joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
test edx, edx
jle 0x488e70
mov cl, byte [0xbf8c9e]
mov bl, byte [0xbf8c9f]
cmp edx, 0x40
jb 0x488e61
mov eax, edx
and eax, 0xffffffc0
mov dword [ebp - 4], eax
movsx eax, cl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx eax, bl
pshufd xmm2, xmm0, 0
movd xmm0, eax
lea eax, [edi + 0x20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm3, xmm0, 0
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x20]
lea eax, [eax + 0x40]
add esi, 0x40
movaps xmm1, xmm2
paddb xmm1, xmm0
xorps xmm1, xmm3
movups xmmword [eax - 0x60], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x50]
paddb xmm0, xmm2
xorps xmm0, xmm3
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [eax - 0x40]
paddb xmm1, xmm0
xorps xmm1, xmm3
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
paddb xmm0, xmm2
xorps xmm0, xmm3
movups xmmword [eax - 0x30], xmm0
cmp esi, dword [ebp - 4]
jl 0x488e10
cmp esi, edx
jge 0x488e70
mov al, byte [esi + edi]
add al, cl
xor al, bl
mov byte [esi + edi], al
inc esi
cmp esi, edx
jl 0x488e61
mov bh, byte [0xbf8c9d]
mov bl, byte [0xbf8c9c]
test bh, bh
jne 0x488e88
test bl, bl
je 0x488f2f
xor eax, eax
test edx, edx
jle 0x488f2f
cmp edx, 0x40
jb 0x488f20
movsx ecx, bh
mov esi, edx
and esi, 0xffffffc0
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bl
pshufd xmm2, xmm0, 0
movd xmm0, ecx
lea ecx, [edi + 0x20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm3, xmm0, 0
nop dword [eax + eax]
movups xmm0, xmmword [ecx - 0x20]
lea ecx, [ecx + 0x40]
add eax, 0x40
movaps xmm1, xmm3
paddb xmm0, xmm3
xorps xmm0, xmm2
movups xmmword [ecx - 0x60], xmm0
movups xmm0, xmmword [ecx - 0x50]
paddb xmm1, xmm0
xorps xmm1, xmm2
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
paddb xmm0, xmm3
xorps xmm0, xmm2
movups xmmword [ecx - 0x40], xmm0
movups xmm0, xmmword [ecx - 0x30]
paddb xmm0, xmm3
xorps xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
cmp eax, esi
jl 0x488ed0
cmp eax, edx
jge 0x488f2f
nop dword [eax]
mov cl, byte [eax + edi]
add cl, bl
xor cl, bh
mov byte [eax + edi], cl
inc eax
cmp eax, edx
jl 0x488f20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488f40
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
jmp 0x488f5b
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 8], 1
mov ebx, 2
lea ecx, [ebx + 1]
mov eax, 0xf0f0f0f1
mul ecx
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0xbda80d]
xor al, byte [ebx + 0xbda759]
movzx esi, al
mov eax, 0xf0f0f0f1
mul ebx
mov eax, edi
add ebx, 4
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
movzx eax, byte [eax + 0xbda80c]
xor al, byte [ecx + 0xbda759]
movzx eax, al
add si, ax
mov eax, 0xf0f0f0f1
mul ecx
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0xbda80b]
xor al, byte [edi + 0xbda759]
movzx eax, al
add si, ax
mov eax, 0xf0f0f0f1
mul edi
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0xbda80a]
xor al, byte [edi + 0xbda758]
add edi, 4
movzx eax, al
add si, ax
add word [ebp - 4], si
cmp ebx, 0x22
jb 0x488f70
mov al, byte [ebp - 4]
push str...DataHackMHPServer.ini
sub al, 0x12
push 0x20
mov byte [0xbf8c9f], al
mov eax, dword [ebp - 4]
push 0xbfc244
push 0x556a78
shr eax, 8
push str.CustomerName
dec al
push str.MHPServerInfo
mov byte [0xbf8c9e], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str...DataHackMHPServer.ini
push 0
push str.EncDecKey1
push str.MHPServerInfo
call esi
push str...DataHackMHPServer.ini
push 0
push str.EncDecKey2
push str.MHPServerInfo
mov byte [0xbf8c9d], al
call esi
mov dl, byte [0xbf8c9d]
mov cl, al
mov byte [0xbf8c9c], cl
test dl, dl
jne 0x4890a9
test cl, cl
je 0x489125
xor eax, eax
xorps xmm2, xmm2
xorps xmm1, xmm1
movq xmm0, qword [eax + 0xbfc244]
punpcklbw xmm0, xmm0
psraw xmm0, 8
paddw xmm2, xmm0
movq xmm0, qword [eax + 0xbfc24c]
punpcklbw xmm0, xmm0
add eax, 0x10
psraw xmm0, 8
paddw xmm1, xmm0
cmp eax, 0x20
jb 0x4890b1
paddw xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddw xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddw xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
paddw xmm1, xmm0
movd eax, xmm1
movzx eax, ax
add dl, al
shr eax, 8
add cl, al
mov byte [0xbf8c9d], dl
mov byte [0xbf8c9c], cl
jmp 0x489137
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489f90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x57a040]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0xbdac68], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
je 0x48a1a7
mov edi, dword [ebx*4 + 0x20a514c]
test ebx, ebx
js 0x48a1a7
cmp ebx, 0x1194
jge 0x48a1a7
cmp dword [edi + 4], 3
jne 0x48a1a7
movzx eax, word [edi + 0x78]
cmp eax, 1
je 0x489fee
cmp eax, 6
jne 0x48a1a7
cmp byte [edi + 0xa], 0
jg 0x48a1a7
cmp byte [edi + 0x9c0], 0
jne 0x48a1a7
movsx eax, word [edi + 0xd0]
cmp eax, dword [0xbdac6c]
jl 0x48a1a7
movzx esi, byte [edi + 0x149]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], esi
push eax
mov ecx, 0x9f436c
call fcn.00405650
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x9f436c]
cmp byte [eax + 0xd], 0
jne 0x48a04c
cmp esi, dword [eax + 0x10]
jge 0x48a04e
mov eax, ecx
cmp eax, ecx
je 0x48a1a7
xor ecx, ecx
cmp dword [eax + 0x38], 0xffffffff
cmovne ecx, dword [eax + 0x38]
test ecx, ecx
je 0x48a1a7
movsx edx, word [edi + 0x146]
imul ecx, esi, 0x15d38
movsx esi, word [edi + 0x144]
test esi, esi
js 0x48a0a9
cmp esi, dword [ecx + 0xd2f384]
jge 0x48a0a9
test edx, edx
js 0x48a0a9
mov eax, dword [ecx + 0xd2f388]
cmp edx, eax
jge 0x48a0a9
imul eax, edx
add eax, dword [ecx + 0xd2f380]
test byte [eax + esi], 1
jne 0x48a1a7
cmp dword [edi + 0x698], 1
jne 0x48a143
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x2fc
push eax
lea eax, [esp + 0x18]
mov ecx, 0xa9b83c
push eax
call fcn.00405650
mov eax, dword [esp + 0x1c]
mov ecx, dword [0xa9b83c]
cmp byte [eax + 0xd], 0
jne 0x48a0eb
cmp dword [eax + 0x10], 0x2fc
jle 0x48a0ed
mov eax, ecx
cmp eax, ecx
jne 0x48a110
push 0x2fc
push str.Could_not_find_message__d_
push 0xa9b7bc
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, 0xa9b7bc
jmp 0x48a113
add eax, 0x18
push eax
push 0
push 0
push 0
push 0
push 0
push 1
push dword [edi]
push 0xb90558
call fcn.004cdc70
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
cmp byte [eax + 4], 0
jne 0x48a169
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [edi + 0x718], eax
call esi
mov dword [edi + 0x71c], eax
mov byte [esp + 0x20], 0
jmp 0x48a182
mov dword [edi + 0x718], 0
mov dword [edi + 0x71c], 0
mov byte [esp + 0x20], 1
push 0x10
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x51bf10c1
push eax
push ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.005192f0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00529f01
mov esp, ebp
pop ebp
ret 8
Function at 0x493670
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
push ebx
mov ebx, dword [ecx*4 + 0x20a514c]
push esi
push edi
test ecx, ecx
js 0x493850
cmp ecx, 0x1194
jge 0x493850
cmp dword [ebx + 4], 3
jne 0x493850
movzx eax, word [ebx + 0x78]
cmp eax, 1
je 0x4936b6
cmp eax, 6
jne 0x493850
cmp byte [ebx + 0xa], 0
jg 0x493850
cmp byte [ebx + 0x9c0], 0
jne 0x493850
mov esi, dword [ebp + 8]
mov dword [esp + 0x18], 0x20bf06c1
mov byte [esp + 0x1d], 0xff
mov al, byte [esi + 4]
mov byte [esp + 0x1c], al
cmp al, 0xcc
jae 0x493843
cmp al, 0xc
jb 0x493843
movzx eax, al
imul edx, eax, 0x10c
mov eax, dword [ebx + 0x390]
mov dword [esp + 0x14], edx
movzx edi, word [edx + eax + 4]
lea eax, [edi - 0x1a80]
cmp ax, 6
ja 0x493843
mov eax, dword [ebx + 0x390]
movss xmm0, dword [edx + eax + 0x20]
ucomiss xmm0, dword [0x56a714]
lahf
test ah, 0x44
jnp 0x493843
cmp byte [esi + 5], 0xfe
jne 0x4937a4
ucomiss xmm0, dword [0x56a81c]
lahf
test ah, 0x44
jp 0x4937a4
xor edx, edx
mov ecx, 0x6460e4
test edx, edx
js 0x49376b
cmp edx, 0x100
jge 0x49376b
cmp dword [ecx], edx
jne 0x49376b
movsx eax, di
cmp dword [ecx + 8], eax
je 0x493779
add ecx, 0x4c
inc edx
cmp ecx, 0x64ace4
jl 0x493753
jmp 0x4937a4
mov eax, dword [esp + 0x14]
mov edx, dword [ebx + 0x390]
push 0
push 0
push 0
push 0
push 0
mov dword [eax + edx + 0x20], 0x437e0000
push dword [ecx]
push 1
push ebx
call fcn.00477200
mov byte [esp + 0x1d], 0xfe
cmp byte [esi + 5], 0xff
jne 0x49382b
movzx eax, byte [esi + 4]
mov edi, dword [ebx + 0x390]
imul esi, eax, 0x10c
movss xmm0, dword [esi + edi + 0x20]
ucomiss xmm0, dword [0x56a818]
lahf
test ah, 0x44
jp 0x49382b
xor edx, edx
mov ecx, 0x6460e4
test edx, edx
js 0x4937f2
cmp edx, 0x100
jge 0x4937f2
cmp dword [ecx], edx
jne 0x4937f2
movsx eax, word [esi + edi + 4]
cmp dword [ecx + 8], eax
je 0x493816
add ecx, 0x4c
inc edx
cmp ecx, 0x64ace4
jl 0x4937d8
push 6
lea eax, [esp + 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.005192f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + edi + 0x20], 0x437f0000
push dword [ecx]
push ebx
call fcn.004774b0
mov byte [esp + 0x1d], 0xff
push 6
lea eax, [esp + 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.005192f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 6
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.005192f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49d8f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov edx, dword [ebp + 0xc]
sub esp, 0xf4
push ebx
mov ebx, ecx
push esi
push edi
cmp edx, 0xc
jl 0x49dac4
cmp edx, 0xec
jge 0x49dac4
mov eax, dword [ebp + 8]
imul ecx, edx, 0x10c
mov eax, dword [eax*4 + 0x20a514c]
mov eax, dword [eax + 0x390]
movsx edi, word [eax + ecx + 4]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edi
push eax
lea ecx, [ebx + 4]
call fcn.00405650
mov esi, dword [esp + 0x1c]
cmp byte [esi + 0xd], 0
jne 0x49dac4
cmp edi, dword [esi + 0x10]
jl 0x49dac4
cmp esi, dword [ebx + 4]
je 0x49dac4
add esi, 0x14
lea edi, [esp + 0x20]
mov ecx, 0x38
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
mov esi, 8
lea eax, [ecx - 0xc]
cdq
idiv esi
mov esi, dword [esp + 0x2c]
mov ebx, edx
mov edx, eax
cmp ecx, 0x4c
jge 0x49d9bc
lea ecx, [esi + ebx]
cmp ecx, 8
jg 0x49dac4
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
lea eax, [edi + edx]
cmp eax, 8
jle 0x49da79
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esi + ebx]
cmp ecx, 0x6c
jge 0x49d9ea
cmp eax, 8
jg 0x49dac4
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
lea eax, [edi + edx]
cmp eax, 0xc
jle 0x49da79
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, 0x8c
jge 0x49da14
cmp eax, 8
jg 0x49dac4
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
lea eax, [edi + edx]
cmp eax, 0x10
jle 0x49da79
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, 0xac
jge 0x49da3e
cmp eax, 8
jg 0x49dac4
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
lea eax, [edi + edx]
cmp eax, 0x14
jle 0x49da79
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, 0xcc
jge 0x49da64
cmp eax, 8
jg 0x49dac4
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
lea eax, [edi + edx]
cmp eax, 0x18
jle 0x49da79
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 8
jg 0x49dac4
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
lea eax, [edi + edx]
cmp eax, 0x1c
jg 0x49dac4
test edi, edi
jle 0x49dac4
shl edx, 3
mov dword [esp + 0x10], edx
xor eax, eax
test esi, esi
jle 0x49dab4
mov edi, dword [ebp + 8]
nop dword [eax]
mov ecx, dword [edi*4 + 0x20a514c]
mov ecx, dword [ecx + 0x39c]
add ecx, edx
mov dl, byte [ebp + 0x10]
add ecx, eax
inc eax
mov byte [ecx + ebx], dl
mov edx, dword [esp + 0x10]
cmp eax, esi
jl 0x49da90
mov edi, dword [esp + 0xc]
add edx, 8
sub edi, 1
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
jne 0x49da84
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49dad0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push ebx
push esi
push edi
lea ebx, [eax + 0xc]
add eax, edx
lea edi, [ecx*8]
add ebx, edi
cmp ebx, 0xc
jl 0x49db0d
cmp ebx, 0x4c
jge 0x49db0d
cmp eax, 8
jg 0x49db04
add ecx, dword [ebp + 0x18]
cmp ecx, 8
jle 0x49db10
pop edi
pop esi
or al, 0xff
pop ebx
pop ebp
ret 0x14
add ecx, dword [ebp + 0x18]
cmp ebx, 0x4c
jl 0x49db24
cmp ebx, 0x6c
jge 0x49db29
cmp eax, 8
jg 0x49db04
cmp ecx, 0xc
jg 0x49db04
cmp ebx, 0x6c
jl 0x49db3b
cmp ebx, 0x8c
jge 0x49db43
cmp eax, 8
jg 0x49db04
cmp ecx, 0x10
jg 0x49db04
cmp ebx, 0x8c
jl 0x49db55
cmp ebx, 0xac
jge 0x49db5d
cmp eax, 8
jg 0x49db04
cmp ecx, 0x14
jg 0x49db04
cmp ebx, 0xac
jl 0x49db6f
cmp ebx, 0xcc
jge 0x49db77
cmp eax, 8
jg 0x49db04
cmp ecx, 0x18
jg 0x49db04
cmp ebx, 0xcc
jl 0x49db8d
cmp ebx, 0xec
jge 0x49db8d
cmp eax, 8
jg 0x49db04
cmp ecx, 0x1c
jg 0x49db04
mov eax, dword [ebp + 0x18]
xor esi, esi
test eax, eax
jle 0x49dbcb
xor ecx, ecx
test edx, edx
jle 0x49dbc3
mov eax, dword [ebp + 8]
mov eax, dword [eax*4 + 0x20a514c]
mov eax, dword [eax + 0x39c]
add eax, edi
add eax, dword [ebp + 0xc]
cmp byte [eax], 0xff
jne 0x49db04
inc ecx
inc eax
cmp ecx, edx
jl 0x49dbb1
mov eax, dword [ebp + 0x18]
inc esi
add edi, 8
cmp esi, eax
jl 0x49db96
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 0x14
Function at 0x49fc20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov dl, byte [ebp + 0xc]
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dl, 0x20
jae 0x49fe17
mov cl, byte [ebp + 0x10]
cmp cl, 0xcc
jae 0x49fe17
cmp cl, 0x4c
jb 0x49fc73
cmp cl, 0x6c
jae 0x49fc73
cmp dword [ebx + 0x634], 1
lea eax, [ebx + 0x634]
jl 0x49fe17
cmp cl, 0x8c
jb 0x49fc92
cmp cl, 0xac
jae 0x49fc97
cmp dword [eax], 3
jmp 0x49fc9a
lea eax, [ebx + 0x634]
cmp cl, 0x6c
jb 0x49fc64
cmp cl, 0x8c
jae 0x49fc69
cmp dword [eax], 2
jl 0x49fe17
lea eax, [ebx + 0x634]
cmp cl, 0xac
jb 0x49fca0
cmp dword [eax], 4
jl 0x49fe17
movzx eax, dl
mov ecx, ebx
mov edx, dword [ebx + 0x3a8]
imul esi, eax, 0x10c
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], esi
mov edx, dword [edx + esi]
call fcn.00523910
test al, al
je 0x49fe17
mov edx, dword [ebx + 0x3a8]
mov ecx, ebx
mov edx, dword [edx + esi]
call fcn.005239f0
test al, al
je 0x49fe17
movzx edi, byte [ebp + 0x10]
mov eax, dword [ebx + 0x3a8]
add esi, eax
push edi
push esi
push ebx
mov dword [esp + 0x20], edi
call fcn.0049d0f0
test al, al
je 0x49fe17
push edi
sub esp, 0x10c
mov ecx, 0x43
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push dword [ebx]
call fcn.0049dce0
cmp al, 0xff
je 0x49fe17
mov esi, dword [ebx]
push 0xff
push dword [esp + 0x10]
push esi
call fcn.0049e5e0
mov eax, dword [esi*4 + 0x20a514c]
mov ecx, dword [eax + 0x3a8]
add ecx, dword [esp + 0x10]
call fcn.00493c10
movzx eax, word [ebx + 0x2b0]
mov ecx, eax
test ax, ax
js 0x49fe00
mov eax, 0x1194
cmp cx, ax
jge 0x49fe00
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [ebx + 0x3b4], 0
call esi
mov dword [ebx + 0x70c], eax
lea eax, [esp + 0xc]
push 4
push eax
push dword [ebx]
mov dword [esp + 0x18], 0x3c04c1
call fcn.005192f0
movsx eax, word [ebx + 0x2b0]
mov eax, dword [eax*4 + 0x20a514c]
mov byte [eax + 0x3b4], 0
call esi
movsx ecx, word [ebx + 0x2b0]
push 4
mov dword [esp + 0x10], 0x23c04c1
mov ecx, dword [ecx*4 + 0x20a514c]
mov dword [ecx + 0x70c], eax
lea eax, [esp + 0x10]
push eax
movsx eax, word [ebx + 0x2b0]
push eax
call fcn.005192f0
mov al, byte [ebp + 0xc]
mov byte [esp + 0xf], al
lea eax, [esp + 0xc]
push 4
push eax
movsx eax, word [ebx + 0x2b0]
push eax
mov word [esp + 0x18], 0x4c1
mov byte [esp + 0x1a], 0x38
call fcn.005192f0
push dword [esp + 0x14]
push dword [ebx]
call fcn.0049f3c0
mov al, byte [ebp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
or al, 0xff
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a57f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi*4 + 0x20a514c]
test edi, edi
js 0x4a59ac
cmp edi, 0x1194
jge 0x4a59ac
cmp dword [esi + 4], 3
jne 0x4a59ac
movzx eax, word [esi + 0x78]
cmp eax, 1
je 0x4a5836
cmp eax, 6
jne 0x4a59ac
cmp byte [esi + 0xa], 0
jg 0x4a59ac
cmp byte [esi + 0x9c0], 0
jne 0x4a59ac
mov ebx, dword [ebp + 8]
mov dl, byte [ebx + 3]
cmp dl, 0xff
je 0x4a5890
movzx eax, dl
imul ecx, eax, 0x10c
mov eax, dword [esi + 0x390]
movzx eax, word [ecx + eax + 4]
mov ecx, 0x1a04
cmp ax, cx
je 0x4a5890
mov ecx, 0x1a05
cmp ax, cx
je 0x4a5890
mov eax, dword [esi + 0x384]
and al, 3
cmp al, 1
je 0x4a59ac
mov al, byte [ebx + 4]
mov word [esp + 0x18], 0x8c1
mov byte [esp + 0x1a], 0x34
mov dword [esp + 0x1c], 0
cmp al, 1
jne 0x4a58cb
cmp word [esi + 0xd0], 0x32
jge 0x4a58cb
push 8
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.005192f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dl, 0xff
jne 0x4a5968
push esi
call fcn.0049cfd0
xor ebx, ebx
mov dword [esp + 0x14], eax
test eax, eax
jle 0x4a59a1
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop
mov edx, dword [esi + 0x390]
add edx, ecx
movzx eax, word [edx + 4]
mov edi, eax
mov dword [esp + 0x10], edi
mov edi, dword [ebp + 0xc]
test ax, ax
js 0x4a5943
mov eax, 0x2000
cmp word [esp + 0x10], ax
jge 0x4a5943
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 4]
push eax
push ebx
push edx
push esi
call fcn.0049f740
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4a593f
movzx eax, byte [esp + 0x19]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.005192f0
mov ecx, dword [esp + 0xc]
inc ebx
add ecx, 0x10c
mov dword [esp + 0xc], ecx
cmp ebx, dword [esp + 0x14]
jl 0x4a58f0
push edi
mov ecx, 0x6509a4
call fcn.004d9990
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dl, 0xcc
jae 0x4a58b5
movzx eax, al
push eax
movzx ecx, dl
imul eax, ecx, 0x10c
push ecx
add eax, dword [esi + 0x390]
push eax
push esi
call fcn.0049f740
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4a59ac
push 8
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.005192f0
push edi
mov ecx, 0x6509a4
call fcn.004d9990
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4a6390
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov al, byte [ebp + 0xc]
sub esp, 0x1c
push ebx
push esi
push edi
cmp al, 0x20
jae 0x4a65a2
cmp byte [ebp + 0x10], 0x10
jae 0x4a65a2
mov ebx, dword [ebp + 8]
mov ecx, ebx
movzx eax, al
imul esi, eax, 0x10c
mov dword [esp + 0x10], eax
mov edx, dword [ebx + 0x3a8]
mov dword [esp + 0x14], esi
mov edx, dword [esi + edx]
call fcn.00523910
test al, al
je 0x4a65a2
mov edx, dword [ebx + 0x3a8]
mov ecx, ebx
mov edx, dword [edx + esi]
call fcn.005239f0
test al, al
je 0x4a65a2
mov eax, dword [ebp + 0x10]
movzx edi, al
mov eax, dword [ebx + 0x3a8]
add esi, eax
push edi
push esi
push ebx
mov dword [esp + 0x24], edi
call fcn.004a5b70
test al, al
je 0x4a65a2
push edi
sub esp, 0x10c
mov ecx, 0x43
mov edi, esp
rep movsd dword es:[edi], dword [esi]
push dword [ebx]
call fcn.004cd140
cmp al, 0xff
je 0x4a65a2
mov esi, dword [ebx]
push 0xff
push dword [esp + 0x14]
push esi
call fcn.0049e5e0
mov eax, dword [esi*4 + 0x20a514c]
mov ecx, dword [eax + 0x3a8]
add ecx, dword [esp + 0x14]
call fcn.00493c10
movzx eax, word [ebx + 0x2b0]
mov ecx, eax
test ax, ax
js 0x4a6516
mov eax, 0x1194
cmp cx, ax
jge 0x4a6516
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [ebx + 0x3b4], 0
call esi
mov dword [ebx + 0x70c], eax
lea eax, [esp + 0x10]
push 4
push eax
push dword [ebx]
mov dword [esp + 0x1c], 0x3c04c1
call fcn.005192f0
movsx eax, word [ebx + 0x2b0]
mov eax, dword [eax*4 + 0x20a514c]
mov byte [eax + 0x3b4], 0
call esi
movsx ecx, word [ebx + 0x2b0]
push 4
mov dword [esp + 0x14], 0x23c04c1
mov ecx, dword [ecx*4 + 0x20a514c]
mov dword [ecx + 0x70c], eax
lea eax, [esp + 0x14]
push eax
movsx eax, word [ebx + 0x2b0]
push eax
call fcn.005192f0
mov al, byte [ebp + 0xc]
mov byte [esp + 0x13], al
lea eax, [esp + 0x10]
push 4
push eax
movsx eax, word [ebx + 0x2b0]
push eax
mov word [esp + 0x1c], 0x4c1
mov byte [esp + 0x1e], 0x38
call fcn.005192f0
mov esi, dword [esp + 0x18]
cmp esi, 0x10
jae 0x4a657e
mov eax, dword [ebx]
imul ecx, esi, 0x10c
mov eax, dword [eax*4 + 0x20a514c]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 0x11bc]
movsx edi, word [eax + ecx + 4]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], edi
push eax
mov ecx, 0x9ed0c4
call fcn.00405650
mov eax, dword [esp + 0x24]
mov ecx, dword [0x9ed0c4]
cmp byte [eax + 0xd], 0
jne 0x4a656a
cmp edi, dword [eax + 0x10]
jge 0x4a656c
mov eax, ecx
cmp eax, ecx
je 0x4a657e
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x11c8]
mov byte [esi + eax], 1
push dword [ebp + 0x10]
push dword [ebx]
call fcn.004cd090
cmp byte [ebp + 0x10], 8
jae 0x4a6596
push esi
push dword [ebx]
call fcn.0049f3c0
mov al, byte [ebp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
or al, 0xff
pop ebx
mov esp, ebp
pop ebp
ret 0x10