joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451ab0
Capabilities:
Connect to http server
Create http request
Encode data using xor
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0
push 0
push 0
push str.MyBrowser
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
mov dword [ebp - 0x814], esi
test esi, esi
je 0x451ca7
push 1
push 0
push 3
push 0
push 0
push 0x50
push dword [0x704660]
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 0x80c], eax
test eax, eax
je 0x451cac
mov dword [ebp - 0x808], 0x5f3484
push ebx
mov ebx, dword [ebp - 0x808]
mov edi, dword [ebp - 0x808]
add edi, 0x14
mov dword [ebp - 0x81c], 0x5f3480
mov dword [ebp - 0x818], 0
cmp byte [ebx + 0x13], 0
je 0x451b93
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x808], ecx
test esi, esi
je 0x451b7e
sub edi, ecx
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x808]
cmp edx, dword [ebx + 0xf]
jb 0x451b62
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov esi, dword [ebp - 0x814]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0x80c]
push 1
push 0
lea ecx, [ebp - 0x81c]
push ecx
push 0
push 0
push edi
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
test edi, edi
je 0x451cb1
mov ecx, 0x62e758
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x451bc1
sub ecx, edx
mov edx, 0x62e75c
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x451bd2
push ecx
push 0x62e758
sub edx, ebx
push edx
push 0x62e75c
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
pop ebx
test eax, eax
je 0x451cb6
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.005b7980
add esp, 0xc
mov dword [ebp - 0x810], 0x800
lea eax, [ebp - 0x810]
push 0
push eax
lea eax, [ebp - 0x804]
push eax
push 0x16
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x451cbb
lea eax, [ebp - 0x804]
push eax
push 0x725ec0
call fcn.0042bd40
push eax
call fcn.0043fee0
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.005b7980
add esp, 0x18
lea eax, [ebp - 0x810]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x451cc0
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x80c]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005b6a74
mov esp, ebp
pop ebp
ret
call fcn.00451cd0
call fcn.00451cd0
call fcn.00451cd0
call fcn.00451cd0
call fcn.00451cd0
call fcn.00451cd0
int3
Function at 0x451cd0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9d46
mov eax, dword fs:[0]
push eax
sub esp, 0x158
push esi
mov eax, dword [0x6d5760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x7046f4], 1
jne 0x451d50
push 1
push 0x40
push 8
push str.GameGuard_Log.txt
lea ecx, [ebp - 0x164]
call fcn.00430010
lea eax, [ebp - 0x164]
mov dword [ebp - 4], 0
push str._nHTTP_Server_connection_fail_
push eax
call fcn.0042bd40
add esp, 8
lea ecx, [ebp - 0x164]
call fcn.004308e0
lea ecx, [ebp - 0x164]
mov dword [ebp - 4], 0xffffffff
call fcn.00430290
cmp dword [0x704704], 1
jne 0x451dfd
lea eax, [ebp - 0x14]
push eax
call fcn.005ba559
lea eax, [ebp - 0x14]
push eax
call fcn.005ba2ba
add esp, 8
lea ecx, [ebp - 0xbc]
mov esi, eax
push 1
push 0x40
push 8
push 0x5eba44
call fcn.00430010
lea eax, [ebp - 0xbc]
mov dword [ebp - 4], 1
push str._nLocal_Time:
push eax
call fcn.0042bd40
push esi
call fcn.005ba0ad
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0042bd40
lea eax, [ebp - 0xbc]
push str.HTTP_Server_connection_fail_
push eax
call fcn.0042bd40
lea eax, [ebp - 0xbc]
push str._n__________________
push eax
call fcn.0042bd40
add esp, 0x24
lea ecx, [ebp - 0xbc]
call fcn.004308e0
push 2
push 0x5eba44
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xbc]
call fcn.00430290
mov eax, dword [0x7046f8]
cmp eax, 1
je 0x451e48
cmp eax, 3
je 0x451e48
cmp eax, 4
je 0x451e48
push 0
cmp eax, 2
jne 0x451e3e
push 0
push 0
push 0x451e60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
test eax, eax
jne 0x451e38
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x451e90
jmp 0x451e21

Function at 0x451ec0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push fcn.00451ab0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x452090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0x5f34d0
mov dword [ecx + 4], 0
mov dword [ecx + 0x18], str.SPLASH
mov dword [ecx + 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], 0x5f34dc
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 4]
add edi, 0x14
mov dword [ebp - 8], eax
cmp byte [ebx + 0x13], 0
je 0x452115
push esi
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 4], ecx
test esi, esi
pop esi
je 0x452109
sub edi, ecx
nop
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
cmp edx, dword [ebx + 0xf]
jb 0x4520f0
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
mov eax, dword [ebp - 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop edi
mov dword [0x704614], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4523e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6d5760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0x5f3514
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x10]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x452462
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.005b96b2
add esp, 4
mov ecx, eax
xor edx, edx
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x452459
sub edi, ecx
lea ebx, [ebx]
mov eax, edx
add ecx, edx
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ebx + 0xf]
jb 0x452440
mov eax, dword [ebx + 0xf]
mov edi, ecx
mov byte [ecx + eax], 0
push 0x808080
push edi
lea ecx, [ebp - 0x2c]
call fcn.00451f10
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.004523a0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x2c]
call fcn.00452000
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00451f90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453760
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x453780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x4583c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da936
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x718694]
mov eax, dword [eax + 0x125]
movzx eax, ax
push eax
lea eax, [ebp - 0x50]
push str.._data_aiconfig__d.dat
push eax
call fcn.005b7fdc
push 0x1c5c
lea edi, [esi + 0xe6]
push 0
push edi
call fcn.005b7980
push 0x5e8a08
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.005b7e20
mov eax, dword [ebp - 0x54]
add esp, 0x24
test eax, eax
je 0x458514
push eax
push 1
push 0x1c5c
push edi
call fcn.005b83b7
push dword [ebp - 0x54]
call fcn.005b7cd0
mov eax, dword [0x704ca4]
add esp, 0x14
test eax, eax
jne 0x458490
push 0x1d7a
call fcn.005b6294
add esp, 4
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x458482
mov ecx, eax
call fcn.00453df0
jmp 0x458484
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x704ca4], eax
imul eax, dword [eax + 0x21a], 0x64
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5e8800]
cvtpd2ps xmm0, xmm0
movss dword [esi + 0xda], xmm0
mov eax, dword [0x704ca4]
test eax, eax
jne 0x4584eb
push 0x1d7a
call fcn.005b6294
add esp, 4
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4584e4
mov ecx, eax
call fcn.00453df0
jmp 0x4584e6
xor eax, eax
mov dword [0x704ca4], eax
imul eax, dword [eax + 0x21e], 0x64
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5e8800]
cvtpd2ps xmm0, xmm0
movss dword [esi + 0xe2], xmm0
jmp 0x45851b
mov ecx, esi
call fcn.004550f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b6a74
mov esp, ebp
pop ebp
ret

Function at 0x458540
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
push str.data
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push str.data_aiconfig
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [0x718694]
movzx eax, word [eax + 0x125]
push eax
lea eax, [ebp - 0x44]
push str.._data_aiconfig__d.dat
push eax
call fcn.005b7fdc
push 0x5f3aac
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.005b7e20
mov eax, dword [ebp - 0x48]
add esp, 0x18
test eax, eax
je 0x4585c3
push eax
push 1
lea eax, [edi + 0xe6]
push 0x1c5c
push eax
call fcn.005b86ce
push dword [ebp - 0x48]
call fcn.005b7cd0
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.005b6a74
mov esp, ebp
pop ebp
ret
Function at 0x461f80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
push edi
mov edi, ecx
lea ecx, [edi + 0x9a4]
jne 0x461fc8
mov eax, dword [0x717044]
add eax, 0x1d4c0
push esi
mov dword [edi + 0x958], eax
call fcn.00479ed0
push str.ANRaster.tga
lea ecx, [edi + 0x9a4]
call fcn.00479e00
pop esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004d64a0
pop edi
pop ebp
ret 4
call fcn.00479ed0
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
mov ecx, edi
call fcn.004d64a0
pop edi
pop ebp
ret 4

Function at 0x461ff0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
push edi
mov edi, ecx
lea ecx, [edi + 0x9a4]
jne 0x46203b
imul eax, dword [ebp + 0xc], 0x3e8
push esi
add eax, dword [0x717044]
mov dword [edi + 0x958], eax
call fcn.00479ed0
push str.ANRaster.tga
lea ecx, [edi + 0x9a4]
call fcn.00479e00
pop esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004d64a0
pop edi
pop ebp
ret 8
call fcn.00479ed0
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
mov ecx, edi
call fcn.004d64a0
pop edi
pop ebp
ret 8

Function at 0x466880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db267
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6d5760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
lea ebx, [ecx + 0x48]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
lea edi, [ecx + 0x6c]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [ecx + 0x90]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
push 0x65
mov byte [ebp - 4], 4
call fcn.004159f0
mov ecx, dword [ebp - 0x10]
push 0x65
lea ecx, [ecx + 0x24]
call fcn.004159f0
push 0x65
mov ecx, ebx
call fcn.004159f0
push 0x65
mov ecx, edi
call fcn.004159f0
push 0x65
mov ecx, esi
call fcn.004159f0
mov eax, dword [ebp - 0x10]
mov dword [0x704e5c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4890c0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x4890e0
push 0
push 0x6a
push str.DirectoryManager.cpp
call fcn.00413300
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x4890f7
cmp esi, 0x11
je 0x4890f7
push dword [edi + esi*4 + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
pop ebp
ret 4

Function at 0x48e050
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dc907
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6d5760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.CEffectManager.0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
push 0x48dc30
push 0x48dc10
push 2
push 0xc
lea eax, [ebx + 0x34]
mov dword [ebp - 4], 0
push eax
call fcn.005b7a10
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
push 0xa
lea ecx, [ebx + 0x70]
mov byte [ebp - 4], 2
call fcn.005b2240
push 0x20
lea ecx, [ebx + 4]
mov byte [ebp - 4], 3
call fcn.004159f0
push 0x20
lea ecx, [ebx + 0x4c]
call fcn.004159f0
push 0x190
call fcn.005b6294
add esp, 4
test eax, eax
je 0x48e144
mov dword [eax], vtable.CMemoryPoolTempl_class_CDamageNumber_.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [eax + 0x10], 0
jmp 0x48e146
xor eax, eax
push 0x190
mov dword [ebx + 0x2c], eax
call fcn.005b6294
add esp, 4
test eax, eax
je 0x48e174
mov dword [eax], vtable.CMemoryPoolTempl_class_CEffect_.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [eax + 0x10], 0
jmp 0x48e176
xor eax, eax
mov esi, dword [ebx + 0x2c]
push 0x80
mov dword [ebx + 0x28], eax
push str.CDamageNumber
lea eax, [esi + 0x10]
push eax
call fcn.005b7b40
lea edi, [esi + 4]
mov dword [esi + 0xc], 0x28
add esp, 0xc
cmp dword [edi], 0
jne 0x48e1b1
push 0x3c
push edi
call fcn.0048e8a0
mov eax, dword [edi]
add esp, 8
mov dword [esi + 8], eax
mov esi, dword [ebx + 0x28]
push 0x80
push str.CEffect
lea eax, [esi + 0x10]
push eax
call fcn.005b7b40
lea edi, [esi + 4]
mov dword [esi + 0xc], 0x32
add esp, 0xc
cmp dword [edi], 0
jne 0x48e1e9
push 0x64
push edi
call fcn.0048e9d0
mov eax, dword [edi]
add esp, 8
mov dword [esi + 8], eax
mov eax, ebx
mov dword [ebx + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498be0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x408], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x418], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x41c], eax
xor edi, edi
mov eax, dword [ebp + 0x14]
push 0x400
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x404]
push edi
push eax
mov dword [ebp - 0x414], ebx
call fcn.005b7980
mov edx, dword [ebp - 0x408]
add esp, 0xc
mov dword [ebp - 0x40c], esi
lea ecx, [edx + 1]
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x498c50
sub edx, ecx
mov dword [ebp - 0x410], esi
xor ecx, ecx
cmp edx, 2
jl 0x498c96
lea ebx, [edx - 1]
lea esp, [esp]
mov eax, dword [ebp - 0x408]
movsx eax, byte [eax + ecx]
add esi, eax
mov eax, dword [ebp - 0x408]
movsx eax, byte [eax + ecx + 1]
add ecx, 2
add edi, eax
cmp ecx, ebx
jl 0x498c70
mov ebx, dword [ebp - 0x414]
cmp ecx, edx
jge 0x498caa
mov eax, dword [ebp - 0x408]
movsx eax, byte [eax + ecx]
mov dword [ebp - 0x410], eax
lea eax, [edi + esi]
xor edx, edx
add eax, dword [ebp - 0x410]
div dword [ebx + 0x48]
mov esi, edx
xor edx, edx
mov eax, esi
div dword [ebx + 0x24]
mov eax, dword [ebx + 0x28]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x498ce7
jmp 0x498cd0
cmp dword [eax], esi
je 0x498cdd
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x498cd0
jmp 0x498ce7
cmp dword [eax + 4], 0
jne 0x498d8b
cmp dword [ebx + 0x20], 0xcd
jb 0x498d1a
push 0x33
mov ecx, ebx
call fcn.00498dd0
lea eax, [ebp - 0x404]
push 0x5f769c
push eax
call fcn.005b7fdc
add esp, 8
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebx]
mov edi, dword [ebp - 0x408]
push 0
push 0
mov ecx, dword [eax]
push 0
push edi
push eax
call dword [ecx + 0x18c]
mov dword [ebp - 0x40c], eax
test eax, eax
je 0x498d91
mov ecx, dword [ebx]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x114]
mov eax, dword [ebx]
push dword [ebp - 0x40c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10c]
mov ecx, ebx
call fcn.00498ba0
test eax, eax
je 0x498d70
mov ecx, dword [ebp - 0x40c]
mov dword [eax + 8], ecx
mov dword [eax + 4], esi
push eax
lea ecx, [ebx + 4]
call fcn.005b2380
push esi
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebx + 0x20]
call fcn.00548fd0
jmp 0x498d91
mov edi, dword [ebp - 0x408]
push dword [ebp - 0x420]
mov eax, dword [ebx]
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x18c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b6a74
mov esp, ebp
pop ebp
ret 0x10
Function at 0x498f20
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esi + 0x4c]
mov ebx, eax
add edx, 0x493e0
cmp ebx, edx
jbe 0x498f87
cmp dword [esi + 0x10], 0
jle 0x498f79
push edi
lea ecx, [esi + 4]
call fcn.005b2b20
mov edi, eax
test edi, edi
je 0x498f78
push dword [edi + 8]
call fcn.004992f0
add esp, 4
lea ecx, [esi + 0x20]
push dword [edi + 4]
call fcn.0048f480
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
pop edi
push str._n____Cache_delete_one_item.__n_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], ebx
pop esi
pop ebx
ret

Function at 0x499b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dccd0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6d5760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.CEventMap.0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
lea edi, [ebx + 0x34]
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x6a]
mov byte [edi + 1], 0
call fcn.004da6c0
lea ecx, [ebx + 0x8a]
mov byte [ebp - 4], 1
call fcn.004da6c0
lea ecx, [ebx + 0xaa]
mov byte [ebp - 4], 2
call fcn.004da6c0
lea ecx, [ebx + 0xca]
mov byte [ebp - 4], 3
call fcn.004da6c0
push 0x3e8
lea ecx, [ebx + 4]
mov byte [ebp - 4], 4
call fcn.004159f0
push 0x29
push 0
push edi
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x62], 0
mov dword [ebx + 0x5e], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0xea], 0
call fcn.005b7980
add esp, 0xc
mov dword [ebx + 0x66], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a49d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd5d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6d5760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.004a6250
mov dword [edi], eax
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00479580
mov dword [edi + 8], eax
lea ecx, [edi + 0x10]
mov byte [ebp - 4], 1
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.00484cd0
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a52e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x6d5760]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x25b]
push esi
mov esi, dword [ebp + 0xc]
push 0x1f3
push 0
push eax
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x268], esi
mov byte [ebp - 0x25c], 0
call fcn.005b7980
xor eax, eax
mov byte [ebp - 0x260], 0
push 0x63
push eax
mov word [ebp - 0x25f], ax
mov byte [ebp - 0x68], al
lea eax, [ebp - 0x67]
push eax
call fcn.005b7980
add esp, 0x18
test ebx, ebx
je 0x4a5460
test esi, esi
je 0x4a5460
push edi
lea eax, [ebp - 0x25c]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x4a5407
cmp byte [ebp - 0x25c], 0
je 0x4a5407
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea esi, [ebp - 0x25c]
push 0x5f7de4
push esi
call edi
test eax, eax
je 0x4a53f3
push 0x5f7de8
push esi
call edi
test eax, eax
je 0x4a53f3
movzx eax, byte [esi]
mov byte [ebp - 0x260], al
movzx eax, byte [esi + 1]
mov byte [ebp - 0x25f], al
lea eax, [ebp - 0x68]
push 0x64
push eax
lea eax, [ebp - 0x260]
mov byte [ebp - 0x25e], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x4a540f
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea eax, [ebp - 0x68]
push ebx
push eax
push dword [ebp - 0x264]
call fcn.005bb0c4
add esp, 0xc
test eax, eax
je 0x4a5424
add esi, 4
cmp byte [esi], 0
jne 0x4a5387
mov ebx, dword [ebp - 0x264]
mov esi, dword [ebp - 0x268]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b6a74
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 0x268]
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x264]
add eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b6a74
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.005b6a74
mov esp, ebp
pop ebp
ret 8