joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
mov dword [esi + 0x930], 0
je 0x45f762
cmp dword [esi + 0x2c], 0
jne 0x45f762
cmp dword [0x6d3b50], 0
push edi
mov edi, dword [ebp + 8]
jne 0x45f6bb
push dword [edi + 0x260]
push dword [edi + 0x25c]
call fcn.0045fba0
test eax, eax
je 0x45f6bb
cmp dword [0x6d3b24], 0
je 0x45f667
cmp dword [0x6d3b60], esi
je 0x45f69e
mov dword [esi + 0x930], 0x100000
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x40], eax
sub eax, dword [esi + 0x44]
cmp eax, 0x78
jbe 0x45f69e
mov dword [0x6d3a60], 1
mov eax, dword [edi + 0x25c]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x260]
mov dword [esi + 0x54], eax
cmp dword [0x6d3b24], 0
jne 0x45f6ea
test byte [esi + 0xc], 0x80
je 0x45f6ea
push 0
mov ecx, 0x6c7238
call fcn.00446140
jmp 0x45f6ea
cmp dword [0x6d3a5c], 0
mov dword [0x6d3a60], 0
je 0x45f6de
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
jmp 0x45f6ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
cmp dword [0x6d3b54], 0
jne 0x45f756
push dword [edi + 0x270]
mov ecx, esi
push dword [edi + 0x26c]
call fcn.0045fba0
test eax, eax
je 0x45f756
cmp dword [edi + 0x220], 0
je 0x45f71d
or dword [esi + 0x930], 0x400
cmp dword [edi + 0x224], 0
je 0x45f730
or dword [esi + 0x930], 0x200
cmp dword [edi + 0x238], 0
je 0x45f743
or dword [esi + 0x930], 0x10000
cmp dword [edi + 0x23c], 0
je 0x45f756
or dword [esi + 0x930], 0x20000
mov eax, dword [esi + 0x930]
pop edi
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x45fc20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x45fc8e
mov ecx, dword [esi + 0x888]
test ecx, ecx
je 0x45fc79
mov edx, dword [esi + 0x894]
mov eax, 0x51eb851f
imul edx, dword [esi + 0x890]
mul edx
lea eax, [esi + 0x898]
shr edx, 5
shl edx, 0x18
or edx, dword [esi + 0x88c]
push edx
push eax
push ecx
mov dword [esp], 0
lea eax, [esi + 0x900]
push 0
push eax
call fcn.0044e530
mov ecx, esi
pop esi
jmp fcn.0045fe00
mov eax, dword [0x6d3a58]
xor ecx, ecx
cmp dword [0x6dc19c], ecx
cmovne eax, ecx
mov dword [0x6d3a58], eax
pop esi
ret
Function at 0x45fe00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x60], 0
jne 0x45fe33
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x6d3a68]
cmp eax, 0x78
jbe 0x45ff23
call esi
mov dword [0x6d3a68], eax
mov dword [0x6d3a5c], 0
pop esi
ret
mov eax, dword [esi + 0x40]
sub eax, dword [esi + 0x44]
cmp eax, 0x78
jbe 0x45ff23
mov dword [0x6d3a5c], 1
lea edx, [esi + 0x58]
mov dword [0x6d3b40], edx
mov ecx, dword [esi + 0x54]
mov eax, dword [esi + 0x50]
add ecx, 0x1c
add eax, 0x22
mov dword [edx + 0x3c], ecx
mov dword [edx + 0x38], eax
cmp dword [esi + 0x910], 0
je 0x45febb
push 0x1d
mov ecx, 0x6eb1a0
call fcn.0052b330
test eax, eax
je 0x45febb
mov eax, dword [esi + 0x910]
cmp dword [eax + 8], 0
je 0x45febb
mov dword [0x6d3b44], eax
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x910]
add edx, 0x1c
mov eax, dword [esi + 0x50]
sub eax, 0x102
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], edx
mov eax, dword [esi + 0x910]
mov dword [eax + 0x1a0], 1
cmp dword [esi + 0x914], 0
je 0x45ff23
push 0x1d
mov ecx, 0x6eb1a0
call fcn.0052b330
test eax, eax
je 0x45ff23
mov eax, dword [esi + 0x914]
cmp dword [eax + 8], 0
je 0x45ff23
mov dword [0x6d3b48], eax
mov edx, dword [esi + 0x914]
mov cx, word [edx + 0x48]
add cx, 3
mov ax, cx
shl ax, 4
sub ax, cx
mov ecx, dword [esi + 0x54]
movzx eax, ax
sub ecx, eax
mov eax, dword [esi + 0x50]
sub eax, 0x102
mov dword [edx + 0x3c], ecx
mov dword [edx + 0x38], eax
mov eax, dword [esi + 0x914]
mov dword [eax + 0x1a0], 1
pop esi
ret

Function at 0x466670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0xc]
pop ebp
jmp fcn.00454990

Function at 0x47aa30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589676
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 4]
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CReinforceManager.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
push 0x14
mov byte [ebp - 4], 1
call fcn.0047ae10
push 0x14
lea ecx, [edi + 0x28]
call fcn.0047ae10
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x483060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589676
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 4]
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CMunpaMarkManager.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
push 0x40
mov byte [ebp - 4], 1
mov dword [edi + 0x4c], 0
call fcn.0047ae10
push 0x40
lea ecx, [edi + 0x28]
call fcn.0047ae10
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a7eb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
push edi
mov edi, ecx
lea ecx, [edi + 0x9c0]
jne 0x4a7ef8
mov eax, dword [0x6db0a0]
add eax, 0x1d4c0
push esi
mov dword [edi + 0x974], eax
call fcn.00469fa0
push str.ANRaster.tga
lea ecx, [edi + 0x9c0]
call fcn.00469f00
pop esi
push dword [ebp + 8]
mov ecx, edi
call fcn.0044a320
pop edi
pop ebp
ret 4
call fcn.00469fa0
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
mov ecx, edi
call fcn.0044a320
pop edi
pop ebp
ret 4

Function at 0x4a7f20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
push edi
mov edi, ecx
lea ecx, [edi + 0x9c0]
jne 0x4a7f6b
imul eax, dword [ebp + 0xc], 0x3e8
push esi
add eax, dword [0x6db0a0]
mov dword [edi + 0x974], eax
call fcn.00469fa0
push str.ANRaster.tga
lea ecx, [edi + 0x9c0]
call fcn.00469f00
pop esi
push dword [ebp + 8]
mov ecx, edi
call fcn.0044a320
pop edi
pop ebp
ret 8
call fcn.00469fa0
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
mov ecx, edi
call fcn.0044a320
pop edi
pop ebp
ret 8
Function at 0x4c0a10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a87a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004c09b0
xorps xmm0, xmm0
mov dword [edi], vtable.CItem.0
lea esi, [edi + 0xa10]
mov dword [ebp - 4], 0
movdqu xmmword [edi + 0x9e4], xmm0
mov ecx, esi
movdqu xmmword [edi + 0x9f5], xmm0
call fcn.0044e4b0
lea ecx, [edi + 0xa30]
mov byte [ebp - 4], 1
call fcn.0044e4b0
lea ecx, [edi + 0xa50]
mov byte [ebp - 4], 2
call fcn.0044e4b0
push fcn.0044e4e0
push fcn.0044e4b0
push 0x16
push 0x20
add edi, 0xa78
mov byte [ebp - 4], 3
push edi
call fcn.005864e4
mov ecx, dword [ebp - 0x10]
mov eax, 0x83
mov byte [ebp - 4], 4
mov word [ecx + 0xc], ax
mov eax, dword [ebp + 8]
mov dword [ecx + 0xd3c], 0
movdqu xmm0, xmmword [eax]
movdqu xmmword [ecx + 0x9c4], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [ecx + 0x9d4], xmm0
movdqu xmm0, xmmword [eax + 0x20]
movdqu xmmword [ecx + 0x9e4], xmm0
movdqu xmm0, xmmword [eax + 0x30]
movdqu xmmword [ecx + 0x9f4], xmm0
mov ax, word [eax + 0x40]
mov word [ecx + 0xa04], ax
xor eax, eax
push eax
push esi
mov dword [ecx + 0xa08], 0
mov word [ecx + 0xa06], ax
mov dword [ecx + 0xa0c], eax
mov ecx, 0x6d38a0
push 0x7f
call fcn.004583a0
mov eax, dword [ebp - 0x10]
xor esi, esi
mov dword [eax + 0xa70], 0xfafa00
mov dword [eax + 0xa74], 0xffffff
mov dword [eax + 0xd38], 0
push 8
push edi
lea eax, [esi + 0x6c]
mov ecx, 0x6d38a0
push eax
call fcn.004583a0
inc esi
add edi, 0x20
cmp esi, 0x16
jl 0x4c0b43
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c63a0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
push ebx
mov ebx, ecx
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp dword [ebx + 0xc8], 0
jne 0x4c63c1
mov dword [ebx + 0xc8], eax
sub eax, dword [ebx + 0xc8]
cmp eax, 0x1388
jbe 0x4c64f0
mov ecx, dword [ebx + 0xa4]
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0xb8], eax
test ecx, ecx
jle 0x4c6405
jmp 0x4c63f0
mov eax, dword [ebx + 0xb8]
test eax, eax
je 0x4c6402
mov eax, dword [eax]
mov dword [ebx + 0xb8], eax
dec ecx
jne 0x4c63f0
lea eax, [ebp - 0x350]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x350]
dec ecx
mov edi, edi
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4c6420
mov eax, dword [str.Resource.bin]
mov dword [ecx], eax
mov eax, dword [0x5a1b88]
mov dword [ecx + 4], eax
mov eax, dword [0x5a1b8c]
mov dword [ecx + 8], eax
mov eax, dword [0x5a1b90]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.004c6330
test eax, eax
je 0x4c64ce
mov ax, word [0x5a1b9c]
movq xmm0, qword [str.Resource_]
mov word [ebp - 0x104], ax
mov al, byte [0x5a1b9e]
mov byte [ebp - 0x102], al
lea eax, [ebp - 0x220]
movq qword [ebp - 0x10c], xmm0
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c64a8
lea edi, [ebp - 0x10c]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4c64b8
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4c6462
call dword [sym.imp.WINMM.dll_timeGetTime]
pop edi
mov dword [ebx + 0xc8], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e82c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e830d
push 0
lea eax, [ebp + 8]
push eax
push 0x6c0
lea eax, [edi + 0x6c4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4e8315
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push 0
lea eax, [ebp + 8]
push eax
push 0x1c0
lea eax, [edi + 0xf44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
je 0x4e8307
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x4e9cc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4e9d13
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4e9d1b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 8], 0x71208
jne 0x4e9d0c
push 0
lea eax, [ebp - 4]
push eax
push 0xb0
lea eax, [ebx + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e9d0c
cmp dword [ebp - 4], 0xb0
push esi
ja 0x4e9d0d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e9de0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4e9e45
push 0
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x71208
push eax
push 4
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 0xb0
lea eax, [ebx + 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x504c70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b8c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
push 0x3d
push eax
mov word [esi + 0xfc], ax
mov dword [esi + 0x104], eax
mov byte [esi + 0x108], al
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea eax, [esi + 0x38]
push eax
mov dword [esi], vtable.COBalloonName.0
mov dword [esi + 0x78], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x7c], 0xffffff
mov dword [esi + 0x84], 0xffffff
call sub.MSVCR120.dll_memset
xorps xmm0, xmm0
movdqu xmmword [esi + 0x88], xmm0
mov byte [esi + 0x98], 0
movdqu xmmword [esi + 0x99], xmm0
push 0x810
movdqu xmmword [esi + 0xa9], xmm0
mov byte [esi + 0xb9], 0
movdqu xmmword [esi + 0xba], xmm0
movdqu xmmword [esi + 0xca], xmm0
mov byte [esi + 0xda], 0
movdqu xmmword [esi + 0xdb], xmm0
movdqu xmmword [esi + 0xeb], xmm0
mov byte [esi + 0xfb], 0
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x504d9c
mov ecx, eax
call fcn.004521d0
jmp 0x504d9e
xor eax, eax
mov dword [esi + 0x110], eax
xorps xmm0, xmm0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x118], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x120], 0
movdqu xmmword [esi + 0x15c], xmm0
push 0x20
movdqu xmmword [esi + 0x16c], xmm0
mov byte [esi + 0x17c], 0
movdqu xmmword [esi + 0x130], xmm0
mov dword [ebp - 4], 0xffffffff
movdqu xmmword [esi + 0x140], xmm0
mov byte [esi + 0x150], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x154], 0
mov dword [esi + 0x158], 0
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x504e57
mov ecx, eax
call fcn.0044e4b0
jmp 0x504e59
xor eax, eax
mov dword [esi + 0x180], eax
xorps xmm0, xmm0
mov dword [esi + 0x1a4], 0
mov eax, esi
mov dword [esi + 0x1a8], 0
movdqu xmmword [esi + 0x1b4], xmm0
mov ecx, dword [ebp - 0xc]
movdqu xmmword [esi + 0x1c4], xmm0
mov byte [esi + 0x1d4], 0
mov dword [esi + 0x1ac], 0
mov dword [esi + 0x1b0], 0
mov dword [esi + 0x1d8], 0
mov dword [esi + 0x1dc], 0
mov dword [esi + 0x184], 0
mov dword [esi + 0x188], 0
mov dword [esi + 0x18c], 0
mov dword [esi + 0x190], 0
mov dword [esi + 0x194], 0
mov dword [esi + 0x198], 0
mov dword [esi + 0x19c], 0
mov dword [esi + 0x1a0], 0
mov dword [esi + 4], 0
movdqu xmmword [esi + 0x1e8], xmm0
mov byte [esi + 0x1f8], 0
mov dword [esi + 0x1e0], 0
mov dword [esi + 0x1e4], 0
movdqu xmmword [esi + 0x204], xmm0
mov byte [esi + 0x214], 0
mov dword [esi + 0x1fc], 0
mov dword [esi + 0x200], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x50ac70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58c2db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CNewbieGuide.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
push 0x60
mov dword [ebp - 4], 0
call fcn.0047ae10
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x50d960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b6c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CPKManager.0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x40]
mov dword [ebp - 4], 0
call fcn.00401000
push 3
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], 0xea60
call fcn.0047ae10
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x511140
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x51121b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
push 0
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push esi
call edi
test eax, eax
je 0x5111b5
cmp dword [ebp - 0xc], 0x6111101
jne 0x5111b5
push 0
lea eax, [ebp + 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push esi
call edi
test eax, eax
je 0x5111b5
movzx eax, byte [0x706bc0]
cmp dword [ebp - 4], eax
je 0x5111c4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [ebp + 8]
push eax
push 0x120
lea eax, [ebp - 0x12c]
push eax
push esi
call edi
push esi
test eax, eax
je 0x5111b6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x829
mov ecx, 0x6d3af8
call fcn.004666e0
mov edi, dword [ebp - 0x48]
mov esi, eax
push edi
push dword [ebp - 0x4c]
lea ecx, [esi + 0x93c]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00510a80
test eax, eax
je 0x51121a
mov eax, dword [esi]
mov ecx, esi
push edi
push dword [ebp - 0x4c]
call dword [eax + 0x24]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x511300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x5113bc
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x511356
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp + 8], 0x6060801
jne 0x511347
push 0
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x511348
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx + 0x1c], 0
je 0x5113bc
mov ecx, dword [0x6d9f74]
test ecx, ecx
je 0x5113bc
push dword [ebp - 0xc]
call fcn.004b5bd0
push dword [ebp - 0x10]
mov ecx, dword [0x6d9f74]
call fcn.004b5bb0
movss xmm0, dword [ebp - 8]
push 0
push ecx
movss dword [esp], xmm0
mov ecx, 0x7092d0
push 0
call fcn.00553d00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5118b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov ecx, 0x6d3af8
push 0x829
call fcn.004666e0
test eax, eax
je 0x5118e2
cvttss2si ecx, dword [eax + 0x898]
mov dword [ebp - 0x4c], ecx
cvttss2si eax, dword [eax + 0x89c]
mov dword [ebp - 0x48], eax
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x511958
movzx ecx, byte [0x706bc0]
lea eax, [ebp - 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push eax
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x6111101
push eax
push edi
mov dword [ebp - 0xc], ecx
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 0x120
lea eax, [ebp - 0x12c]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x511960
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
test ebx, ebx
je 0x511a8d
push esi
push 0
mov ecx, 0x709b18
call fcn.0055f4c0
push eax
lea eax, [ebp - 0x104]
push str._sData
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x104]
add esp, 0xc
push 0
push eax
call esi
push dword [edi + 0x18]
mov ecx, 0x709b18
push 0
call fcn.0055f4c0
push eax
lea eax, [ebp - 0x104]
push str._sData_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push eax
call esi
test bl, 1
je 0x511a1a
mov eax, dword [edi + 0x18]
mov ecx, 0x709b18
push eax
push eax
push 0
call fcn.0055f4c0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x104]
push str._sData_d_d.UII
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
call fcn.005113d0
jmp 0x511a20
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
test bl, 2
je 0x511a56
mov eax, dword [edi + 0x18]
mov ecx, 0x709b18
push eax
push eax
push 0
call fcn.0055f4c0
push eax
lea eax, [ebp - 0x104]
push str._sData_d_d.UIS
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
call fcn.00511aa0
test bl, 4
je 0x511a8c
mov eax, dword [edi + 0x18]
mov ecx, 0x709b18
push eax
push eax
push 0
call fcn.0055f4c0
push eax
lea eax, [ebp - 0x104]
push str._sData_d_d.UIR
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
call fcn.005118b0
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4