joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ee60
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push 0x8000
call fcn.0046e7b0
push eax
call fcn.005829fb
add esp, 8
cmp eax, 0xffffffff
mov dword [esi + 0xae00], eax
jne 0x46ee87
xor eax, eax
pop esi
ret 8
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
push eax
call fcn.0057eb00
mov dword [esi + 4], eax
mov eax, dword [esi + 0xae00]
push eax
call fcn.0057e83c
add esp, 0x10
mov eax, 1
pop esi
ret 8

Function at 0x46ef20
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, 0xf01790
lea edi, [esi + 0x9ee8]
push edi
push 0
push 0x50
call fcn.0046c680
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0xac]
push edi
lea eax, [eax + eax*8]
lea ecx, [esi + eax*8]
lea edx, [eax + ecx + 0x9ee8]
mov ecx, 0xf01790
push edx
call fcn.0046cd20
mov edi, dword [esi + 0xac]
push 0x8000
mov ecx, esi
mov dword [esi + 0xac], 0
call fcn.0046e7b0
push eax
call fcn.005829fb
add esp, 8
cmp eax, 0xffffffff
mov dword [esi + 0xae00], eax
mov dword [esi + 0xac], edi
jne 0x46ef9a
pop edi
xor eax, eax
pop esi
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
push eax
call fcn.0057eb00
mov dword [esi + 4], eax
mov eax, dword [esi + 0xae00]
push eax
call fcn.0057e83c
add esp, 0x10
mov eax, 1
pop edi
pop esi
ret 0xc

Function at 0x46efd0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, 0xf01790
lea edi, [esi + 0x9ee8]
push edi
push 0
push 0x50
call fcn.0046c680
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0xac]
push edi
lea eax, [eax + eax*8]
lea ecx, [esi + eax*8]
lea edx, [eax + ecx + 0x9ee8]
mov ecx, 0xf01790
push edx
call fcn.0046cd20
mov edi, dword [esi + 0xac]
push 0x8000
mov ecx, esi
mov dword [esi + 0xac], 0
call fcn.0046e7b0
push eax
call fcn.005829fb
add esp, 8
cmp eax, 0xffffffff
mov dword [esi + 0xae00], eax
mov dword [esi + 0xac], edi
jne 0x46f04a
pop edi
xor eax, eax
pop esi
ret 0xc
mov ecx, dword [esi + 4]
push 0
push ecx
push eax
call fcn.0057f1fb
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0xae00]
push edx
push eax
push ecx
call fcn.0057eb00
mov edx, dword [esi + 4]
add edx, eax
mov dword [esi + 4], edx
mov edx, dword [esi + 0xae00]
push edx
call fcn.0057e83c
add esp, 0x1c
mov eax, 1
pop edi
pop esi
ret 0xc

Function at 0x46f220
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x400
push esi
push edi
push 0x8000
xor edi, edi
call fcn.0046e7b0
push eax
call fcn.005829fb
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x46f24f
pop edi
or eax, eax
pop esi
add esp, 0x400
ret
lea eax, [esp + 8]
push 0x400
push eax
push esi
call fcn.0057eb00
add esp, 0xc
xor ecx, ecx
test eax, eax
jle 0x46f276
movsx edx, byte [esp + ecx + 8]
add edi, edx
inc ecx
cmp ecx, eax
jl 0x46f268
test eax, eax
jne 0x46f24f
push esi
call fcn.0057e83c
add esp, 4
mov eax, edi
pop edi
pop esi
add esp, 0x400
ret
Function at 0x46f290
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x400
push esi
push edi
push 0x8000
push eax
xor edi, edi
call fcn.005829fb
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x46f2c0
pop edi
or eax, eax
pop esi
add esp, 0x400
ret 4
lea ecx, [esp + 8]
push 0x400
push ecx
push esi
call fcn.0057eb00
add esp, 0xc
xor ecx, ecx
test eax, eax
jle 0x46f2e7
movsx edx, byte [esp + ecx + 8]
add edi, edx
inc ecx
cmp ecx, eax
jl 0x46f2d9
test eax, eax
jne 0x46f2c0
push esi
call fcn.0057e83c
add esp, 4
mov eax, edi
pop edi
pop esi
add esp, 0x400
ret 4

Function at 0x46f4a0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x8000
mov ecx, 0x1765bd0
call fcn.0046e7b0
push eax
call fcn.005829fb
mov edi, eax
lea eax, [esi + 0x43c]
push 0xe
push eax
push edi
mov dword [esp + 0x24], edi
call fcn.0057eb00
lea ecx, [esi + 0x44c]
push 0x28
push ecx
push edi
call fcn.0057eb00
mov eax, dword [esi + 0x450]
mov edx, dword [esi + 0x454]
xor ecx, ecx
mov edi, eax
mov cx, word [esi + 0x45a]
add esp, 0x20
and edi, 0x80000003
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov dword [esi + 0x14], ecx
jns 0x46f51d
dec edi
or edi, 0xfffffffc
inc edi
lea ebx, [eax + eax*2]
lea ebp, [eax*4]
add ebx, edi
lea edi, [eax + eax]
cmp ecx, 8
mov dword [esi + 0x430], ebx
mov dword [esi + 0x434], edi
mov dword [esi + 0x438], eax
mov dword [esi + 0x42c], ebp
jne 0x46f551
imul edx, eax
mov dword [esi + 0x10], edx
jmp 0x46f57f
cmp ecx, 0x10
jne 0x46f55e
imul edi, edx
mov dword [esi + 0x10], edi
jmp 0x46f57f
cmp ecx, 0x18
jne 0x46f56b
imul ebx, edx
mov dword [esi + 0x10], ebx
jmp 0x46f57f
cmp ecx, 0x20
jne 0x46f578
imul ebp, edx
mov dword [esi + 0x10], ebp
jmp 0x46f57f
mov dword [esi + 0x10], 0
mov edx, dword [esp + 0x10]
push edx
call fcn.0057e83c
mov eax, dword [esi + 0x14]
add esp, 4
cmp eax, 8
jne 0x46f605
mov eax, dword [esi + 0x446]
cmp eax, 0x3e8
jbe 0x46f5ad
mov dword [esi + 0x41c], 0x400
jmp 0x46f5b7
mov dword [esi + 0x41c], 0x300
mov edi, dword [esi + 0x41c]
push 0x8000
sub eax, edi
mov ecx, 0x1765bd0
mov dword [esi + 0x420], eax
call fcn.0046e7b0
push eax
call fcn.005829fb
mov edi, eax
mov eax, dword [esi + 0x420]
push 0
push eax
push edi
call fcn.0057f1fb
mov ecx, dword [esi + 0x41c]
add esi, 0x1c
push ecx
push esi
push edi
call fcn.0057eb00
push edi
call fcn.0057e83c
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x46f610
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push eax
call fcn.0057a50e
add esp, 4
mov dword [esi + 0x474], eax
test eax, eax
je 0x46f6e7
mov ecx, dword [esp + 8]
push edi
mov dword [esi + 0x478], ecx
push 0x8000
mov ecx, 0x1765bd0
mov dword [esi + 0x47c], 0
call fcn.0046e7b0
push eax
call fcn.005829fb
mov edx, dword [esi + 0x446]
mov edi, eax
push 0
push edx
push edi
call fcn.0057f1fb
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x474]
push eax
push ecx
push edi
call fcn.0057eb00
push edi
call fcn.0057e83c
mov eax, dword [esi + 0x14]
add esp, 0x24
cmp eax, 8
pop edi
jne 0x46f692
mov ecx, esi
call fcn.0046f980
mov eax, 1
mov dword [esi + 0x424], eax
mov dword [esi + 0x428], eax
mov eax, dword [esi + 0x14]
cmp eax, 0x18
jne 0x46f6b6
push 0
mov ecx, esi
call fcn.0046f6f0
jmp 0x46f6c4
cmp eax, 8
jne 0x46f6c4
push 0
mov ecx, esi
call fcn.0046f830
mov edx, dword [esi + 0x474]
push edx
call fcn.0057a29c
add esp, 4
mov dword [esi + 0x474], 0
mov dword [esi + 0x478], 0
pop esi
ret 4
Function at 0x470cd0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ebp, dword [esi + 0x20]
push 0x1e8480
mov dword [esi + 0x20], ebx
call fcn.0057a50e
add esp, 4
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x470e89
push 0x8000
mov ecx, 0x1765bd0
call fcn.0046e7b0
push eax
call fcn.005829fb
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x470e7a
lea ebx, [esi + 0x14]
push 4
push ebx
push edi
call fcn.0057eb00
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
jge 0x470d61
lea ecx, [esp + 0x10]
push 4
push ecx
push edi
call fcn.0057eb00
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x470d55
push 1
push eax
push edi
call fcn.0057f1fb
add esp, 0xc
jmp 0x470d2f
push 4
push ebx
push edi
call fcn.0057eb00
add esp, 0xc
mov ebx, dword [ebx]
cmp ebx, 0x7f4
jne 0x470d89
lea edx, [esi + 0xbfc]
push 0x7f0
push edx
push edi
call fcn.0057eb00
add esp, 0xc
mov ecx, esi
call fcn.00470ea0
jmp 0x470d9a
add ebx, 0xfffffffc
lea eax, [esi + 0x24]
push ebx
push eax
push edi
call fcn.0057eb00
add esp, 0xc
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x10]
push ecx
push edx
push edi
call fcn.0057eb00
push edi
call fcn.0057e83c
mov eax, dword [esi + 0x2c]
xor ebx, ebx
add esp, 0x10
cmp ebp, ebx
mov dword [esi + 4], eax
je 0x470dc4
push 0x32
call ebp
add esp, 4
mov eax, dword [esi + 0x28]
mov ebp, dword [esp + 0x18]
cmp eax, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x24], ebx
jle 0x470e7a
mov eax, dword [esi + 0xc]
mov edi, ebp
cmp eax, 0x96
jge 0x470e0b
mov ecx, dword [edi]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 8]
cmp ecx, ebx
mov dword [esi + 0x1c], edx
jbe 0x470e0b
movsx ecx, word [edi + 0xe]
cmp dword [esi + eax*4 + 0x4f0], ecx
je 0x470e0b
add edi, 0x10
cmp eax, 0x96
jl 0x470de5
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jbe 0x470e66
movsx edx, word [edi + 0xe]
cmp edx, dword [esp + 0x1c]
jne 0x470e66
cmp dword [edi + 4], ebx
jne 0x470e66
cmp dword [esi + eax*4 + 0x748], ebx
je 0x470e49
cmp dword [esi + 8], ebx
jne 0x470e49
mov eax, dword [esi + eax*4 + 0x9a0]
mov edx, dword [esi + 0x10]
add eax, edx
push ecx
push eax
mov ecx, 0x1d9d5e0
call fcn.00471590
jmp 0x470e66
mov edi, dword [esi + 0x10]
mov edx, dword [esi + eax*4 + 0x40]
push ecx
mov ecx, dword [esi + eax*4 + 0x9a0]
add ecx, edi
push ecx
push edx
mov ecx, 0xf01790
call fcn.0046c5d0
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x28]
inc edx
mov eax, edx
mov dword [esi + 0xc], edx
cmp eax, ecx
jl 0x470dd9
mov eax, dword [esi + 0x10]
push eax
call fcn.0057a29c
add esp, 4
mov dword [esi + 0x10], ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x471330
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xcc
push esi
push edi
push 0x8000
mov esi, ecx
push eax
call fcn.005829fb
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x471360
pop edi
xor eax, eax
pop esi
add esp, 0xcc
ret 8
push 0x1e8480
call fcn.0057a50e
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
jne 0x47137f
pop edi
pop esi
add esp, 0xcc
ret 8
push ebx
push ebp
lea ebx, [esi + 0x14]
push 4
push ebx
push edi
mov ebp, 1
call fcn.0057eb00
mov ebx, dword [ebx]
add esp, 0xc
cmp ebx, 0x7f4
jne 0x4713bd
lea ecx, [esi + 0xbfc]
push 0x7f0
push ecx
push edi
call fcn.0057eb00
add esp, 0xc
mov ecx, esi
call fcn.00470ea0
jmp 0x4713ce
add ebx, 0xfffffffc
lea edx, [esi + 0x24]
push ebx
push edx
push edi
call fcn.0057eb00
add esp, 0xc
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x10]
push eax
push ecx
push edi
call fcn.0057eb00
push edi
call fcn.0057e83c
mov eax, dword [esp + 0xf0]
mov edx, dword [esi + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x28]
xor ebx, ebx
add esp, 0x10
cmp eax, ebx
mov dword [esi + 4], edx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x24], ebx
jle 0x4714e5
mov eax, dword [esi + 0xc]
mov edi, dword [esp + 0x10]
cmp eax, 0x96
jge 0x47143d
mov ecx, dword [edi]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 8]
cmp ecx, ebx
mov dword [esi + 0x1c], edx
jbe 0x47143d
movsx ecx, word [edi + 0xe]
cmp dword [esi + eax*4 + 0x4f0], ecx
je 0x47143d
add edi, 0x10
cmp eax, 0x96
jl 0x471417
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jbe 0x4714cf
cmp dword [edi + 4], ebx
jne 0x4714d1
cmp dword [esi + eax*4 + 0x748], ebx
je 0x47148f
cmp dword [esi + 8], ebx
jne 0x47148f
mov edx, dword [esi + eax*4 + 0x9a0]
push ecx
mov ecx, dword [esi + 0x10]
add edx, ecx
mov ecx, 0x1d9d5e0
push edx
call fcn.00471590
mov eax, dword [esi + 0xc]
mov ecx, dword [edi + 8]
cmp ecx, dword [esi + eax*4 + 0x40]
jge 0x4714d1
movsx edx, word [edi + 0xe]
push edx
push str.Err:cmp__d
jmp 0x4714c2
mov edx, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + eax*4 + 0x9a0]
add ecx, edx
mov edx, dword [esi + eax*4 + 0x40]
push ecx
push edx
mov ecx, 0xf01790
call fcn.0046c5d0
mov eax, dword [esi + 0xc]
mov ecx, dword [edi + 8]
cmp ecx, dword [esi + eax*4 + 0x40]
jge 0x4714d1
movsx edx, word [edi + 0xe]
push edx
push str.Err:raw__d
lea eax, [esp + 0x1c]
push eax
call fcn.0057a24a
add esp, 0xc
xor ebp, ebp
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x28]
inc edx
mov eax, edx
mov dword [esi + 0xc], edx
cmp eax, ecx
jl 0x471409
mov ecx, dword [esi + 0x10]
push ecx
call fcn.0057a29c
add esp, 4
mov eax, ebp
mov dword [esi + 0x10], ebx
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xcc
ret 8
Function at 0x473740
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x473991
mov eax, dword [esi + 4]
test eax, eax
je 0x473991
mov eax, dword [esi + 0x170]
push eax
call dword [sym.imp.mss32.dll__AIL_sample_buffer_ready_4]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x473991
mov ecx, dword [esi + 0x184]
mov edx, dword [esi + ebp*4 + 0x17c]
mov eax, dword [esi + 0x174]
push ecx
push edx
push eax
call fcn.0057eb00
mov ebx, eax
mov eax, dword [esi + 0x184]
add esp, 0xc
cmp eax, ebx
je 0x47397a
mov ecx, esi
call fcn.00475370
mov ecx, dword [0xd16a1c]
cmp ecx, 0x32
je 0x4737be
cmp ecx, 0x33
je 0x4737be
cmp ecx, 0x1c
jne 0x4737eb
mov eax, dword [esi + 0x3274]
cmp eax, 0x32
jne 0x4737d2
mov ecx, dword [str.fxmusic_flt_07.raw]
push ecx
jmp 0x4737de
cmp eax, 0x48
jne 0x4737eb
mov edx, dword [str.fxmusic_flt_04.raw]
push edx
mov ecx, esi
call fcn.00473620
mov ecx, dword [0xd16a1c]
cmp ecx, 0x2d
jne 0x4737f7
mov ecx, esi
call fcn.00475320
mov eax, dword [esi + 0x3274]
cmp eax, 0x49
jl 0x4738d3
cmp eax, 0x61
jl 0x473872
mov eax, dword [0x8f19f0]
test eax, eax
jle 0x4738d3
xor edi, edi
mov ecx, 0xef7aa8
call fcn.0046c5a0
movsx eax, word [0xef7aa8]
cdq
mov ecx, 0x13
idiv ecx
cmp edx, dword [0x8f19e8]
jne 0x473841
inc edi
cmp edi, 0x10
jl 0x47381a
mov dword [0x8f19e8], edx
mov edx, dword [edx*8 + 0x6605f8]
push edx
mov ecx, esi
call fcn.00473620
mov eax, dword [0x8f19f0]
dec eax
cmp eax, 3
mov dword [0x8f19f0], eax
jle 0x4738d3
mov dword [0x8f19f0], 0
jmp 0x4738d3
mov eax, dword [0x8f19c0]
test eax, eax
jle 0x4738d3
xor edi, edi
mov ecx, 0xef7aa8
call fcn.0046c5a0
movsx eax, word [0xef7aa8]
cdq
mov ecx, 0x18
idiv ecx
cmp edx, dword [0x8f19f8]
jne 0x4738a4
inc edi
cmp edi, 0x10
jl 0x47387d
mov dword [0x8f19f8], edx
mov edx, dword [edx*8 + 0x660538]
push edx
mov ecx, esi
call fcn.00473620
mov eax, dword [0x8f19c0]
dec eax
cmp eax, 3
mov dword [0x8f19c0], eax
jle 0x4738d3
mov dword [0x8f19c0], 0
mov eax, dword [esi + 0x178]
or edi, 0xffffffff
cmp eax, edi
je 0x47391c
mov eax, dword [esi + 0x174]
push eax
call fcn.0057e83c
mov ecx, dword [esi + 0x178]
mov edx, dword [esi + 0x184]
mov dword [esi + 0x174], ecx
mov dword [esi + 0x178], edi
mov eax, dword [esi + ebp*4 + 0x17c]
sub edx, ebx
add eax, ebx
push edx
push eax
push ecx
call fcn.0057eb00
add esp, 0x10
jmp 0x473978
mov eax, dword [esi + 0x34]
and eax, 0xffff
cmp eax, 1
jne 0x473944
xor edi, edi
mov ecx, esi
push edi
call fcn.004730e0
mov dword [esi + 0x154], edi
mov dword [esi + 0x3274], edi
pop edi
pop esi
pop ebp
pop ebx
ret
test eax, eax
jne 0x47397a
mov edx, dword [esi + 0x174]
push eax
push eax
push edx
call fcn.0057f1fb
mov eax, dword [esi + 0x184]
mov ecx, dword [esi + ebp*4 + 0x17c]
mov edx, dword [esi + 0x174]
sub eax, ebx
add ecx, ebx
push eax
push ecx
push edx
call fcn.0057eb00
add esp, 0x18
add ebx, eax
mov eax, dword [esi + ebp*4 + 0x17c]
mov ecx, dword [esi + 0x170]
push ebx
push eax
push ebp
push ecx
call dword [sym.imp.mss32.dll__AIL_load_sample_buffer_16]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x477ba0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1e0
mov eax, 0x1683fc4
push ebx
push esi
mov ebx, ecx
xor esi, esi
mov dword [eax + 0x28], esi
mov dword [eax], esi
add eax, 4
cmp eax, 0x1683fec
jl 0x477bb1
mov dword [ebx + 0x698], esi
mov ecx, 0x1683fb8
mov dword [0x1683fbc], esi
mov dword [0x1683fc0], esi
mov dword [0x1684018], esi
mov dword [0x168401c], esi
call fcn.00476b30
mov ecx, 0x1683fb8
call fcn.00477990
xor eax, eax
lea ecx, [esp + 0x58]
mov dword [ebx + 0x780], eax
push ecx
push 0x101
mov dword [ebx + 0x784], eax
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x477c6e
push ebp
lea edx, [esp + 0xc]
push 0x50
push edx
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x477c68
lea eax, [esp + 0xc]
push eax
call sub.WSOCK32.dll_gethostbyname
cmp eax, esi
je 0x477c68
mov ecx, dword [eax + 0xc]
cmp dword [ecx], esi
je 0x477c68
xor ecx, ecx
lea edx, [ebx + 0x788]
cmp ecx, 8
jge 0x477c68
mov dword [edx - 8], 1
mov ebp, dword [eax + 0xc]
add edx, 4
mov ebp, dword [ecx + ebp]
add ecx, 4
mov ebp, dword [ebp]
mov dword [edx - 4], ebp
mov ebp, dword [eax + 0xc]
cmp dword [ecx + ebp], esi
jne 0x477c42
call sub.WSOCK32.dll_WSACleanup
pop ebp
mov ecx, 0x1683fb8
call fcn.004787f0
lea eax, [ebx + 0x52c78]
mov ecx, 9
mov dword [eax - 4], esi
mov dword [eax], esi
add eax, 0x24
dec ecx
jne 0x477c83
pop esi
pop ebx
add esp, 0x1e0
ret
Function at 0x4785c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x20019
mov ebp, ecx
push 0
push str.SoftwareGameSpyGameSpy_Arcade
push reloc.DPLAYX.dll_Ordinal_1
mov dword [esp + 0x28], 0x200
mov dword [ebp + 0x510], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x478704
lea ecx, [esp + 0x14]
lea ebx, [ebp + 0x2b9]
push ecx
lea edx, [esp + 0x20]
push ebx
push edx
push eax
mov eax, dword [esp + 0x20]
push str.InstDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x478704
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebp + 0x2b8], 0x5c
je 0x478676
mov edi, 0x66160c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.aphex.exe
or ecx, 0xffffffff
xor eax, eax
push 0x64ece0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0057a7c4
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x478704
lea edx, [ebp + 0x2b8]
mov edi, str.__svc_strongholdc
or ecx, 0xffffffff
xor eax, eax
mov byte [edx], 0x22
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov dword [esp + 0x1c], eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x1c]
dec edi
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 0x510], 1
call fcn.0057a3d0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x479090
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov eax, 1
mov dword [esi + 0x618], eax
mov dword [0xd16b0c], 0
mov dword [0xd17374], 0
mov ecx, dword [esi + 0x790]
test ecx, ecx
je 0x4790c4
mov dword [esi + 0x798], eax
pop esi
ret
push edi
push 2
mov ecx, esi
mov dword [esi + 0x798], 0
call fcn.0047f6e0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [esi + 0xe1c14], eax
call edi
sub eax, dword [esi + 0xe1c14]
cmp eax, 0x4e20
jae 0x479115
mov eax, dword [esi + 0x798]
test eax, eax
jne 0x479115
mov ecx, esi
call fcn.004796e0
call edi
sub eax, dword [esi + 0xe1c14]
cmp eax, 0x4e20
jb 0x4790f5
mov eax, dword [esi + 0x798]
pop edi
test eax, eax
jne 0x47914a
mov ecx, esi
call fcn.00477ca0
mov ecx, esi
call fcn.00477ba0
push 0
push 0x13
mov ecx, 0xd16a10
call fcn.0046d170
push 0
push 0x11
mov ecx, 0xfb78d8
call fcn.0049e8c0
pop esi
ret
Function at 0x4ca890
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [0x1a464b8]
push ebp
mov ebp, 1
cmp eax, ebp
jle 0x4cab40
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, 0x1a468c2
mov ax, word [esi - 2]
test ax, ax
je 0x4cab29
cmp ax, 3
je 0x4cab29
movsx eax, word [esi + 4]
cmp eax, ebx
jne 0x4cab29
cmp edi, 1
jne 0x4ca99b
mov ax, word [esi]
cmp ax, 0x5b
je 0x4cab10
cmp ax, 0x5c
je 0x4cab10
cmp ax, 0x5d
je 0x4cab10
cmp ax, 0x5e
je 0x4cab10
cmp ax, 0x5f
je 0x4cab10
cmp ax, 0x60
je 0x4cab10
cmp ax, 0x61
je 0x4cab10
cmp ax, 0x62
je 0x4cab10
cmp ax, 0x63
je 0x4cab10
cmp ax, 0x64
je 0x4cab10
cmp ax, 0x65
je 0x4cab10
cmp ax, 0x67
je 0x4cab10
cmp ax, 0x68
je 0x4cab10
cmp ax, 0x3e
je 0x4cab10
cmp ax, 0x3f
je 0x4cab10
cmp ax, 0x40
je 0x4cab10
cmp ax, 0x41
je 0x4cab10
cmp ax, 0x42
jne 0x4cab29
jmp 0x4cab10
cmp edi, 2
jne 0x4caa0c
mov ax, word [esi]
cmp ax, 0xc
je 0x4cab10
cmp ax, 0xd
je 0x4cab10
cmp ax, 0xe
je 0x4cab10
cmp ax, 0xf
je 0x4cab10
cmp ax, 0x10
je 0x4cab10
cmp ax, 0x16
je 0x4cab10
cmp ax, 0x17
je 0x4cab10
cmp ax, 0x24
je 0x4cab10
cmp ax, 0x25
je 0x4cab10
cmp ax, 0x26
jne 0x4cab29
jmp 0x4cab10
cmp edi, 3
jne 0x4caa87
mov ax, word [esi]
cmp ax, 0x2d
je 0x4cab10
cmp ax, 0x2e
je 0x4cab10
cmp ax, 0x31
je 0x4cab10
cmp ax, 0x4a
je 0x4cab10
cmp ax, 0x4b
je 0x4cab10
cmp ax, 0x4c
je 0x4cab10
cmp ax, 0x4d
je 0x4cab10
cmp ax, 0x4e
je 0x4cab10
cmp ax, 0x18
je 0x4cab10
cmp ax, 0x19
je 0x4cab10
cmp ax, 0x1c
jne 0x4cab29
jmp 0x4cab10
cmp edi, 4
jne 0x4caaa7
mov ax, word [esi]
cmp ax, 8
je 0x4cab10
cmp ax, 9
je 0x4cab10
cmp ax, 0x23
jne 0x4cab29
jmp 0x4cab10
cmp edi, 5
jne 0x4caabd
mov ax, word [esi]
cmp ax, 0x1b
je 0x4cab10
cmp ax, 0x46
jne 0x4cab29
jmp 0x4cab10
cmp edi, 6
jne 0x4caaf0
mov ax, word [esi]
cmp ax, 4
je 0x4cab10
cmp ax, 5
je 0x4cab10
cmp ax, di
je 0x4cab10
cmp ax, 0x11
je 0x4cab10
cmp ax, 0x12
je 0x4cab10
cmp ax, 0x14
je 0x4cab10
cmp ax, 0x22
jne 0x4cab29
jmp 0x4cab10
cmp edi, 7
jne 0x4cab10
mov ax, word [esi]
cmp ax, 0x1e
je 0x4cab10
cmp ax, 0x1f
je 0x4cab10
cmp ax, 0x20
je 0x4cab10
cmp ax, 0x21
jne 0x4cab29
push 0x32
push ebx
push ebp
mov ecx, 0x1a464b0
call fcn.0040ebc0
push ebp
mov ecx, 0x1a464b0
call fcn.0040b120
mov eax, dword [0x1a464b8]
inc ebp
add esi, 0x32c
cmp ebp, eax
jl 0x4ca8b3
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x580dcc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x580dec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00580a68
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x580e0d
test byte [esp + 8], 2
je 0x580e0d
mov dword [0x1d9d670], 0xd
mov dword [0x1d9d674], 5
jmp 0x580de8
xor eax, eax
ret
Function at 0x401b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x40dfe0]
test eax, eax
jle 0x401c03
mov edx, dword [0x40dfe4]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x401b31
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x401ba6
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x401b20
mov dword [esp], esi
call 0x4023e0
test eax, eax
mov edi, eax
je 0x401c2a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x40dfe4]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.004024d0
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x40dfe4]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c0a
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x401bb0
add dword [0x40dfe0], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x401b9f
cmp eax, 0x80
je 0x401b9f
cmp eax, 8
je 0x401b9f
mov eax, dword [ebp - 0x28]
add esi, dword [0x40dfe4]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401b9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401aa0
xor ebx, ebx
jmp 0x401b3b
mov eax, dword [0x40dfe4]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401aa0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401aa0
lea esi, [esi]