joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ee1d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4ee21d
push 0
lea eax, [ebp + 8]
push eax
push 0x47c
lea eax, [edi + 0x480]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4ee225
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push 0
lea eax, [ebp + 8]
push eax
push 0xa8
lea eax, [edi + 0x9a4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
je 0x4ee217
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x4f2500
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], vtable.MD5_CTX.0
xorps xmm0, xmm0
mov dword [ecx + 0x18], 0
mov eax, ecx
mov dword [ecx + 0x14], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
movdqu xmmword [ecx + 0x5c], xmm0
movdqu xmmword [ecx + 0x6c], xmm0
movdqu xmmword [ecx + 0x7c], xmm0
movdqu xmmword [ecx + 0x8c], xmm0
mov byte [ecx + 0x5c], 0x80
ret
Function at 0x4f25a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0xa37210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov byte [ebp - 0x14], 0
movq qword [ebp - 0x13], xmm0
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0xb], 0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
jb 0x4f25e1
mov eax, dword [eax]
push 0x5ab930
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0057cd10
mov eax, dword [ebp - 0x40]
add esp, 0xc
test eax, eax
jne 0x4f2613
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b964
mov esp, ebp
pop ebp
ret 8
push esi
push edi
push 2
push 0
push eax
call fcn.0057d3e3
push dword [ebp - 0x40]
call fcn.005802d4
push 0
push 0
push dword [ebp - 0x40]
mov esi, eax
call fcn.0057d3e3
push esi
call fcn.0057f604
push dword [ebp - 0x40]
mov edi, eax
push esi
push 1
push edi
call fcn.0057d2a8
add esp, 0x30
mov ecx, ebx
push esi
push edi
call fcn.004f2f90
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.004f2770
test edi, edi
je 0x4f266d
push edi
call fcn.0057e788
add esp, 4
push dword [ebp - 0x40]
call fcn.0057cbc0
xorps xmm0, xmm0
mov byte [ebp - 0x38], 0
xor eax, eax
mov byte [ebp - 0x3c], 0
add esp, 4
mov word [ebp - 0x3b], ax
movdqu xmmword [ebp - 0x37], xmm0
xor ebx, ebx
movdqu xmmword [ebp - 0x27], xmm0
push 0x10
lea eax, [ebp - 0x3c]
push eax
movzx eax, byte [ebp + ebx - 0x14]
push eax
call fcn.0057fb48
add esp, 0xc
cmp byte [ebp - 0x3b], 0
jne 0x4f26ea
lea edi, [ebp - 0x38]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4f26b3
mov ax, word [0x5afa3c]
lea edx, [ebp - 0x3c]
mov word [edi], ax
mov esi, edx
jmp 0x4f26d0
mov al, byte [edx]
inc edx
test al, al
jne 0x4f26d0
lea edi, [ebp - 0x38]
sub edx, esi
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4f26e0
jmp 0x4f2708
lea edx, [ebp - 0x3c]
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x4f26f0
lea edi, [ebp - 0x38]
sub edx, esi
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4f2700
mov ecx, edx
inc ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp ebx, 0x10
jl 0x4f2695
lea eax, [ebp - 0x38]
push eax
call fcn.0057de0b
add esp, 4
cmp byte [ebp - 0x38], 0
pop edi
pop esi
jne 0x4f2738
xor ecx, ecx
jmp 0x4f2749
lea ecx, [ebp - 0x38]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f2740
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x38]
push eax
call fcn.004077a0
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.0057b964
mov esp, ebp
pop ebp
ret 8
Function at 0x4f2770
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xa37210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
lea ecx, [ecx]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x4f2790
mov eax, dword [esi + 0x14]
mov ecx, 0x38
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
jb 0x4f27d3
mov ecx, 0x78
sub ecx, eax
lea ebx, [esi + 0x5c]
push ecx
push ebx
mov ecx, esi
call fcn.004f2f90
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.004f2f90
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
lea esp, [esp]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
dec edi
jne 0x4f2800
xor eax, eax
mov edi, esi
xorps xmm0, xmm0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
movdqu xmmword [ebx], xmm0
pop edi
movdqu xmmword [ebx + 0x10], xmm0
pop esi
movdqu xmmword [ebx + 0x20], xmm0
movdqu xmmword [ebx + 0x30], xmm0
mov byte [ebx], 0x80
pop ebx
call fcn.0057b964
mov esp, ebp
pop ebp
ret 4

Function at 0x4f5550
Capabilities:
Create thread
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push 0
push str.ProcessHacker
push 0
push 0
call esi
push 0
test eax, eax
je 0x4f5590
push 0
push 0
push 0x4f5a20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.PhTreeNew
push 0
push 0
call esi
push 0
test eax, eax
jne 0x4f556a
push str.SysListView32
push eax
push eax
call esi
push 0
test eax, eax
jne 0x4f556a
push str.TformSettings
push eax
push eax
call esi
push 0
test eax, eax
jne 0x4f556a
push str.TWildProxyMain
push eax
push eax
call esi
push 0
test eax, eax
jne 0x4f556a
push str.TUserdefinedform
push eax
push eax
call esi
push 0
test eax, eax
jne 0x4f556a
push str.TformAddressChange
push eax
push eax
call esi
push 0
test eax, eax
jne 0x4f556a
push str.TMemoryBrowser
push eax
push eax
call esi
push 0
test eax, eax
jne 0x4f556a
push str.TFoundCodeDialog
push eax
push eax
call esi
pop esi
test eax, eax
je 0x4f5618
push 0
jmp 0x4f556a
ret
Function at 0x4f5940
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x87bed8
push esi
push edi
push ebx
call fcn.005063d0
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 7
mov dword [0xa6868c], ebx
call edi
mov ebx, eax
push 7
add ebx, ebx
call edi
mov esi, eax
push 4
add esi, esi
call edi
push 0
push dword [ebp + 8]
add eax, esi
add eax, dword [0xa54ce8]
push 0
push 0
push eax
mov eax, dword [0xa54ce4]
add eax, ebx
push eax
push 0
push closesocket
push 0x2ca0000
push 0xa68698
push 0xa68898
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
mov dword [0xa68690], esi
test esi, esi
jne 0x4f59c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
mov ecx, 0x83b1d4
call fcn.004ef9f0
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 2
mov ecx, 0x83b1d4
call fcn.004efff0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fac30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x1f2], 0
je 0x4facd1
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4facd1
push 0
push 1
push 0xa68d48
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x4facd1
mov eax, dword [ebp + 8]
movq xmm0, qword [eax]
movq qword [0xa68d30], xmm0
mov eax, dword [eax + 8]
mov dword [0xa68d38], eax
mov eax, dword [ebp + 0xc]
movq xmm0, qword [eax]
movq qword [0xa68d3c], xmm0
mov eax, dword [eax + 8]
mov dword [0xa68d44], eax
mov eax, dword [edi + 0x1f2]
mov dword [0xa68d2c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x84cd6c], eax
lea eax, [ebp + 0x10]
push eax
push 0
push 0
push 0x4fb070
push 0
push 0
mov dword [0xa68d28], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4facd9
push eax
push 0xa68d48
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x4fb840
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0xa37210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x104]
mov ebx, ecx
mov edx, edi
sub esi, edi
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x4fb865
movsx eax, byte [edi]
push eax
call fcn.00580f09
add esp, 4
test eax, eax
je 0x4fb8f4
lea eax, [ebp - 0x104]
push eax
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x4fb8a7
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b964
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0xc]
xor edi, edi
cmp dword [ecx], edi
je 0x4fb8f4
movsx eax, word [esi + 0xa]
push eax
push dword [ecx]
lea eax, [ebp - 0x110]
push eax
call fcn.0057bdd0
add esp, 0xc
push dword [ebp - 0x110]
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [ebp - 0x104]
push 0x5ab8fc
push eax
call fcn.0057cecc
mov eax, dword [esi + 0xc]
lea edi, [edi + 1]
lea ecx, [eax + edi*4]
add esp, 0xc
cmp dword [ecx], 0
jne 0x4fb8b0
lea eax, [ebp - 0x104]
push eax
push 0x20
push 0xa6b978
call fcn.0058100f
imul eax, dword [0xa6b9d0], 0x32
add esp, 0xc
mov esi, dword [ebp + 0xc]
add eax, dword [0xa6b9cc]
imul eax, eax, 0x5e
cmp si, word [eax + 0xa54eda]
jne 0x4fb942
cmp dword [0xa6b9ac], 0
je 0x4fb942
cmp dword [0xa6b9c8], 0
jne 0x4fb942
mov ecx, 0xa6b9a0
call fcn.00547cd0
mov eax, dword [ebx + 0x10]
lea edx, [ebp - 0x104]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
xor ecx, ecx
mov dword [ebx + 0x14], eax
test eax, eax
pop edi
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0057b964
mov esp, ebp
pop ebp
ret 8
Function at 0x4fc250
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.msvcp100.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCP100.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcp100d.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCP100D.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcp110.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCP110.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcp110d.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCP110D.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcp120.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCP120.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcp120d.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCP120D.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcr100.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCR100.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcr100d.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCR100D.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcr110.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCR110.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcr110d.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCR110D.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcr120.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCR120.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcr120d.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCR120D.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcp60.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.MSVCP60.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcp110_clr0400.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcr100_clr0400.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcr110_clr0400.dll
call esi
test eax, eax
jne 0x4fc3f7
push str.msvcr120_clr0400.dll
call esi
test eax, eax
jne 0x4fc3f7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
ret
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop esi
ret
Function at 0x4fc420
Capabilities:
Create thread

Disassembly:
mov eax, dword [0xa69114]
push esi
mov esi, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5ab790]
cvtpd2ps xmm0, xmm0
comiss xmm0, dword [0xa69110]
jbe 0x4fc488
push 0
push 0
push 0
push 0x4fc160
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0xa69114]
add eax, 0x1388
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5ab790]
cvtpd2ps xmm0, xmm0
movss dword [0xa69110], xmm0
cmp byte [0x84fe90], 0
je 0x4fc4a8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
mov dword [0xa69114], eax
mov byte [0x84fe90], 0
pop esi
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [esi + 0xc]
mov edx, eax
mov dword [0xa69114], edx
cmp edx, edi
jae 0x4fc4cb
mov ecx, edx
sub ecx, edi
dec ecx
mov dword [0xa69100], ecx
jmp 0x4fc4d4
mov eax, edx
sub eax, edi
mov dword [0xa69100], eax
mov dword [esi + 0xc], edx
mov eax, dword [0xa69100]
add dword [0xa690fc], eax
add dword [esi + 8], eax
cmp dword [esi + 8], 0x5265c00
pop edi
jb 0x4fc4f9
inc dword [esi + 4]
add dword [esi + 8], 0xfad9a400
pop esi
ret

Function at 0x4fc590
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
mov dword [ebp - 4], 0
je 0x4fc619
push 0
push 0
push 0
push 0x4fc570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0x5bac60
push 0x5bac70
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004fc500
push 0
push 0
push 0
push 0x4fc1f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 4]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x50fe30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a5d76
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0xa37210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 4]
mov dword [edi], vtable.CMunpaMarkManager.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
push 0x40
mov byte [ebp - 4], 1
mov dword [edi + 0x4c], 0
call fcn.00422350
push 0x40
lea ecx, [edi + 0x28]
call fcn.00422350
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x510cb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a73bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa37210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.CNewbieGuide.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
push 0x60
mov dword [ebp - 4], 0
call fcn.00422350
mov dword [esi + 0x30], 0
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x516600
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d59b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xa37210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esi], vtable.COBalloonName.0
push 0x3d
push eax
mov word [esi + 0xf6], ax
mov dword [esi + 0xfc], eax
mov byte [esi + 0x100], al
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea eax, [esi + 0x3c]
push eax
mov dword [esi + 0x7a], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0x7e], 0x464646
call fcn.0057c870
xorps xmm0, xmm0
movdqu xmmword [esi + 0x82], xmm0
mov byte [esi + 0x92], 0
movdqu xmmword [esi + 0x93], xmm0
push 0x798
movdqu xmmword [esi + 0xa3], xmm0
mov byte [esi + 0xb3], 0
movdqu xmmword [esi + 0xb4], xmm0
movdqu xmmword [esi + 0xc4], xmm0
mov byte [esi + 0xd4], 0
movdqu xmmword [esi + 0xd5], xmm0
movdqu xmmword [esi + 0xe5], xmm0
mov byte [esi + 0xf5], 0
movdqu xmmword [esi + 0x10a], xmm0
mov byte [esi + 0x11a], 0
call fcn.0057b17d
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x516741
mov ecx, eax
call fcn.004a9d90
jmp 0x516743
xor eax, eax
mov dword [esi + 0x124], eax
mov eax, esi
mov dword [esi + 0x120], 0
mov dword [esi + 0x136], 0
mov dword [esi + 0x12a], 0
mov dword [esi + 0x12e], 0
mov dword [esi + 0x132], 0
mov dword [esi + 0x11c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x522540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x522593
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x52259b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 8], 0x61208
jne 0x52258c
push 0
lea eax, [ebp - 4]
push eax
push 0xb4
lea eax, [ebx + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x52258c
cmp dword [ebp - 4], 0xb4
push esi
ja 0x52258d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x522850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 0x84]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp eax, dword [esi + 0x80]
je 0x522872
mov dword [ecx + 0xb8], 1
push 0
push 0x80
push 2
push 0
lea ebx, [ecx + 4]
mov ecx, 0x2d
push 0
push 0x40000000
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push str.._ini_GameOption.opt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x5228d4
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 4]
push 0
push eax
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x61208
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 0xb4
push ebx
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x52bb20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a67b3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0xa37210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
push 0xa
mov byte [ebp - 4], 1
call fcn.00422350
push 0x14
lea ecx, [edi + 0x24]
call fcn.00422350
mov ecx, edi
call fcn.0052c900
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x533f10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6a57
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0xa37210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], 0
je 0x533f64
mov dword [edi], 0x5bd2a0
mov dword [edi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 4]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.0044d7f0
mov eax, dword [edi]
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.0044bbd0
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov dword [esi + 0x50], 0
mov eax, dword [0xa5ca94]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x5343c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6b48
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0xa37210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x105
mov dword [ebp - 4], 0
call fcn.0057b17d
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov dword [esi + 0x22], eax
cmovae ecx, dword [ebp + 8]
push ecx
push 0x104
push eax
call fcn.0058100f
mov ecx, dword [esi + 0x22]
mov al, byte [ebp + 0x20]
push 0
push 0
mov byte [ecx + 0x104], al
push dword [esi + 0x22]
push 0x535530
push 0
push 0
call fcn.005813b3
add esp, 0x28
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 0x10
jb 0x53444c
push dword [ebp + 8]
call fcn.0057b1ce
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x1c