joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489bd4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xec
mov esi, dword [ebp + 0xc]
cmp esi, 1
ja 0x489c20
test esi, esi
jne 0x489bf3
mov edx, 0x7d544a
jmp 0x489bf8
mov edx, 0x7d5552
mov edi, edx
mov al, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0070342c
mov bl, 1
jmp 0x489d6e
call fcn.0043f37c
mov ebx, eax
lea eax, [ebp - 0xe4]
mov dword [esp], eax
call fcn.0066643c
mov dword [esp + 4], str.SELECT__name__FROM__accounts__WHERE__id__
lea eax, [ebp - 0xdc]
mov dword [esp], eax
call fcn.0076107c
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00701d98
mov dword [esp + 4], 0x7d5546
mov dword [esp], eax
call fcn.0076107c
mov eax, dword [ebx]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x28]
lea edx, [ebp - 0xd8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.006de294
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call esi
mov ebx, eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.0070479c
jmp 0x489cb1
test ebx, ebx
je 0x489d60
mov eax, dword [ebx]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x7d5580
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.007041ec
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x20]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
sub esp, 4
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.00703510
lea eax, [ebp - 0x24]
mov dword [esp], eax
call fcn.0070479c
jmp 0x489d2b
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.0070479c
jmp 0x489d3c
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x10]
jmp 0x489d5e
mov bl, 1
lea eax, [ebp - 0xe4]
mov dword [esp], eax
call fcn.006668d4
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x48b0d6
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xec
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.0074c9a4
lea edx, [ebx + 0x20]
cmp edx, eax
je 0x48b105
mov bl, 1
jmp 0x48b268
call fcn.0043f37c
mov esi, eax
lea eax, [ebp - 0xe4]
mov dword [esp], eax
call fcn.0066643c
mov edi, dword [ebp + 0xc]
mov dword [esp + 4], str.SELECT__name__FROM__players__WHERE__id__
lea eax, [ebp - 0xdc]
mov dword [esp], eax
call fcn.0076107c
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00701d98
mov dword [esp + 4], str._AND__deleted___0_LIMIT_1
mov dword [esp], eax
call fcn.0076107c
mov eax, dword [esi]
mov edi, dword [eax + 0x1c]
lea eax, [ebp - 0x28]
lea edx, [ebp - 0xd8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.006de294
sub esp, 4
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], esi
call edi
mov esi, eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.0070479c
jmp 0x48b199
test esi, esi
jne 0x48b1a4
mov bl, 0
jmp 0x48b25a
mov eax, dword [esi]
mov edi, dword [eax + 8]
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x7d5580
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.007041ec
lea eax, [ebp - 0x24]
lea edx, [ebp - 0x20]
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call edi
sub esp, 4
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
add ebx, 0x1c
mov dword [esp], ebx
call fcn.00722fdc
lea edx, [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00703510
lea eax, [ebp - 0x24]
mov dword [esp], eax
call fcn.0070479c
jmp 0x48b225
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.0070479c
jmp 0x48b236
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0x10]
jmp 0x48b258
mov bl, 1
lea eax, [ebp - 0xe4]
mov dword [esp], eax
call fcn.006668d4
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x48b57a
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0x10]
mov byte [ebp - 0xfc], al
cmp byte [ebp + 0x14], 0
je 0x48b5b8
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [esi + 0x1c]
mov dword [esp], eax
call fcn.0074c9a4
lea edx, [esi + 0x20]
cmp edx, eax
je 0x48b5b8
mov bl, 1
jmp 0x48b820
call fcn.0043f37c
mov ebx, eax
lea eax, [ebp - 0xf0]
mov dword [esp], eax
call fcn.0066643c
mov edi, dword [ebp + 0xc]
mov dword [esp + 4], str.SELECT__name__FROM__players__WHERE__id__
lea eax, [ebp - 0xe8]
mov dword [esp], eax
call fcn.0076107c
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00701d98
mov dword [esp + 4], str._AND__deleted___0
mov dword [esp], eax
call fcn.0076107c
cmp byte [ebp - 0xfc], 0
jne 0x48b643
mov dword [esp + 4], 0x35
mov dword [esp], 0x8dfd80
call fcn.0041b8da
mov edi, eax
mov dword [esp + 4], 0x7d56c0
lea eax, [ebp - 0xe8]
mov dword [esp], eax
call fcn.0076107c
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00702728
mov dword [esp + 4], 0x7d5546
lea eax, [ebp - 0xe8]
mov dword [esp], eax
call fcn.0076107c
mov eax, dword [ebx]
mov edi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
lea edx, [ebp - 0xe4]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.006de294
sub esp, 4
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
mov ebx, eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
call fcn.0070479c
jmp 0x48b6a3
test ebx, ebx
je 0x48b812
mov eax, dword [ebx]
mov edi, dword [eax + 8]
lea eax, [ebp - 0x25]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x7d5580
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.007041ec
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call edi
sub esp, 4
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.0070479c
jmp 0x48b718
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x10]
lea eax, [esi + 0x1c]
mov dword [ebp - 0xfc], eax
lea edi, [esi + 0x20]
lea eax, [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov eax, dword [esi + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call fcn.0074c700
mov ebx, eax
cmp eax, edi
je 0x48b75a
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebx + 0x10]
jae 0x48b7ca
mov dword [ebp - 0x1c], 0x7bf7b0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00704290
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call fcn.0074c844
mov ebx, eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.0070479c
jmp 0x48b7bf
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.0070479c
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
add ebx, 0x14
mov dword [esp], ebx
call fcn.00703510
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.0070479c
jmp 0x48b810
mov bl, 1
lea eax, [ebp - 0xf0]
mov dword [esp], eax
call fcn.006668d4
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x5433ac
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x28], edx
mov edx, dword [eax + 0x20]
mov dword [ebp - 0x24], edx
mov edx, dword [eax + 0x24]
mov dword [ebp - 0x20], edx
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x1c], eax
movzx esi, word [ebx + 4]
mov edi, esi
test esi, 7
je 0x5433fd
mov ecx, 8
mov eax, esi
cdq
idiv ecx
mov esi, ecx
sub esi, edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.005094ba
add esi, edi
add ebx, dword [ebx + 0x3c20]
add ebx, 8
mov dword [ebp - 0x30], ebx
test esi, esi
jns 0x543410
add esi, 3
sar esi, 2
mov dword [ebp - 0x38], esi
test esi, esi
jle 0x5434a0
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x30]
mov esi, dword [ecx + edx*4]
mov edi, dword [ecx + edx*4 + 4]
mov ebx, 0
mov eax, ebx
and eax, 3
mov edx, dword [ebp + eax*4 - 0x28]
lea eax, [ebx + edx]
mov ecx, edi
shr ecx, 5
mov edx, edi
shl edx, 4
xor edx, ecx
add edx, edi
xor eax, edx
add esi, eax
sub ebx, 0x61c88647
mov edx, esi
shr edx, 5
mov eax, esi
shl eax, 4
xor edx, eax
add edx, esi
mov eax, ebx
shr eax, 0xb
and eax, 3
mov ecx, dword [ebp + eax*4 - 0x28]
lea eax, [ebx + ecx]
xor eax, edx
add edi, eax
cmp ebx, 0xc6ef3720
jne 0x54343a
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov dword [edx + eax*4], esi
mov dword [edx + eax*4 + 4], edi
add dword [ebp - 0x2c], 2
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x38], ecx
jg 0x543425
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x56752c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 8]
cmp byte [eax + 0x30], 0
je 0x56755a
mov dword [esp + 8], 0xdf
mov dword [esp + 4], str..._server.cpp
mov dword [esp], str._running
call sub.msvcrt.dll__assert
mov dword [ebp - 0x30], 0
call fcn.00597864
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov dword [esp + 4], 0
lea eax, [ebx + 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_InterlockedExchangeAdd
sub esp, 8
test eax, eax
jne 0x567593
call fcn.00597864
jmp 0x56766c
mov dword [ebp - 0x44], ebx
mov eax, dword [0x7bf760]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x44]
mov dword [esp + 4], eax
mov eax, dword [0x7bf760]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov edi, 0
lea esi, [ebp - 0x30]
jmp 0x5675d7
cmp edi, 0xffffffff
je 0x5675d7
inc edi
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], ebx
call fcn.0063eb88
test eax, eax
jne 0x5675d1
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov eax, dword [0x7bf760]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
cmp dword [ebp - 0x30], 0
jne 0x567635
jmp 0x56766c
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.0064bb64
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.00631f7c
mov ebx, eax
mov esi, edx
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.0064be18
mov edx, esi
jmp 0x56767a
mov eax, dword [ebp + 8]
mov byte [eax + 0x30], 1
jmp 0x567750
cmp edx, 1
je 0x567687
mov dword [esp], ebx
call sub.libgcc_s_dw2_1.dll__Unwind_Resume
mov dword [esp], ebx
call fcn.00767c68
mov ebx, eax
lea eax, [ebp - 0x21]
mov dword [esp + 8], eax
mov dword [esp + 4], str.NETWORK
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.007041ec
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 8]
lea edx, [ebp - 0x19]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.007041ec
call fcn.006656b0
mov dword [esp + 0x14], 1
lea edx, [ebp - 0x28]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 3
mov dword [esp + 4], str.void_ServiceManager::run__
mov dword [esp], eax
call fcn.005838da
jmp 0x56770d
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.0070479c
jmp 0x56771e
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.0070479c
jmp 0x56773c
call fcn.00767e34
jmp 0x567750
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x5a86bc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x228]
push esi
mov esi, 0x200
push ebx
sub esp, 0x23c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], edx
mov dword [esp + 4], edi
mov dword [esp], eax
call sym.TheForgottenServer.exe_luaL_buffinit
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
call sym.TheForgottenServer.exe_luaL_prepbuffer
cmp esi, ebx
jbe 0x5a870a
mov esi, ebx
mov edx, dword [ebp - 0x230]
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 0xc], edx
mov edx, 1
mov dword [esp + 4], edx
call sub.msvcrt.dll_fread
add dword [ebp - 0x228], eax
sub ebx, eax
setne dl
cmp eax, esi
sete al
movzx eax, al
test edx, eax
jne 0x5a86fc
mov dword [esp], edi
xor esi, esi
call sym.TheForgottenServer.exe_luaL_pushresult
test ebx, ebx
jne 0x5a8760
add esp, 0x23c
mov esi, 1
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call sym.TheForgottenServer.exe_lua_objlen
test eax, eax
jne 0x5a874e
add esp, 0x23c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5aacbc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x12c
mov ebx, eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
je 0x5aae0c
mov dword [esp + 4], eax
mov edx, 0x7f0802
mov ecx, 0x7f0806
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp], ebx
call sym.TheForgottenServer.exe_luaL_gsub
mov dword [esp + 4], eax
mov edx, 0x7f0809
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp], ebx
call sym.TheForgottenServer.exe_luaL_gsub
mov dword [esp], ebx
mov eax, 0xfffffffe
mov dword [esp + 4], eax
call sym.TheForgottenServer.exe_lua_remove
mov dword [esp], 0
mov eax, 0x105
lea esi, [ebp - 0x128]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
test eax, eax
sete dl
cmp eax, 0x105
sete al
or eax, edx
test al, 1
jne 0x5aaddc
mov dword [esp], esi
mov eax, 0x5c
mov dword [esp + 4], eax
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x5aaddc
mov byte [eax], 0
xor eax, eax
mov dword [esp + 8], eax
mov eax, 0xffffffff
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym.TheForgottenServer.exe_lua_tolstring
mov dword [esp + 0xc], esi
mov esi, 0x7f080b
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym.TheForgottenServer.exe_luaL_gsub
mov dword [esp], ebx
mov ecx, 0xfffffffe
mov dword [esp + 4], ecx
call sym.TheForgottenServer.exe_lua_remove
mov dword [esp + 8], edi
mov edx, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], edx
call sym.TheForgottenServer.exe_lua_setfield
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov eax, str.unable_to_get_ModuleFileName
mov dword [esp + 4], eax
call sym.TheForgottenServer.exe_luaL_error
mov dword [esp + 8], edi
mov edx, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], edx
call sym.TheForgottenServer.exe_lua_setfield
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.TheForgottenServer.exe_lua_pushstring
jmp 0x5aad2a
Function at 0x5b5728
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesW
push ecx
cmp eax, 0xffffffff
je 0x5b576c
mov edx, dword [0x8e4d20]
mov ecx, dword [0x8e4d24]
mov dword [ebx], edx
mov dword [ebx + 4], ecx
and eax, 0x10
cmp eax, 1
sbb eax, eax
add eax, 3
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret
mov esi, dword [0x8e4cd0]
call sub.KERNEL32.dll_GetLastError
mov dword [ebx + 4], esi
mov dword [ebx], eax
cmp eax, 2
je 0x5b57ac
cmp eax, 3
je 0x5b57ac
cmp eax, 0x7b
je 0x5b57ac
cmp eax, 0xf
je 0x5b57ac
cmp eax, 0x57
je 0x5b57ac
cmp eax, 0xa1
je 0x5b57ac
cmp eax, 0x35
je 0x5b57ac
cmp eax, 0x20
je 0x5b57c3
xor eax, eax
jmp 0x5b5762
mov eax, dword [0x8e4d20]
mov edx, dword [0x8e4d24]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, 1
jmp 0x5b5762
mov eax, dword [0x8e4d20]
mov edx, dword [0x8e4d24]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, 9
jmp 0x5b5762

Function at 0x5b57dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
push esi
cmp eax, 0xffffffff
je 0x5b5820
mov edx, dword [0x8e4d20]
mov ecx, dword [0x8e4d24]
mov dword [ebx], edx
mov dword [ebx + 4], ecx
and eax, 0x10
cmp eax, 1
sbb eax, eax
add eax, 3
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret
mov esi, dword [0x8e4cd0]
call sub.KERNEL32.dll_GetLastError
mov dword [ebx + 4], esi
mov dword [ebx], eax
cmp eax, 2
je 0x5b5860
cmp eax, 3
je 0x5b5860
cmp eax, 0x7b
je 0x5b5860
cmp eax, 0xf
je 0x5b5860
cmp eax, 0x57
je 0x5b5860
cmp eax, 0xa1
je 0x5b5860
cmp eax, 0x35
je 0x5b5860
cmp eax, 0x20
je 0x5b5877
xor eax, eax
jmp 0x5b5816
mov eax, dword [0x8e4d20]
mov edx, dword [0x8e4d24]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, 1
jmp 0x5b5816
mov eax, dword [0x8e4d20]
mov edx, dword [0x8e4d24]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, 9
jmp 0x5b5816
Function at 0x5b6c68
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28c
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea ebx, [ebp - 0x20]
mov dword [esp], ebx
call fcn.006fd838
mov eax, dword [ebp - 0x20]
lea edx, [eax - 0xc]
mov esi, dword [eax - 0xc]
test esi, esi
je 0x5b6cb4
mov edx, dword [edx + 8]
test edx, edx
js 0x5b6ca8
mov dword [esp], ebx
call fcn.006fbc10
mov eax, dword [ebp - 0x20]
cmp word [eax + esi*2 - 2], 0x5c
je 0x5b6d68
mov esi, 0x7f2a08
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.006fc57c
lea eax, [ebp - 0x270]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileW
sub esp, 8
mov dword [edi], eax
inc eax
je 0x5b6d74
lea esi, [ebp - 0x244]
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.006fc8ec
test byte [ebp - 0x270], 0x10
jne 0x5b6d54
mov eax, dword [ebp + 0x14]
mov dword [eax], 2
mov eax, dword [ebp + 0x18]
mov dword [eax], 2
mov esi, dword [0x8e4d24]
mov ebx, dword [0x8e4d20]
mov eax, dword [ebp - 0x20]
lea edi, [eax - 0xc]
cmp edi, 0x7bf794
jne 0x5b6d98
mov eax, ebx
mov edx, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp + 0x14]
mov dword [eax], 3
mov eax, dword [ebp + 0x18]
mov dword [eax], 3
jmp 0x5b6d2e
mov esi, 0x7f2a04
jmp 0x5b6cb9
mov dword [edi], 0
mov esi, dword [0x8e4cd0]
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x5b6d94
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
jmp 0x5b6d3a
xor ebx, ebx
jmp 0x5b6d3a
cmp dword [0x8e6f60], 0
jne 0x5b6dbf
mov eax, dword [edi + 8]
lea edx, [eax - 1]
mov dword [edi + 8], edx
test eax, eax
jg 0x5b6d48
lea eax, [ebp - 0x19]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.006fc130
jmp 0x5b6d48
mov dword [esp + 4], 0xffffffff
sub eax, 4
mov dword [esp], eax
call fcn.006b2de0
jmp 0x5b6daa
Function at 0x5b72d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x17c
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00704290
mov eax, dword [ebp - 0x20]
lea edx, [eax - 0xc]
mov ebx, dword [eax - 0xc]
test ebx, ebx
je 0x5b7341
mov edi, dword [edx + 8]
test edi, edi
js 0x5b7313
lea edx, [ebp - 0x20]
mov dword [esp], edx
call fcn.00702800
mov eax, dword [ebp - 0x20]
cmp byte [eax + ebx - 1], 0x5c
je 0x5b73fc
mov ebx, dword [eax - 0xc]
mov ecx, dword [eax - 4]
test ecx, ecx
js 0x5b7336
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00702800
mov eax, dword [ebp - 0x20]
cmp byte [eax + ebx - 1], 0x3a
je 0x5b73fc
mov edx, 2
mov eax, 0x7f2aa0
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea edx, [ebp - 0x20]
mov dword [esp], edx
call fcn.007030ac
lea eax, [ebp - 0x160]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov dword [esi], eax
inc eax
je 0x5b740c
lea edx, [ebp - 0x134]
xor eax, eax
mov ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0070342c
test byte [ebp - 0x160], 0x10
jne 0x5b73e8
mov eax, dword [ebp + 0x14]
mov dword [eax], 2
mov edx, dword [ebp + 0x18]
mov dword [edx], 2
mov esi, dword [0x8e4d24]
mov ebx, dword [0x8e4d20]
mov eax, dword [ebp - 0x20]
lea edi, [eax - 0xc]
cmp edi, 0x7bf7a4
jne 0x5b7430
mov eax, ebx
mov edx, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp + 0x14]
mov dword [eax], 3
mov edx, dword [ebp + 0x18]
mov dword [edx], 3
jmp 0x5b73c1
mov edx, 1
mov eax, 0x7f2aa3
jmp 0x5b734b
mov dword [esi], 0
mov esi, dword [0x8e4cd0]
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x5b742c
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
jmp 0x5b73cd
xor ebx, ebx
jmp 0x5b73cd
cmp dword [0x8e6f60], 0
jne 0x5b7457
mov eax, dword [edi + 8]
lea edx, [eax - 1]
mov dword [edi + 8], edx
test eax, eax
jg 0x5b73db
lea eax, [ebp - 0x19]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00702c78
jmp 0x5b73db
mov dword [esp + 4], 0xffffffff
sub eax, 4
mov dword [esp], eax
call fcn.006b2de0
jmp 0x5b7442
Function at 0x5b77a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
lea edx, [eax + 0x1c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x5b9814
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
mov esi, eax
test eax, eax
je 0x5b7828
mov eax, dword [ebx + 8]
add eax, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push edx
mov eax, dword [ebx + 8]
mov edi, eax
mov edx, dword [eax + 8]
lea ecx, [edx - 1]
cmp ecx, 0xfffffffd
ja 0x5b7811
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], esi
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_ResumeThread
push ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], 8
call fcn.00767ac4
mov dword [eax + 4], 0
mov dword [eax], 0x826598
mov dword [esp + 8], 0x634ab4
mov dword [esp + 4], 0x80be40
mov dword [esp], eax
call fcn.007682d4
lea esi, [esi]