joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44afdc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xdc
push ebx
mov ebx, dword [esp + 0xe4]
push esi
push edi
mov edi, dword [esp + 0xf0]
lea eax, [esp + 0x10]
push eax
call fcn.004431e0
mov ecx, dword [esp + 0xf4]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0044313a
xor esi, esi
test edi, edi
jbe 0x44b02e
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call fcn.004431b2
xor byte [esi + ebx], al
inc esi
cmp esi, edi
jb 0x44b01c
pop edi
pop esi
pop ebx
add esp, 0xdc
ret 0xc

Function at 0x44b2e9
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
sub dword [0x49223c], 1
jne 0x44b2f8
call fcn.00443390
mov ecx, dword [0x4a72e4]
mov eax, dword [ecx]
add ecx, 4
mov dword [0x4a72e4], ecx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
fild dword [esp]
test edx, edx
jge 0x44b341
fadd qword [0x48c528]
fmul qword [0x48c530]
pop ecx
ret

Function at 0x44b64f
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x30], 0
lea esi, [edi + 0x30]
je 0x44b6b7
mov eax, dword [edi + 0x34]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ebx, [edi + 0x34]
push eax
push ebx
call ebp
cmp eax, 0x1f6
je 0x44b6b5
add edi, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi]
push 0x1f6
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call int.004356cd
add esp, 4
push 0x1f6
push ebx
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop ebx
pop edi
pop esi
ret 4

Function at 0x44b7ca
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x20], 0
jne 0x44b7f4
push esi
call int.0043572f
test al, al
je 0x44b7f4
mov eax, dword [esi + 8]
push eax
call fcn.004437fa
add esp, 4
push eax
mov dword [esi + 0x20], eax
call fcn.0044b6bc
cmp dword [esi + 0x24], 0
jne 0x44b827
push esi
call fcn.00435713
test al, al
je 0x44b827
push esi
call int.00435703
test al, al
jne 0x44b827
mov ecx, dword [esi + 0x10]
push ecx
call fcn.004437fa
add esp, 4
mov dword [esi + 0x24], eax
pop esi
mov dword [esp + 4], eax
jmp fcn.0044b6bc
pop esi
ret 4
Function at 0x44bb20
Capabilities:
Delete directory
Delete file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x22c
lea eax, [esp + 0x20]
call fcn.0040ffb0
lea eax, [esp + 0x20]
push eax
call fcn.00436ac4
add esp, 4
test al, al
jne 0x44bb4b
add esp, 0x22c
ret
push ebx
xor ebx, ebx
cmp byte [esp + 0x238], bl
jne 0x44bb6f
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
pop ebx
add esp, 0x22c
ret
lea edx, [esp + 0x24]
push edx
call fcn.004112d5
xor ecx, ecx
mov word [esp + eax*2 + 0x2a], cx
add esp, 4
lea ecx, [esp + 4]
lea edx, [esp + 0x24]
mov eax, 0x614
push ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 3
mov word [esp + 0x18], ax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x22c
ret

Function at 0x44bbc9
Capabilities:
Copy file
Move file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x438
push ebx
mov bl, byte [esp + 0x448]
lea eax, [esp + 0x230]
call fcn.0040ffb0
mov ecx, dword [esp + 0x444]
lea eax, [esp + 0x24]
call fcn.0040ffb0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x44bc48
test bl, bl
je 0x44bc71
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x234]
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x44bc3e
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
pop ebx
add esp, 0x438
ret
lea eax, [esp + 0x230]
push eax
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bc71
lea ecx, [esp + 0x24]
push ecx
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bc7b
test bl, bl
jne 0x44bc9d
xor al, al
pop ebx
add esp, 0x438
ret
lea edx, [esp + 0x24]
push edx
call fcn.004366be
add esp, 4
test al, al
je 0x44bc71
lea eax, [esp + 0x24]
push eax
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bc71
lea ecx, [esp + 0x230]
push 0x487240
push ecx
call fcn.00411663
lea edx, [esp + 0x238]
push edx
call fcn.004112d5
lea edx, [esp + 0x30]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x242], cx
call fcn.004112d5
xor ecx, ecx
mov word [esp + eax*2 + 0x36], cx
lea edx, [esp + 0x240]
lea eax, [esp + 0x34]
mov dword [esp + 0x1c], edx
add esp, 0x10
mov dword [esp + 0x10], eax
xor eax, eax
lea edx, [esp + 4]
mov ecx, 0x614
push edx
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0x438
ret
Function at 0x44bd29
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10b4
call fcn.00425210
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea eax, [esp + 0x438]
xor bl, bl
call fcn.0040ffb0
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x648]
call fcn.0040ffb0
lea eax, [esp + 0x648]
push eax
lea ecx, [esp + 0x43c]
push ecx
call int.00436a1d
lea edx, [esp + 0x440]
push edx
mov byte [esp + 0x1b], al
call fcn.00436ac4
add esp, 0xc
test al, al
je 0x44bd9e
lea eax, [esp + 0x438]
push 0x487240
push eax
call fcn.00411663
add esp, 8
lea ecx, [esp + 0x648]
push ecx
call fcn.00436ac4
add esp, 4
test al, al
je 0x44bdc7
lea edx, [esp + 0x648]
push 0x487240
push edx
call fcn.00411663
add esp, 8
lea eax, [esp + 0xcb0]
push eax
lea ecx, [esp + 0xebc]
push ecx
lea edx, [esp + 0xab0]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x448]
push ecx
call fcn.00413db0
add esp, 0x14
lea edx, [esp + 0x858]
push edx
lea eax, [esp + 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov byte [esp + 0xe], 1
cmp esi, 0xffffffff
je 0x44bf7d
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp byte [esp + 0xe], 1
jne 0x44bf7d
test byte [esp + 0x858], 0x10
jne 0x44bf5d
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x64c]
push edx
lea eax, [esp + 0xcb8]
push eax
lea ecx, [esp + 0xec4]
push ecx
lea edx, [esp + 0x894]
push edx
call fcn.00436879
add esp, 0x14
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00411691
lea edx, [esp + 0xab0]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00411663
lea ecx, [esp + 0x894]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00411663
lea eax, [esp + 0x240]
push eax
call fcn.00436b22
add esp, 0x1c
test al, al
je 0x44bedb
cmp byte [ebp + 0x10], 0
je 0x44bf34
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x44bf44
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp + 0x14], 1
jne 0x44bf1f
cmp byte [esp + 0xf], 0
jne 0x44befd
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x44bf30
push 0
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
je 0x44bf34
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x44bf30
push 0
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x20]
push ecx
call edi
test eax, eax
jne 0x44bf5b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x44bf34
mov bl, 1
lea ecx, [esp + 0x858]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44be20
mov byte [esp + 0xe], al
jmp 0x44be20
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4523ce
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
mov esi, dword [esp + 0x440]
push edi
xor ebp, ebp
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004151b0
add esp, 0x10
push 0x7ca302cc
push 4
lea edx, [esp + 0x1c]
push edx
call fcn.0044afdc
lea eax, [esp + 0x14]
push 0x487704
push eax
mov byte [esp + 0x20], 0
call fcn.004151d0
add esp, 8
test eax, eax
jne 0x452562
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
inc ebp
call fcn.004151b0
mov edi, dword [esp + 0x20]
mov eax, dword [esi]
push eax
xor edi, 0xca4eb60
lea ebx, [edi + edi]
push ebx
lea ecx, [esp + 0x38]
push 1
push ecx
call fcn.004151b0
add esp, 0x20
add edi, 0x2d8c5e49
push edi
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0044afdc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x234]
xor eax, eax
push edx
mov word [esp + ebx + 0x28], ax
call fcn.00411691
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push 4
push ecx
call fcn.004151b0
mov edi, dword [esp + 0x28]
mov edx, dword [esi]
push edx
xor edi, 0x882bec0c
lea ebx, [edi + edi]
push ebx
lea eax, [esp + 0x40]
push 1
push eax
call fcn.004151b0
add esp, 0x28
add edi, 0x758a03bd
push edi
push ebx
lea ecx, [esp + 0x28]
push ecx
call fcn.0044afdc
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x20]
push eax
xor edx, edx
push ecx
mov word [esp + ebx + 0x28], dx
call fcn.00411691
mov edi, dword [esp + 0x450]
lea edx, [esp + 0x238]
push edi
push edx
call fcn.004133e4
add esp, 0x10
test eax, eax
je 0x452553
push 0x4876f8
push edi
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x452510
test ebp, ebp
je 0x452553
mov eax, dword [esi]
push 1
push 1
push eax
call fcn.0041557c
mov ecx, dword [esi]
add esp, 0xc
push ecx
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004151b0
mov eax, dword [esp + 0x2c]
xor eax, 0x87bc
mov dword [esp + 0x2c], eax
add eax, 0x18
push 1
push eax
mov eax, dword [esi]
push eax
call fcn.0041557c
add esp, 0x1c
jmp 0x4523e1
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 0x430
ret 0xc
Function at 0x4534eb
Capabilities:
Move file

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xa54
lea eax, [esp + 0x234]
call fcn.0040ffb0
mov ecx, dword [esp + 0xa5c]
lea eax, [esp + 0x28]
call fcn.0040ffb0
lea eax, [esp + 0x234]
push eax
call fcn.00436ac4
add esp, 4
test al, al
jne 0x45352c
add esp, 0xa54
ret
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.00436ac4
add esp, 4
xor ebx, ebx
test al, al
je 0x453618
cmp byte [esp + 0xa64], bl
je 0x453679
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4535ab
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x23c]
push edx
call fcn.004133e4
add esp, 8
test eax, eax
je 0x4535a1
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
pop ebx
add esp, 0xa54
ret
mov al, 1
pop ebx
add esp, 0xa54
ret
lea edx, [esp + 0x444]
push edx
lea eax, [esp + 0x64c]
push eax
lea ecx, [esp + 0x854]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x248]
push eax
call fcn.00413db0
lea ecx, [esp + 0x40]
push 0x484e10
push ecx
call fcn.00411663
lea edx, [esp + 0x664]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.00411663
add esp, 0x24
cmp word [esp + 0x444], bx
je 0x453618
lea ecx, [esp + 0x444]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00411663
add esp, 8
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x23c]
push ecx
call int.00436a1d
add esp, 8
test al, al
lea edx, [esp + 0x2c]
lea eax, [esp + 0x238]
je 0x45366b
push 1
push edx
push eax
call fcn.0044bbc9
add esp, 0xc
test al, al
je 0x453679
lea ecx, [esp + 0x238]
push 1
push ecx
call fcn.0044bb20
add esp, 8
test al, al
setne al
pop ebx
add esp, 0xa54
ret
push edx
push eax
call fcn.004133e4
add esp, 8
test eax, eax
jne 0x453683
xor al, al
pop ebx
add esp, 0xa54
ret
lea ecx, [esp + 0x238]
push ecx
call fcn.004112d5
xor edx, edx
mov word [esp + eax*2 + 0x23e], dx
lea eax, [esp + 0x30]
push eax
call fcn.004112d5
xor ecx, ecx
lea edx, [esp + 0x240]
mov word [esp + eax*2 + 0x36], cx
mov dword [esp + 0x14], edx
add esp, 8
lea edx, [esp + 4]
lea eax, [esp + 0x2c]
mov ecx, 0x614
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1e], ebx
mov dword [esp + 0x22], ebx
mov dword [esp + 0x1a], ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 1
mov word [esp + 0x18], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
pop ebx
add esp, 0xa54
ret
Function at 0x467e5e
Capabilities:
Print debug messages
Write file on windows

Disassembly:
sub esp, 0x18
mov al, byte [0x49728f]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, dword [esp + 0x2c]
push 0x8000
push edi
mov byte [esp + 0x18], al
call fcn.0041453a
add esp, 4
push eax
call fcn.00414443
add esp, 8
mov esi, eax
push ebp
mov dword [esp + 0x18], esi
call fcn.00444279
test al, al
je 0x467ebd
push edi
push ebp
call int.00443676
push eax
push 1
push ebp
call fcn.004676a3
push eax
call fcn.004146ce
add esp, 0x10
mov ebx, eax
jmp 0x467f09
push esi
jmp 0x467f1c
lea esi, [esp + 0x18]
call fcn.0040d500
push ebp
call fcn.00453063
push esi
push eax
call fcn.0045efe7
mov edx, dword [esp + 0x18]
push edx
push 0x4873d8
push edi
call fcn.00414750
add esp, 0xc
cmp byte [esp + 0x10], 0
mov ebx, eax
je 0x467efc
push ebp
call fcn.00453081
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea esi, [esp + 0x18]
call fcn.00401330
mov esi, dword [esp + 0x14]
push edi
call fcn.004149f6
add esp, 4
cmp esi, 0xffffffff
jne 0x467eba
push 0x4000
push edi
call fcn.0041453a
add esp, 4
push eax
call fcn.00414443
add esp, 8
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x18
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x7217300c
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x8223964
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x67dd76c3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x50650302
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x413300
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x610
push ebx
push ebp
push esi
push edi
mov ecx, 6
mov esi, str.MAPSFREEPLAYFREEPLAY.BAL
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 1
movsb byte es:[edi], byte [esi]
call fcn.0043d050
push 2
lea eax, [esp + 0x1c]
push 0
push eax
lea edi, [esp + 0x124]
call fcn.00472860
mov esi, dword [esp + 0x124]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x10
test eax, eax
je 0x41335e
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x6c
push 0x14c9440
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
mov eax, dword [0x4d2234]
sub eax, 0
je 0x4133b3
sub eax, 2
je 0x41339f
dec eax
je 0x41338d
mov ecx, 5
mov esi, str.MAPSFREEPLAYCITY.BAL
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4133c3
mov ecx, 6
mov esi, str.MAPSFREEPLAYCHINA.BAL
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
jmp 0x4133c4
mov ecx, 5
mov esi, str.MAPSFREEPLAYMALL.BAL
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4133c3
mov ecx, 6
mov esi, str.MAPSFREEPLAYSUBURB.BAL
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 1
call fcn.0043d050
push 2
lea edx, [esp + 0x1c]
push 0
push edx
lea edi, [esp + 0x124]
call fcn.00472860
mov esi, dword [esp + 0x124]
add esp, 0x10
test eax, eax
je 0x413527
push 0
lea eax, [esp + 0x14]
push eax
push 0x18
push 0x14c9914
push esi
call ebx
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
push 0x14c9910
push esi
call ebx
mov eax, dword [0x14c9910]
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [eax*4]
push ecx
push 0x14c992c
push esi
call ebx
mov eax, dword [0x14c9910]
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [eax*4]
push ecx
push 0x14c997c
push esi
call ebx
push 0
lea edx, [esp + 0x14]
push edx
push 4
push 0x14c99cc
push esi
call ebx
mov ecx, dword [0x14c9910]
push 0
lea eax, [esp + 0x14]
push eax
lea edx, [ecx*4]
push edx
push 0x14c99d0
push esi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 4
push 0x14c9a20
push esi
call ebx
mov edx, dword [0x14c9910]
push 0
lea ecx, [esp + 0x14]
push ecx
lea eax, [edx*4]
push eax
push 0x14c9a24
push esi
call ebx
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
push 0x14c9a74
push esi
call ebx
mov eax, dword [0x14c9910]
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [eax*4]
push ecx
push 0x14c9a78
push esi
call ebx
push 0
mov eax, dword [0x14c9910]
lea edx, [esp + 0x14]
push edx
lea ecx, [eax*4]
push ecx
push 0x14c9b90
push esi
call ebx
mov eax, dword [0x14c9910]
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [eax*4]
push ecx
push 0x14c9ac8
push esi
call ebx
mov eax, dword [0x14c9910]
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [eax + eax*2]
shl eax, 1
push eax
push 0x14c9b18
push esi
call ebx
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x610
jmp fcn.00412d80
Function at 0x416af0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
mov ebp, dword [0x4d64a4]
push esi
push edi
xor esi, esi
lea esp, [esp]
mov eax, dword [0x14cc4b0]
mov edx, dword [eax + 0x50]
add edx, esi
cmp word [edx + 0xc8], 0xffff
jne 0x416b6b
mov bl, byte [edx + 0xd0]
movzx ecx, bl
shl ecx, 6
test byte [ecx + ebp + 1], 0x10
jne 0x416b4e
mov al, bl
call fcn.0041c670
movzx ecx, al
shl ecx, 6
test byte [ecx + ebp + 1], 0x10
jne 0x416b4e
cmp bl, 0xcc
je 0x416b4e
cmp al, 0xcc
je 0x416b4e
cmp bl, 0xd6
je 0x416b4e
cmp al, 0xd6
jne 0x416b6b
mov eax, dword [edx + 0xa8]
and eax, 0xffeffffe
or eax, 8
push edx
mov dword [edx + 0xa8], eax
call fcn.0040f460
add esp, 4
add esi, 0xd4
cmp esi, 0xa5a0
jb 0x416b00
mov ebx, dword [0x14cc4b0]
mov eax, dword [ebx + 0xc]
xor edi, edi
test eax, eax
jbe 0x416bf1
xor esi, esi
lea ebx, [ebx]
mov edx, dword [ebx + 0x30]
add edx, esi
cmp word [edx + 0xc8], 0xffff
jne 0x416be3
mov al, byte [edx + 0xd0]
movzx ecx, al
shl ecx, 6
test byte [ecx + ebp + 1], 0x10
jne 0x416bc5
call fcn.0041c670
movzx eax, al
shl eax, 6
test byte [eax + ebp + 1], 0x10
je 0x416be3
mov ecx, dword [edx + 0xa8]
and ecx, 0xffeffffe
or ecx, 8
push edx
mov dword [edx + 0xa8], ecx
call fcn.0040f460
add esp, 4
mov eax, dword [ebx + 0xc]
inc edi
add esi, 0xd4
cmp edi, eax
jb 0x416b90
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41c970
Capabilities:
Read file on windows

Disassembly:
lea edx, [esp - 0x60c]
sub esp, 0x61c
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41c980
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c991
push esi
push edi
sub eax, edx
push 1
mov dword [esp + eax + 0x19], 0x54454e
call fcn.0043d050
push 2
xor esi, esi
lea eax, [esp + 0x20]
push esi
push eax
lea edi, [esp + 0x128]
call fcn.00472860
add esp, 0x10
test eax, eax
jne 0x41c9d7
pop edi
mov dword [0x14c783c], esi
pop esi
add esp, 0x61c
ret
mov edi, dword [esp + 0x118]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [esp + 0x18]
push ecx
push 4
push 0x14c783c
push edi
call ebp
mov eax, dword [0x14c783c]
lea eax, [eax + eax*4]
shl eax, 2
mov edx, 0x12985f4
call fcn.00474ce0
mov ecx, dword [0x14c783c]
xor ebx, ebx
cmp ecx, esi
mov dword [0x14cc4c8], eax
jbe 0x41ca94
lea esp, [esp]
push 0
lea edx, [esp + 0x18]
push edx
push 4
add eax, esi
push eax
push edi
call ebp
mov eax, dword [0x14cc4c8]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esi + eax + 8]
push edx
push edi
mov dword [esi + eax + 4], 0
call ebp
push 0
lea eax, [esp + 0x20]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push edi
call ebp
mov eax, dword [0x14cc4c8]
mov dl, byte [esp + 0x10]
mov byte [esi + eax + 0x12], dl
fld dword [esi + eax]
fadd dword [0x4c49d4]
inc ebx
add esi, 0x14
fstp dword [esi + eax - 0x14]
fld dword [esi + eax - 0xc]
fadd dword [0x4c49d4]
fstp dword [esi + eax - 0xc]
mov ecx, dword [0x14c783c]
cmp ebx, ecx
jb 0x41ca20
shl ecx, 4
mov eax, ecx
mov edx, 0x12985f4
call fcn.00474ce0
mov dword [0x14cc4c4], eax
mov eax, dword [0x14c783c]
shl eax, 4
mov edx, 0x12985f4
call fcn.00474ce0
push edi
mov dword [0x14cc4c0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x61c
ret