joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469910
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00412d30
mov ecx, 0x4cdf8c
test ecx, ecx
jne 0x46993a
mov dword [ebp - 0x4c], 0
jmp 0x469968
mov dword [ebp - 0x6c], 0x4cdf8c
mov edx, dword [ebp - 0x6c]
inc edx
mov dword [ebp - 0x70], edx
mov eax, dword [ebp - 0x6c]
mov cl, byte [eax]
mov byte [ebp - 0x71], cl
inc dword [ebp - 0x6c]
cmp byte [ebp - 0x71], 0
jne 0x469948
mov edx, dword [ebp - 0x6c]
sub edx, dword [ebp - 0x70]
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
push 0x4cdf8c
lea ecx, [ebp - 0x10]
call fcn.004590c0
push 0
call fcn.0048074f
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x28]
call fcn.0047ae65
push 0
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0047af20
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x469a66
lea ecx, [ebp - 0x28]
call fcn.0047ac0b
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
call fcn.0047ae2c
test eax, eax
jne 0x4699de
push 0x10
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call dword [edx + 0x38]
test eax, eax
je 0x4699e0
jmp 0x4699ae
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
call fcn.0047adc8
test eax, eax
je 0x469a61
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
sbb edx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
push 0
push 0x15180
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.00483370
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edx
cmp dword [ebp - 0x7c], 0
jl 0x469a61
jg 0x469a38
cmp dword [ebp - 0x80], 0x1e
jbe 0x469a61
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x28]
call fcn.0047b0ca
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
call fcn.00413050
jmp 0x4699ae
lea ecx, [ebp - 0x28]
call fcn.0047ae89
lea ecx, [ebp - 0x10]
call fcn.00413050
mov esp, ebp
pop ebp
ret 4

Function at 0x46a170
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x4cdf94
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46a1b8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x46beb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xa8], 1
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x94], eax
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x94], 0xffffffff
jne 0x46bef2
jmp 0x46bf99
mov eax, dword [ebp - 0x14]
mov word [eax + 0x74], 2
mov cx, word [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebp - 0x14]
mov word [edx + 0x76], ax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x78], eax
push 0x10
mov edx, dword [ebp - 0x14]
add edx, 0x74
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x94]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x46bf45
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
jmp 0x46bf99
movsx edx, word [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str.Connect_ClientMode__s__d
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0046c5e0
add esp, 0x10
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xd8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x94]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00461720
mov ecx, dword [ebp - 0x14]
call fcn.004628d0
mov eax, 1
jmp 0x46bfee
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x94], 0xffffffff
je 0x46bfc2
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x94], 0xffffffff
mov dword [ebp - 0xc], 0x4ce1fc
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x14]
add edx, 0x9c
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov dword [ebp - 0xc], 0x4ce1fc
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46c000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x58], 0
je 0x46c037
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x60]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push str.CGOConnection::Reconnect___failed__d__p
call fcn.0045faa0
add esp, 0xc
xor eax, eax
jmp 0x46c1a5
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0xa8], 1
je 0x46c04a
xor eax, eax
jmp 0x46c1a5
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x94], eax
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x94], 0xffffffff
jne 0x46c076
jmp 0x46c150
push 0x10
mov eax, dword [ebp - 0x18]
add eax, 0x74
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x94]
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x46c0a1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
jmp 0x46c150
push str.Reconnect
mov eax, dword [ebp - 0x18]
push eax
call fcn.0046c5e0
add esp, 8
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0xd8], 0
mov edx, dword [ebp - 0x18]
add edx, 0x14
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x58], 0
je 0x46c0da
call fcn.0045eed0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x94]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x18]
add edx, 8
push edx
mov ecx, dword [ebp - 0x18]
call fcn.00461720
xor eax, eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x2c
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
xor edx, edx
mov eax, dword [ebp - 0x18]
add eax, 0x40
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x54]
mov dword [edx + 0x4030], 0
mov eax, dword [ebp - 0x18]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x18]
call fcn.004628d0
mov eax, 1
jmp 0x46c1a5
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x94], 0xffffffff
je 0x46c179
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x94], 0xffffffff
mov dword [ebp - 0xc], 0x4ce1fc
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x18]
add edx, 0x9c
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov dword [ebp - 0xc], 0x4ce1fc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x46cc80
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x4e4150]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a0], ecx
mov ecx, dword [ebp - 0x1a0]
call fcn.00462610
mov eax, dword [ebp - 0x1a0]
mov dword [eax], 0x4ce3b4
mov ecx, dword [ebp - 0x1a0]
add ecx, 0x1c
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x19c]
mov eax, dword [ebp - 0x19c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 0x19c]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x19c]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x1a0]
add ecx, 0x28
call fcn.00463f50
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + 0x3c], 0
mov edx, dword [ebp - 0x1a0]
mov dword [edx + 0x40], 0
mov eax, dword [ebp - 0x1a0]
mov dword [eax + 0x44], 0
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + 0x48], 0xffffffff
mov edx, dword [ebp - 0x1a0]
mov dword [edx + 0x4c], 0
mov ecx, dword [ebp - 0x1a0]
add ecx, 0x50
call fcn.0046d6d0
mov eax, dword [ebp - 0x1a0]
mov dword [eax + 0x7c], 0
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + 0x80], 0
mov edx, dword [ebp - 0x1a0]
mov dword [edx + 0x84], 0
mov eax, dword [ebp - 0x1a0]
mov dword [eax + 0x88], 0
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + 0x8c], 0
lea edx, [ebp - 0x198]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 0x1a0]
add edx, 0x64
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f5bc
mov esp, ebp
pop ebp
ret
Function at 0x46cf00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x40], 0
je 0x46cf2d
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x40], 0
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x44], 0
je 0x46cf51
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x44], 0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x3c], 0
je 0x46cf75
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x3c], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x48], 0xffffffff
je 0x46d002
mov word [ebp - 4], 1
mov word [ebp - 2], 0
push 2
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x48]
push ecx
call dword [sym.imp.WSOCK32.dll_shutdown]
push 4
lea edx, [ebp - 4]
push edx
push 0x80
push 0xffff
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x48]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x48]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x48], 0xffffffff
push 0x3e8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x46d002
jmp 0x46cfe4
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x4c], 0
je 0x46d072
push str.shutdown_user_context.._n
call fcn.004836ea
add esp, 4
mov dword [ebp - 8], 0
jmp 0x46d02a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x7c]
jge 0x46d04a
push 1
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x4c]
mov ecx, dword [ebp - 8]
mov ecx, dword [eax + ecx*4]
call fcn.0046bbd0
jmp 0x46d021
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x4c], 0
push 0x3e8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x8c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x46d072
jmp 0x46d054
mov ecx, dword [ebp - 0xc]
call fcn.0046d660
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x8c], 0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x38], 0
je 0x46d0ad
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esp, ebp
pop ebp
ret
Function at 0x46de70
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 1
push 3
push 0x10
push 0xf01ff
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46deca
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x46dee0
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
push 0x10000
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46df30
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x46df26
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x46df40
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46dfd8
push 2
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x46dfcc
xor eax, eax
cmp dword [ebp + 8], 0
setne al
add eax, 3
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xc]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x10]
push ecx
push 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
jmp 0x46e039
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 0x14]
push edx
push 0
push 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusA]
cmp dword [ebp - 0x14], 0
je 0x46e039
mov edx, dword [ebp - 0x14]
push edx
call fcn.00460f60
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusA]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00460f70
add esp, 4
mov esp, ebp
pop ebp
ret 8

Function at 0x46e720
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
push ecx
mov ecx, dword [ebp - 0x3c]
call fcn.0046e7a0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x46e76a
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x46e761
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 4]
call dword [eax]
add esp, 8
mov dword [ebp - 0xc], eax
jmp 0x46e768
mov dword [ebp - 0xc], 0
jmp 0x46e782
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx + 4]
mov edx, dword [eax]
call dword [edx + 0x28]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x471820
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x64]
jge 0x471865
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0x470400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x471899
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
mov edx, 1
lock xadd dword [ecx], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1c], 0
je 0x47188c
push str.CreateWorkerThread___LoginDB
call fcn.0045fad0
add esp, 4
jmp 0x471899
push str.CreateWorkerThread___GameDB
call fcn.0045fad0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x47fb05
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x47fb22
call fcn.00482ddc
mov dword [eax], 0x16
xor eax, eax
jmp 0x47fb8c
push esi
push 0x8c
push 1
call fcn.00485558
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x47fb77
push esi
call fcn.00486a3b
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x47fb55
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x47fa70
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x47fb8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0048154a
test ebx, ebx
pop ecx
je 0x47fb89
push ebx
call fcn.00482dee
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x481674
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0047f5d0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x48170f
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4ed0fc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x48170f
cmp eax, 1
je 0x481730
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x48170f
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4816dc
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x48170b
xor eax, eax
inc eax
jmp 0x48174f
cmp edi, eax
jae 0x481713
xor eax, eax
jmp 0x48174f
cmp eax, esi
jae 0x48171a
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4ed0fc]
jmp 0x481733
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4829b7
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4829e4
test byte [esp + 8], 0x80
je 0x4829d2
and eax, 0xfffffffe
jmp 0x4829d5
or eax, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4829f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00482dee
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x4830cf
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0x60
push 0x4d5458
call fcn.0048472c
mov edi, 0x94
mov eax, edi
call fcn.0047f5d0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4ed0fc], ecx
mov eax, dword [esi + 4]
mov dword [0x4ed108], eax
mov edx, dword [esi + 8]
mov dword [0x4ed10c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4ed100], esi
cmp ecx, 2
je 0x48312f
or esi, 0x8000
mov dword [0x4ed100], esi
shl eax, 8
add eax, edx
mov dword [0x4ed104], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call fcn.0045311e
dec ebp
pop edx
jne 0x48316a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48316a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x483182
cmp eax, 0x20b
je 0x48316f
mov dword [ebp - 0x1c], esi
jmp 0x483196
cmp dword [ecx + 0x84], 0xe
jbe 0x48316a
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x483190
cmp dword [ecx + 0x74], 0xe
jbe 0x48316a
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00488b1a
pop ecx
test eax, eax
jne 0x4831aa
push 0x1c
call fcn.00483055
pop ecx
call fcn.00486c41
test eax, eax
jne 0x4831bb
push 0x10
call fcn.00483055
pop ecx
call fcn.0048b0e8
mov dword [ebp - 4], esi
call fcn.0048ae9e
test eax, eax
jge 0x4831d4
push 0x1b
call fcn.00483030
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4eeb10], eax
call fcn.0048ad7c
mov dword [0x4ed0ec], eax
call fcn.0048acda
test eax, eax
jge 0x4831fa
push 8
call fcn.00483030
pop ecx
call fcn.0048aaa7
test eax, eax
jge 0x48320b
push 9
call fcn.00483030
pop ecx
push 1
call fcn.00483492
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x483221
push eax
call fcn.00483030
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0048aa4a
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x483242
movzx eax, word [ebp - 0x40]
jmp 0x483245
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00495ee2
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x483263
push edi
call fcn.004835bf
call fcn.004835e1
jmp 0x483295
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00484767
ret