax
jne 0x4a922a
push 0x80
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [ebp - 0x26c]
push ecx
lea edx, [ebp - 0x16c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jne 0x4a925c
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret

Function at 0x4aef26
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov dword [ebp - 0x8c], ecx
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0xa58], 0
jne 0x4aef5a
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0xa58], eax
call sub.IMM32.dll_ImmCreateContext
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 0x444]
push ecx
call sub.IMM32.dll_ImmAssociateContext
mov edx, dword [ebp - 0x8c]
mov dword [edx + 0x450], eax
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 0x450]
push ecx
push 0
mov edx, dword [ebp - 0x8c]
mov eax, dword [edx + 0x444]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x8c]
mov eax, dword [edx + 0x444]
push eax
call sub.IMM32.dll_ImmReleaseContext
push recv
push 0
push 0x281
mov ecx, dword [0x13c1aa0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 0x444]
push ecx
call sub.IMM32.dll_ImmGetDefaultIMEWnd
mov dword [ebp - 0x88], eax
push 0x80
lea edx, [ebp - 0x84]
push edx
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4afbc3
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x444]
push ecx
call sub.IMM32.dll_ImmGetContext
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4afbe6
jmp 0x4afc58
mov edx, dword [ebp + 0xc]
and edx, 8
test edx, edx
je 0x4afc21
push 0x200
mov eax, dword [ebp - 0xc]
add eax, 0x454
push eax
push 8
mov ecx, dword [ebp - 4]
push ecx
call sub.IMM32.dll_ImmGetCompositionStringA
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax + 0x454], 0
jmp 0x4afc2b
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x454], 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x444]
push ecx
call sub.IMM32.dll_ImmReleaseContext
mov edx, dword [ebp - 0xc]
add edx, 0x454
push edx
mov eax, dword [0x13c1aac]
mov edx, dword [eax]
mov ecx, dword [0x13c1aac]
call dword [edx + 0x20]
mov esp, ebp
pop ebp
ret 8
Function at 0x4b4542
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x936244], 0
je 0x4b4555
xor eax, eax
jmp 0x4b474a
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x936248], eax
cmp dword [0x936248], 0
jne 0x4b4596
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadLibrary___dbghelp.dll___:_GetLastError___lu_n
call fcn.0059beae
add esp, 8
mov dword [0x936244], 0
mov eax, 1
jmp 0x4b474a
push str.SymCleanup
mov eax, dword [0x936248]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x936270], eax
push str.SymFunctionTableAccess64
mov ecx, dword [0x936248]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x936274], eax
push str.SymGetLineFromAddr64
mov edx, dword [0x936248]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x936278], eax
push str.SymGetModuleBase64
mov eax, dword [0x936248]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x93627c], eax
push str.SymGetModuleInfo64
mov ecx, dword [0x936248]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x936280], eax
push str.SymGetOptions
mov edx, dword [0x936248]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x936284], eax
push str.SymGetSymFromAddr64
mov eax, dword [0x936248]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x936288], eax
push str.SymInitialize
mov ecx, dword [0x936248]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x93628c], eax
push str.SymSetOptions
mov edx, dword [0x936248]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x936294], eax
push str.StackWalk64
mov eax, dword [0x936248]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x936298], eax
push str.UnDecorateSymbolName
mov ecx, dword [0x936248]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x93629c], eax
push str.SymLoadModule64
mov edx, dword [0x936248]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x936290], eax
cmp dword [0x936270], 0
je 0x4b4709
cmp dword [0x936274], 0
je 0x4b4709
cmp dword [0x93627c], 0
je 0x4b4709
cmp dword [0x936280], 0
je 0x4b4709
cmp dword [0x936284], 0
je 0x4b4709
cmp dword [0x936288], 0
je 0x4b4709
cmp dword [0x93628c], 0
je 0x4b4709
cmp dword [0x936294], 0
je 0x4b4709
cmp dword [0x936298], 0
je 0x4b4709
cmp dword [0x93629c], 0
je 0x4b4709
cmp dword [0x936290], 0
jne 0x4b4733
push str.GetProcAddress__:_some_required_function_not_found._n
call fcn.0059beae
add esp, 4
mov eax, dword [0x936248]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x936244], 0
mov eax, 1
jmp 0x4b474a
mov dword [0x936244], 1
push 0x936250
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
pop ebp
ret
Function at 0x547600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5abef9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
push 0
mov ecx, dword [ebp - 0x10]
call fcn.00554900
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x9c
call fcn.0040b370
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x5afac0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 1
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x18]
mov dword [edx + 0x28], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [0x5c7bd4]
mov dword [ecx + 0x30], edx
push 0x68
push 0
mov eax, dword [ebp - 0x10]
add eax, 0x34
push eax
call fcn.005998e0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x88], 0x3a83126f
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x8c], 0x3a83126f
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x90], 0x3a83126f
mov edx, dword [ebp - 0x10]
add edx, 0x58
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x48
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x38
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0xc], ecx
mov edx, dword [0x684bb0]
cmp dword [edx + 0x24], 0x7531
jne 0x547734
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x30], 6
jne 0x547725
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x80], 0x40e00000
jmp 0x547732
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x80], 0x40a00000
jmp 0x547741
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x80], 0x40a00000
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x559833
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x104]
push ecx
call fcn.005997d0
add esp, 4
mov dword [ebp - 0x108], eax
mov edx, dword [ebp - 0x108]
sub edx, 1
mov dword [ebp - 4], edx
jmp 0x55987c
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x5598a1
mov ecx, dword [ebp - 4]
movsx edx, byte [ebp + ecx - 0x104]
cmp edx, 0x5c
jne 0x55989f
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x104], 0
jmp 0x5598a1
jmp 0x559873
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x55a000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push esi
push edi
mov dword [ebp - 0xc], 0xde2b0
mov dword [ebp - 0x10], 0xd4e228
mov dword [ebp - 0x18], 0
push 0x5cde98
push str..ItemList.bin
call fcn.00599fd6
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x55a056
push 0
push 0x5cdeac
push str.Cant_read_ItemList.bin
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x55a210
mov eax, dword [ebp - 0x1c]
push eax
push 1
push 0xde2b0
push 0xd4e228
call fcn.0059b4d8
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
push ecx
push 1
push 4
lea edx, [ebp - 0x18]
push edx
call fcn.0059b4d8
add esp, 0x10
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00599eec
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
push 0xd4e228
call fcn.005599b2
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3845ce2
je 0x55a0b2
xor eax, eax
jmp 0x55a210
mov dword [ebp - 0x14], 0
jmp 0x55a0c4
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jge 0x55a0e2
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
xor edx, 0x5a
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
mov byte [eax], dl
jmp 0x55a0bb
push 0
push 0x8000
push str..ExtraItem.bin
call fcn.0059a3c7
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x55a104
jmp 0x55a20b
mov ecx, 1
test ecx, ecx
je 0x55a17e
push 0x8e
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0059a189
add esp, 0xc
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x8e
jae 0x55a139
jmp 0x55a17e
mov cx, word [ebp - 0x12c]
mov word [ebp - 0x28], cx
movsx edx, word [ebp - 0x28]
test edx, edx
jle 0x55a157
movsx eax, word [ebp - 0x28]
cmp eax, 0x1964
jl 0x55a159
jmp 0x55a104
lea ecx, [ebp - 0x12a]
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp - 0x2c]
movsx edi, word [ebp - 0x28]
imul edi, edi, 0x8c
add edi, 0xd4e228
mov ecx, 0x23
rep movsd dword es:[edi], dword [esi]
jmp 0x55a104
mov edx, dword [ebp - 4]
push edx
call fcn.0059a01f
add esp, 4
mov dword [ebp - 0x24], 0
jmp 0x55a19c
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0xc]
jge 0x55a1ba
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x24]
movsx eax, byte [edx]
xor eax, 0x5a
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x24]
mov byte [ecx], al
jmp 0x55a193
mov edx, dword [ebp - 0xc]
push edx
push 0xd4e228
call fcn.005599b2
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3845ce2
je 0x55a1db
xor eax, eax
jmp 0x55a210
mov dword [ebp - 0x24], 0
jmp 0x55a1ed
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0xc]
jge 0x55a20b
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x24]
movsx eax, byte [edx]
xor eax, 0x5a
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x24]
mov byte [ecx], al
jmp 0x55a1e4
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5621f1
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
push 0x5ce5f8
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x562228
xor eax, eax
jmp 0x5622ab
push 0
push 0x4000000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x562285
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 0xc], 0x400
jb 0x56227a
mov dword [ebp - 0xc], 0x3ff
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
jmp 0x56229c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x5622ab
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x564b84
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x40
mov eax, dword [ebp + 0xc]
push eax
push 0xe4169c
call fcn.00564f69
add esp, 0xc
push 0x40
push 0x5afed4
push 0xe4169c
push 0xe4169c
call fcn.00564e86
add esp, 0x10
mov ecx, dword [ebp + 0x14]
and ecx, 0xff
test ecx, ecx
jne 0x564c3b
mov dword [ebp - 4], 0
jmp 0x564bd5
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x10
jge 0x564c39
push 0x20
mov eax, dword [0x5ce6c4]
push eax
push 0xe4167c
call fcn.00599ae0
add esp, 0xc
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x30
mov edx, dword [ebp + 0x10]
add edx, ecx
push edx
mov eax, dword [0x5ce6c4]
push eax
call fcn.00564d89
add esp, 8
push 0x20
mov ecx, dword [0x5ce6c0]
push ecx
mov edx, dword [0x5ce6c4]
push edx
call fcn.00564ed8
add esp, 0xc
push 0x20
push 0xe4167c
mov eax, dword [0x5ce6c0]
push eax
call fcn.00599ae0
add esp, 0xc
jmp 0x564bcc
jmp 0x564cb3
mov dword [ebp - 8], 0xf
jmp 0x564c4d
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jl 0x564cb3
push 0x20
mov edx, dword [0x5ce6c0]
push edx
push 0xe4167c
call fcn.00599ae0
add esp, 0xc
mov eax, dword [ebp - 8]
imul eax, eax, 0x30
mov ecx, dword [ebp + 0x10]
add ecx, eax
push ecx
mov edx, dword [0x5ce6c0]
push edx
call fcn.00564d89
add esp, 8
push 0x20
mov eax, dword [0x5ce6c4]
push eax
mov ecx, dword [0x5ce6c0]
push ecx
call fcn.00564ed8
add esp, 0xc
push 0x20
push 0xe4167c
mov edx, dword [0x5ce6c4]
push edx
call fcn.00599ae0
add esp, 0xc
jmp 0x564c44
push 0x40
push 0x5aff14
push 0xe4169c
push 0xe4169c
call fcn.00564e86
add esp, 0x10
push 0x40
push 0xe4169c
mov eax, dword [ebp + 8]
push eax
call fcn.00564fad
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x564ce3
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x40
mov eax, dword [ebp + 0xc]
push eax
push 0xe4163c
call fcn.00564f69
add esp, 0xc
push 0x38
push str.91__
push 0xe4163c
push 0xe4163c
call fcn.00564e86
add esp, 0x10
mov dword [ebp - 4], 0
jmp 0x564d25
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x10
jge 0x564d85
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x5b000c]
push eax
push 0x1c
mov ecx, dword [0x5ce6c8]
push ecx
call fcn.00564f1a
add esp, 0xc
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x5b000c]
push eax
push 0x1c
mov ecx, dword [0x5ce6cc]
push ecx
call fcn.00564f1a
add esp, 0xc
push 0x30
push 0x5affdc
push 0xe4163c
mov edx, dword [ebp - 4]
imul edx, edx, 0x30
mov eax, dword [ebp + 8]
add eax, edx
push eax
call fcn.00564e86
add esp, 0x10
jmp 0x564d1c
mov esp, ebp
pop ebp
ret

Function at 0x564d89
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push 0x30
push 0x5aff54
mov eax, dword [ebp + 8]
push eax
push 0xe4160c
call fcn.00564e86
add esp, 0x10
push 0x30
mov ecx, dword [ebp + 0xc]
push ecx
push 0xe4160c
call fcn.00564ed8
add esp, 0xc
push 0xe4160c
mov edx, dword [ebp + 8]
push edx
call fcn.00564de1
add esp, 8
push 0x20
push 0x5aff84
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00564e86
add esp, 0x10
pop ebp
ret