joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x10
push str.BER_decode_error
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00416460
lea eax, [esp + 4]
push eax
push 1
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00416a60
cmp dword [esp + 0x1c], 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
jb 0x416058
mov ecx, dword [esp + 8]
push ecx
call fcn.005c5896
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x418bb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ecx, edi
shr ecx, 2
xor ebx, ebx
test ecx, ecx
jbe 0x418be2
mov eax, edx
sub esi, edx
mov ebx, ecx
push ebp
jmp 0x418bd0
mov ebp, dword [esi + eax]
xor dword [eax], ebp
add eax, 4
sub ecx, 1
jne 0x418bd0
mov esi, dword [esp + 0x14]
pop ebp
lea eax, [ebx*4]
sub edi, eax
je 0x418c0b
add edx, eax
add esi, eax
test edi, edi
jbe 0x418c0b
mov ecx, esi
mov eax, edx
sub ecx, edx
mov esi, edi
lea ecx, [ecx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x418c00
pop edi
pop esi
pop ebx
ret

Function at 0x418c10
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
jbe 0x418c56
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [esp + 0xc], ecx
push ebp
mov ebp, dword [esi + eax]
xor ebp, dword [eax]
add eax, 4
sub ecx, 1
mov dword [edi + eax - 4], ebp
jne 0x418c38
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop ebp
add eax, eax
add eax, eax
sub edi, eax
je 0x418c81
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
jbe 0x418c81
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
sub edi, 1
mov byte [eax + esi - 1], dl
jne 0x418c72
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x419230
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x619058
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
call fcn.004194b0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
mov eax, dword [eax]
push ecx
push edx
push eax
call dword [sym.imp.advapi32.dll_CryptGenRandom]
test eax, eax
jne 0x4192b5
push 0xe
push 0x65b234
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], eax
mov byte [esp + 0x10], al
call fcn.00416460
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x5c], 0
call fcn.00418fe0
push 0x67d1a8
lea edx, [esp + 0x24]
push edx
call fcn.005c5906
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
add esp, 0x54
ret 8
Function at 0x49d0e0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
fldz
push esi
fst dword [esp + 0x18]
push edi
fst dword [esp + 0x20]
lea eax, [esp + 0x1c]
fst dword [esp + 0x24]
push eax
fst dword [esp + 0x2c]
fst dword [esp + 0x30]
fst dword [esp + 0x34]
fst dword [esp + 0x38]
fst dword [esp + 0x3c]
fstp dword [esp + 0x40]
call fcn.0049d050
mov edi, dword [ebp + 8]
push 0x62931c
push edi
call fcn.005c6f30
add esp, 8
push 0x80
push edi
mov esi, eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
fld dword [esp + 0x24]
sub esp, 0x18
fstp qword [esp + 0x10]
fld dword [esp + 0x38]
fstp qword [esp + 8]
fld dword [esp + 0x34]
fstp qword [esp]
push str.CenterPos__f__f__f_n
push 0
push esi
call fcn.00519f10
fld dword [esp + 0x58]
add esp, 0xc
fstp qword [esp + 0x10]
fld dword [esp + 0x50]
fstp qword [esp + 8]
fld dword [esp + 0x54]
fstp qword [esp]
push str.CameraSetting__f__f__f_n
push 0
push esi
call fcn.00519f10
fld dword [esp + 0x54]
add esp, 0xc
fstp qword [esp + 0x10]
fld dword [esp + 0x44]
fstp qword [esp + 8]
fld dword [esp + 0x40]
fstp qword [esp]
push str.CmrPos__f__f__f_n
push 0
push esi
call fcn.00519f10
fld dword [esp + 0x54]
add esp, 0x24
call fcn.005c5ec0
fld dword [esp + 0x2c]
push eax
call fcn.005c5ec0
fld dword [esp + 0x2c]
push eax
call fcn.005c5ec0
fld dword [esp + 0x3c]
push eax
call fcn.005c5ec0
fld dword [esp + 0x44]
push eax
call fcn.005c5ec0
fld dword [esp + 0x4c]
push eax
call fcn.005c5ec0
fld dword [esp + 0x38]
push eax
call fcn.005c5ec0
fld dword [esp + 0x38]
push eax
call fcn.005c5ec0
fld dword [esp + 0x38]
push eax
call fcn.005c5ec0
push eax
push str.Line__x__dy__dz__ddistance__dpitch__drot__dup__dview__dcross__d__n
push 0
push esi
call fcn.00519f10
push esi
call fcn.005c6cd4
add esp, 0x34
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x49d8b0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
call fcn.0049cee0
test al, al
jne 0x49d90f
cmp dword [esi + 0x15c04], 0
fld dword [esi + 0x15be0]
fimul dword [esp + 8]
fstp dword [esp + 8]
je 0x49d905
push 0x91
call dword [sym.imp.user32.dll_GetKeyState]
test al, 1
je 0x49d905
fld dword [esp + 8]
push ecx
fchs
mov ecx, esi
fmul qword [0x62abe0]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fstp dword [esp]
call fcn.0049d760
pop esi
ret 4
fld dword [esp + 8]
fstp dword [esi + 0x15bd4]
pop esi
ret 4

Function at 0x49d920
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
call fcn.0049cee0
test al, al
jne 0x49d97f
cmp dword [esi + 0x15c04], 0
fld dword [esi + 0x15be4]
fimul dword [esp + 8]
fstp dword [esp + 8]
je 0x49d975
push 0x91
call dword [sym.imp.user32.dll_GetKeyState]
test al, 1
je 0x49d975
fld dword [esp + 8]
push ecx
fchs
mov ecx, esi
fmul qword [0x62abe0]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fstp dword [esp]
call fcn.0049d740
pop esi
ret 4
fld dword [esp + 8]
fstp dword [esi + 0x15bd8]
pop esi
ret 4
Function at 0x49d990
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
call fcn.0049cee0
test al, al
jne 0x49d9f7
cmp dword [esi + 0x15c04], 0
fld dword [esi + 0x15be8]
fimul dword [esp + 8]
fadd qword [0x622160]
fstp dword [esp + 8]
je 0x49d9ed
push 0x91
call dword [sym.imp.user32.dll_GetKeyState]
test al, 1
je 0x49d9ed
fld dword [esp + 8]
push ecx
fld1
mov ecx, esi
fsubrp st(1)
fmul qword [0x627060]
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
fstp dword [esp]
call fcn.0049d780
pop esi
ret 4
fld dword [esp + 8]
fstp dword [esi + 0x15bdc]
pop esi
ret 4

Function at 0x4a2e30
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
push 0x62bf7c
push str.interface.cfg
mov edi, ecx
call fcn.005c6f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a2e51
pop edi
xor al, al
pop esi
ret
push esi
push 0xc8
push 1
add edi, 0x2628
push edi
call fcn.005c81c9
push esi
call fcn.005c6cd4
add esp, 0x14
pop edi
mov al, 1
pop esi
ret

Function at 0x4a2e80
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x2624], 0
je 0x4a2ef0
push esi
push 0x624d74
call dword [sym.imp.python22.dll_Py_BuildValue]
push eax
mov eax, dword [edi + 0x2624]
push str.OnSaveInterfaceStatus
push eax
call fcn.00547d00
push 0x62d37c
push str.interface.cfg
call fcn.005c6f30
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x4a2ed2
push str.Cannot_open_interface.cfg
call fcn.0053cd50
add esp, 4
pop esi
pop edi
ret
push esi
push 0xc8
push 1
add edi, 0x2628
push edi
call fcn.005c8bc0
push esi
call fcn.005c6cd4
add esp, 0x14
pop esi
pop edi
ret
Function at 0x4a4660
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
lea eax, [esp + 4]
push eax
push 3
mov ebx, ecx
call fcn.0051d2f0
test al, al
jne 0x4a4693
mov al, 1
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x2c
ret
mov ecx, ebx
call fcn.0051d200
movzx ecx, word [esp + 5]
cmp ecx, eax
jg 0x4a4681
lea edx, [esp + 8]
push edx
push 7
mov ecx, ebx
call fcn.0051d300
test al, al
jne 0x4a46c5
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x2c
ret
mov eax, dword [esp + 9]
add eax, 0xfffffff9
push ebp
mov ebp, dword [esp + 0xf]
movzx eax, ax
push esi
movzx esi, ax
push edi
push esi
call fcn.005c523d
add esp, 4
mov edi, eax
push edi
push esi
mov ecx, ebx
call fcn.0051d300
test al, al
jne 0x4a470f
push edi
call fcn.005c6b29
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x2c
ret
mov eax, dword [0x68a0e4]
mov ebx, 0x10
cmp dword [0x68a0f8], ebx
jae 0x4a4726
mov eax, 0x68a0e4
push eax
call fcn.0053d2e0
push ebp
call fcn.004bcba0
add esp, 8
push eax
lea ecx, [esp + 0x20]
call fcn.00416540
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], ebx
jae 0x4a474d
lea eax, [esp + 0x20]
push 0x62d37c
push eax
call fcn.005c6f30
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4a4788
push edi
call fcn.005c6b29
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.0046da60
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x2c
ret
push ebx
push 1
push esi
push edi
call fcn.005c8bc0
push ebx
call fcn.005c6cd4
push edi
call fcn.005c6b29
add esp, 0x18
lea ecx, [esp + 0x1c]
call fcn.0046da60
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.005c5ea5
add esp, 0x2c
ret
Function at 0x4a4d90
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push edi
lea eax, [esp + 8]
push eax
push 1
mov edi, ecx
call dword [sym.imp.devil.dll_ilGenImages]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.devil.dll_ilBindImage]
push 0x600
call dword [sym.imp.devil.dll_ilEnable]
push 0x602
call dword [sym.imp.devil.dll_ilOriginFunc]
mov ebx, dword [esp + 0x10]
push ebx
push 0
call dword [sym.imp.devil.dll_ilLoad]
test al, al
jne 0x4a4de4
mov edx, dword [esp + 0x14]
pop edi
mov dword [edx], 2
pop ebx
pop ecx
ret 8
push esi
mov esi, dword [sym.imp.devil.dll_ilGetInteger]
push 0xde4
call esi
cmp eax, 0x40
je 0x4a4e0a
mov eax, dword [esp + 0x18]
pop esi
pop edi
mov dword [eax], 3
xor al, al
pop ebx
pop ecx
ret 8
push 0xde5
call esi
cmp eax, 0x80
je 0x4a4e2b
mov ecx, dword [esp + 0x18]
pop esi
pop edi
mov dword [ecx], 4
xor al, al
pop ebx
pop ecx
ret 8
lea edx, [esp + 0xc]
push edx
push 1
call dword [sym.imp.devil.dll_ilDeleteImages]
call dword [sym.imp.devil.dll_ilShutDown]
push 0x62bf7c
push ebx
call fcn.005c6f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x4a4e5c
mov eax, dword [esp + 0x18]
mov dword [eax], 2
push 2
push 0
push esi
call fcn.005c847b
push esi
call fcn.005c8383
push 0
push 0
push esi
mov dword [edi + 0x3a0], eax
call fcn.005c847b
mov ecx, dword [edi + 0x3a0]
push ecx
call fcn.005c523d
mov edx, dword [edi + 0x3a0]
push esi
push 1
push edx
push eax
mov dword [edi + 0x3a8], eax
call fcn.005c81c9
push esi
call fcn.005c6cd4
push ebx
call fcn.00542330
add esp, 0x38
pop esi
mov dword [edi + 0x3a4], eax
pop edi
mov al, 1
pop ebx
pop ecx
ret 8
Function at 0x4aa6d0
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x60d9f6
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x26c], eax
push ebx
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x280]
mov dword fs:[0], eax
mov eax, dword [esp + 0x290]
mov ecx, dword [esp + 0x294]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push 8
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4aa7fd
xor ebx, ebx
mov edi, vtable.CFilename.0
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
mov dword [esp + 0x38], edi
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x28c], ebx
call fcn.0053d7d0
push 0x224
lea eax, [esp + 0x60]
push ebx
push eax
call fcn.005c5560
add esp, 0x10
lea ecx, [esp + 0x58]
push ecx
push esi
mov dword [esp + 0x60], 0x224
call sub.kernel32.dll_Module32First
cmp eax, ebx
je 0x4aa7de
nop
cmp dword [esp + 0x54], 0x10
mov eax, dword [esp + 0x40]
jae 0x4aa79f
lea eax, [esp + 0x40]
push eax
lea edx, [esp + 0x17c]
push edx
call fcn.004aa5e0
add esp, 8
test eax, eax
jne 0x4aa826
push 0x224
lea eax, [esp + 0x5c]
push ebx
push eax
call fcn.005c5560
add esp, 0xc
lea ecx, [esp + 0x58]
push ecx
push esi
mov dword [esp + 0x60], 0x224
call sub.kernel32.dll_Module32Next
test eax, eax
jne 0x4aa790
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x38], edi
jb 0x4aa7fd
mov edx, dword [esp + 0x40]
push edx
call fcn.005c5896
add esp, 4
xor al, al
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x27c
ret
lea edx, [esp + 0x178]
push edx
lea ecx, [esp + 0x1c]
call fcn.0046c0a0
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x24]
push eax
add ecx, 4
mov byte [esp + 0x294], 1
call fcn.00416950
mov ebx, 0x10
mov dword [esp + 0x18], edi
cmp dword [esp + 0x34], ebx
jb 0x4aa86f
mov ecx, dword [esp + 0x20]
push ecx
call fcn.005c5896
add esp, 4
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x10]
push esi
mov dword [eax], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp + 0x38], edi
cmp dword [esp + 0x54], ebx
jb 0x4aa897
mov ecx, dword [esp + 0x40]
push ecx
call fcn.005c5896
add esp, 4
mov al, 1
jmp 0x4aa7ff
Function at 0x4bce60
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x60e328
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov eax, dword [str.UserDict.pyc]
xor ebx, ebx
xor ebp, ebp
cmp byte [eax], 0xa
je 0x4bcf5f
mov esi, 0x68a138
lea edi, [ebx + 0x10]
lea esp, [esp]
push 4
push str.lib_
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00416460
mov ecx, dword [esi]
mov eax, ecx
mov dword [esp + 0x3c], ebx
lea esi, [eax + 1]
jmp 0x4bcee0
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4bcee0
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.004161e0
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], edi
jae 0x4bcf02
lea eax, [esp + 0x18]
push ebx
push eax
call fcn.005c67ca
add esp, 8
test eax, eax
jne 0x4bcf80
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov ecx, eax
cmp edx, edi
jae 0x4bcf24
lea ecx, [esp + 0x18]
mov eax, ecx
push ecx
push eax
call dword [sym.imp.kernel32.dll_MoveFileA]
mov dword [esp + 0x3c], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x4bcf47
mov ecx, dword [esp + 0x18]
push ecx
call fcn.005c5896
add esp, 4
inc ebp
mov edx, dword [ebp*4 + 0x68a138]
cmp byte [edx], 0xa
lea esi, [ebp*4 + 0x68a138]
jne 0x4bceb0
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x2c
ret
cmp dword [esp + 0x2c], edi
jb 0x4bcf93
mov eax, dword [esp + 0x18]
push eax
call fcn.005c5896
add esp, 4
xor al, al
jmp 0x4bcf61
Function at 0x4bdd00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x60e4a7
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6ac9e8]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
push 0
call fcn.005c7411
add esp, 4
mov esi, eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
add eax, esi
push eax
call fcn.0053da40
call fcn.0053da50
push eax
call fcn.005c73dd
mov esi, 1
push esi
call fcn.0053cac0
push 0
push str.perf_game_update.txt
call fcn.005c67ca
add esp, 0x14
test eax, eax
jne 0x4bdd88
push str.perf_game_update.txt
call dword [sym.imp.kernel32.dll_DeleteFileA]
push 0
push str.newpatch.exe
call fcn.005c67ca
add esp, 8
test eax, eax
jne 0x4bddaf
push str.patchupdater.exe
call fcn.005c94ef
add esp, 4
xor al, al
jmp 0x4bdf44
call dword [sym.imp.devil.dll_ilInit]
push ebp
call fcn.004bce00
add esp, 4
test eax, eax
je 0x4bdda8
push 0
call fcn.0053cb70
add esp, 4
or edi, 0xffffffff
test byte [0x6babbc], 1
jne 0x4bde01
or dword [0x6babbc], esi
mov ecx, 0x6babb4
mov dword [esp + 0x70], 0
call fcn.0053e890
push 0x61fbd0
call fcn.005c6092
add esp, 4
mov dword [esp + 0x70], edi
test byte [0x6babbc], 2
jne 0x4bde30
or dword [0x6babbc], 2
mov ecx, 0x6b6ed0
mov dword [esp + 0x70], esi
call fcn.005888b0
push 0x61fbc0
call fcn.005c6092
add esp, 4
mov dword [esp + 0x70], edi
push str.pack
call fcn.004bcfa0
add esp, 4
test al, al
jne 0x4bde59
push 0
push 0
push str.Pack_Initialization_failed._Check_log.txt_file..
call fcn.0053ce60
add esp, 0xc
xor al, al
jmp 0x4bdf44
push ebx
call fcn.004ab780
add esp, 4
test al, al
je 0x4bde74
call fcn.004a6be0
push eax
call fcn.0051a5c0
add esp, 4
push 0x15ca0
call fcn.005c58a1
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x70], 2
test eax, eax
je 0x4bde9c
mov ecx, eax
call fcn.0049c8c0
mov esi, eax
jmp 0x4bde9e
xor esi, esi
push ebx
mov ecx, esi
mov dword [esp + 0x74], edi
call fcn.00523160
lea ecx, [esp + 0x14]
xor bl, bl
call fcn.005483e0
lea ecx, [esp + 0x24]
mov dword [esp + 0x70], 3
call fcn.004aaab0
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x74], 4
call fcn.00548b30
add esp, 4
push str.eter.python
lea ecx, [esp + 0x18]
call fcn.00548630
test al, al
je 0x4bdefa
lea ecx, [esp + 0x14]
push ebp
push ecx
call fcn.004bd790
add esp, 8
mov bl, al
mov ecx, esi
call fcn.0049acc0
push 1
call dword [sym.imp.winmm.dll_timeEndPeriod]
lea ecx, [esp + 0x14]
call sub.python22.dll_Py_Finalize
lea ecx, [esp + 0x24]
mov byte [esp + 0x70], 3
call fcn.004aaa30
lea ecx, [esp + 0x14]
mov dword [esp + 0x70], edi
call fcn.00548400
mov ecx, esi
call fcn.0049c3c0
test esi, esi
je 0x4bdf42
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov al, bl
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.005c5ea5
add esp, 0x60
ret
Function at 0x4bdf70
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x404
mov eax, dword [0x6ac9e8]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
mov ebx, dword [esp + 0x410]
push esi
lea eax, [esp + 8]
push eax
push 0x100
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.kernel32.dll_lstrlen]
lea edx, [esp + 8]
dec edx
cmp byte [eax + edx], 0x5c
je 0x4bdfd2
push edi
lea edi, [esp + 0xc]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4bdfc0
mov ax, word [0x631208]
mov word [edi], ax
pop edi
lea eax, [esp + 8]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4bdfd7
mov ecx, dword [str.metin2client.dat]
mov edx, dword [0x6311f8]
mov dword [eax], ecx
mov ecx, dword [0x6311fc]
mov dword [eax + 4], edx
mov edx, dword [0x631200]
mov dword [eax + 8], ecx
mov cl, byte [0x631204]
mov dword [eax + 0xc], edx
mov byte [eax + 0x10], cl
call fcn.004a6c00
lea edx, [esp + 0x308]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x4be017
push 7
lea edx, [esp + 0x30c]
push str.locale_
push edx
call fcn.005c9287
add esp, 0xc
test eax, eax
jne 0x4be05a
call fcn.004a6c00
add eax, 7
lea edx, [esp + 0x308]
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4be050
mov esi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
lea eax, [esp + 8]
push eax
push 0x1ff
lea ecx, [esp + 0x110]
push ecx
push 0
push ebx
lea edx, [esp + 0x31c]
push edx
call esi
cmp byte [esp + 0x108], 0
jne 0x4be0f0
mov ecx, dword [esp + 0x410]
mov edx, dword [0x6b6eac]
push 0x1ff
lea eax, [esp + 0x10c]
push eax
push ecx
push edx
call dword [sym.imp.user32.dll_LoadStringA]
cmp byte [esp + 0x108], 0
jne 0x4be0f0
lea eax, [esp + 8]
push eax
push 0x1ff
lea ecx, [esp + 0x110]
push ecx
push 0
push ebx
push 0x6311e8
call esi
cmp byte [esp + 0x108], 0
jne 0x4be0f0
lea edx, [esp + 0x108]
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4be0e6
lea edx, [esp + 0x410]
push edx
mov ecx, 0x6b6eb0
call fcn.00514e90
mov esi, eax
lea eax, [esp + 0x108]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4be110
sub eax, edx
push eax
lea eax, [esp + 0x10c]
push eax
mov ecx, esi
call fcn.00416460
mov ecx, dword [esp + 0x408]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.005c5ea5
add esp, 0x404
ret
Function at 0x51cf60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x28]
push edi
test ecx, ecx
jle 0x51cf92
mov eax, dword [esi + 0x24]
sub eax, ecx
test eax, eax
jle 0x51cf85
mov edx, dword [esi + 0x1c]
push eax
lea eax, [edx + ecx]
push eax
push edx
call fcn.005ca0b0
add esp, 0xc
mov ecx, dword [esi + 0x28]
sub dword [esi + 0x24], ecx
mov dword [esi + 0x28], 0
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
sub eax, ecx
test eax, eax
jle 0x51cff4
mov edx, dword [esi + 0x1c]
push 0
push eax
mov eax, dword [esi + 0x5c]
add edx, ecx
push edx
push eax
call sub.ws2_32.dll_recv
mov edi, eax
test edi, edi
jge 0x51cfc7
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x51cfc9
pop edi
xor al, al
pop esi
ret
je 0x51cfc2
mov ecx, esi
call fcn.0051ce90
test al, al
je 0x51cff1
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 0x24]
cmp byte [esi + 0x4c], 0
je 0x51cff1
mov ecx, dword [esi + 0x54]
mov edx, dword [ecx + 4]
push edi
add ecx, 4
push eax
push eax
mov eax, dword [edx + 0x1c]
call eax
add dword [esi + 0x24], edi
pop edi
mov al, 1
pop esi
ret

Function at 0x51d090
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call fcn.0051d040
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [esi + 0x60], ecx
mov edx, dword [eax + 4]
lea edi, [esi + 0x60]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
push 0
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
push 1
push 2
mov dword [edi + 0xc], edx
call sub.ws2_32.dll_socket
mov dword [esi + 0x5c], eax
cmp eax, 0xffffffff
je 0x51d113
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x14], 1
call sub.ws2_32.dll_ioctlsocket
mov ecx, edi
call fcn.005428b0
mov edx, dword [esi + 0x5c]
push eax
push edi
push edx
call sub.ws2_32.dll_connect
cmp eax, 0xffffffff
jne 0x51d12b
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x51d12b
push str.error___WSAEWOULDBLOCK
call fcn.0053cc50
add esp, 4
mov ecx, esi
call fcn.0051d040
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
pop edi
xor al, al
pop esi
pop ecx
ret 8
push 0
call fcn.005c9f98
mov ecx, eax
mov eax, dword [esp + 0x18]
mov edi, edx
cdq
add esp, 4
add ecx, eax
adc edi, edx
mov dword [esi + 0xc], edi
pop edi
mov dword [esi + 8], ecx
mov al, 1
pop esi
pop ecx
ret 8

Function at 0x51d3a0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0051d2a0
mov edi, eax
test edi, edi
jle 0x51d3fb
call fcn.0051ce90
test al, al
je 0x51d3d5
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x2c]
cmp byte [esi + 0x4c], 0
je 0x51d3d5
mov ecx, dword [esi + 0x50]
mov edx, dword [ecx + 4]
push edi
add ecx, 4
push eax
push eax
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [esi + 0x2c]
add ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x5c]
push 0
push edi
push ecx
push edx
call sub.ws2_32.dll_send
test eax, eax
jge 0x51d3f1
pop edi
xor al, al
pop esi
ret
add dword [esi + 0x38], eax
mov ecx, esi
call fcn.0051d000
pop edi
mov al, 1
pop esi
ret