joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494ab0
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x6a8388
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x762dc0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, ecx
test ebx, ebx
je 0x494ae2
lea eax, [ebx + 4]
jmp 0x494ae4
xor eax, eax
push eax
push dword [esp + 0x48]
call fcn.00494d30
mov dword [ebx + 0x10], eax
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
lea esi, [eax*2 + 2]
cmp ecx, esi
je 0x494b31
mov edi, edx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
call fcn.0065cb97
push esi
call fcn.00467190
add esp, 8
test esi, esi
jne 0x494b1f
xor edx, edx
jmp 0x494b31
lea eax, [esi*4]
push eax
call fcn.00462360
add esp, 4
mov edx, eax
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x44]
add ecx, 3
mov dword [ebx + 0x1c], edx
shr ecx, 2
lea edx, [esp + 0x14]
cmp ecx, 1
mov dword [esp + 0x14], ecx
mov dword [esp + 0x44], 1
cmovae eax, edx
mov dword [ebx + 0x18], esi
mov ebp, dword [eax]
push ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], ebp
call fcn.00467190
add esp, 4
test ebp, ebp
jne 0x494b7a
xor edi, edi
mov dword [esp + 0x14], edi
jmp 0x494b90
lea eax, [ebp*4]
push eax
call fcn.00462360
add esp, 4
mov dword [esp + 0x14], eax
mov edi, eax
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x40]
lea esi, [ebp*4]
push eax
push dword [esp + 0x40]
mov dword [esp + 0x3c], 0
push esi
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x54], 4
call fcn.0065cbcf
mov eax, dword [esp + 0x50]
sub esi, eax
push esi
add eax, edi
push 0
push eax
call fcn.006593c0
add esp, 0x1c
lea edx, [esp + 0x44]
lea ecx, [esp + 0x18]
call fcn.0046bda0
mov eax, dword [ebx + 0x1c]
mov edx, 1
mov dword [eax], 0xb7e15163
cmp dword [ebx + 0x18], edx
jbe 0x494c09
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
inc edx
mov eax, dword [ecx - 4]
sub eax, 0x61c88647
mov dword [ecx], eax
cmp edx, dword [ebx + 0x18]
jb 0x494bf3
mov eax, dword [ebx + 0x18]
lea ecx, [esp + 0x1c]
xor esi, esi
mov dword [esp + 0x44], eax
cmp eax, ebp
mov dword [esp + 0x40], 0
lea edx, [esp + 0x44]
cmovae ecx, edx
mov eax, dword [ecx]
lea ecx, [eax + eax*2]
xor eax, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], eax
test ecx, ecx
je 0x494c85
lea ebx, [ebx]
xor edx, edx
div dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
lea ecx, [eax + edx*4]
xor edx, edx
mov eax, dword [ecx]
add eax, esi
add eax, dword [esp + 0x40]
rol eax, 3
mov dword [ecx], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x44]
div ebp
lea eax, [edi + edx*4]
mov edx, dword [esp + 0x40]
lea ecx, [esi + edx]
add esi, edx
add esi, dword [eax]
rol esi, cl
mov dword [eax], esi
mov eax, dword [esp + 0x44]
inc eax
mov dword [esp + 0x44], eax
cmp eax, dword [esp + 0x3c]
jb 0x494c40
push dword [esp + 0x14]
xor eax, eax
mov ecx, ebp
rep stosd dword es:[edi], eax
call fcn.0065cb97
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x494cb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [ecx + 0x18]
push ebp
mov edx, dword [eax + 4]
mov ebp, dword [ecx + 0xc]
push esi
mov esi, dword [ebx]
add esi, dword [eax]
mov eax, dword [ebx + 4]
push edi
add eax, edx
xor edi, edi
test ebp, ebp
je 0x494ce9
xor esi, eax
mov ecx, eax
rol esi, cl
add esi, dword [ebx + edi*8 + 8]
xor eax, esi
mov ecx, esi
rol eax, cl
add eax, dword [ebx + edi*8 + 0xc]
inc edi
cmp edi, ebp
jb 0x494cd0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x494cf5
mov edx, dword [ecx]
jmp 0x494cf7
xor edx, edx
xor edx, esi
mov esi, dword [esp + 0x1c]
mov dword [esi], edx
test ecx, ecx
je 0x494d18
add ecx, 4
test ecx, ecx
je 0x494d18
mov ecx, dword [ecx]
pop edi
xor ecx, eax
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
ret 0xc
xor ecx, ecx
pop edi
xor ecx, eax
mov dword [esi + 4], ecx
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x495310
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx + 0x118]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [ecx + 0x11c]
push edi
push ebx
push dword [esp + 0x1c]
lea edi, [eax*4]
mov dword [esp + 0x18], ebx
push edi
push esi
mov dword [esp + 0x2c], 4
call fcn.0065cbcf
sub edi, ebx
lea eax, [esi + ebx]
push edi
push 0
push eax
call fcn.006593c0
lea edx, [esp + 0x38]
lea ecx, [esp + 0x2c]
call fcn.0046bda0
push eax
mov edx, esi
mov ecx, esi
call fcn.0046dfe0
add esp, 0x20
mov dword [esp + 0x1c], 0
mov ecx, dword [esi + 4]
mov edx, ecx
mov edi, dword [esi + 0x38]
mov eax, ecx
ror edx, 0x12
shr ecx, 3
ror eax, 7
xor edx, eax
mov eax, edi
xor edx, ecx
ror eax, 0x11
mov ecx, edi
shr edi, 0xa
ror ecx, 0x13
xor ecx, eax
xor ecx, edi
add edx, ecx
mov ecx, dword [esp + 0x1c]
add edx, dword [esi + 0x24]
add edx, dword [esi]
mov dword [esi + 0x40], edx
mov eax, dword [ecx + 0x712510]
add ecx, 4
add dword [esi], eax
add esi, 4
mov dword [esp + 0x1c], ecx
cmp ecx, 0xc0
jb 0x495374
mov ecx, 0xc8
lea esp, [esp]
mov eax, dword [ecx + 0x712508]
lea esi, [esi + 0x10]
add dword [esi - 0x10], eax
mov eax, dword [ecx + 0x71250c]
add dword [esi - 0xc], eax
mov eax, dword [ecx + 0x712510]
add dword [esi - 8], eax
mov eax, dword [ecx + 0x712514]
add ecx, 0x10
add dword [esi - 4], eax
cmp ecx, 0x108
jb 0x4953d0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc

Function at 0x499ff0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x49b920
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0
mov byte [ebp - 0x24], 0x4e
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x52
mov byte [ebp - 0x21], 0x61
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x45
mov byte [ebp - 0x1c], 0x78
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
mov esp, 0
jmp dword [ebp - 0x28]
Function at 0x49bb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a882b
mov eax, dword fs:[0]
push eax
sub esp, 0xdbc
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x79
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x78
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0
lea eax, [ebp + 0xc]
mov dword [ebp - 0xd1c], eax
mov ecx, dword [ebp - 0xd1c]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
mov dword [ebp - 0xd1c], 0
push 0
call fcn.00498810
add esp, 4
mov dword [ebp - 0xd20], eax
lea ecx, [ebp - 0xd20]
push ecx
call fcn.004987f0
add esp, 4
mov ecx, 9
mov esi, eax
lea edi, [ebp - 0xd18]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x40], 0x25
mov byte [ebp - 0x3f], 0x30
mov byte [ebp - 0x3e], 0x32
mov byte [ebp - 0x3d], 0x64
mov byte [ebp - 0x3c], 0x3a
mov byte [ebp - 0x3b], 0x25
mov byte [ebp - 0x3a], 0x30
mov byte [ebp - 0x39], 0x32
mov byte [ebp - 0x38], 0x64
mov byte [ebp - 0x37], 0x3a
mov byte [ebp - 0x36], 0x25
mov byte [ebp - 0x35], 0x30
mov byte [ebp - 0x34], 0x32
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x20
mov byte [ebp - 0x31], 0x2d
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x25
mov byte [ebp - 0x2e], 0x30
mov byte [ebp - 0x2d], 0x32
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3a
mov byte [ebp - 0x2a], 0x25
mov byte [ebp - 0x29], 0x30
mov byte [ebp - 0x28], 0x32
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x3a
mov byte [ebp - 0x25], 0x25
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x20
mov byte [ebp - 0x22], 0x3a
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0
mov edx, dword [ebp - 0xd04]
add edx, 0x76c
push edx
mov eax, dword [ebp - 0xd08]
add eax, 1
push eax
mov ecx, dword [ebp - 0xd0c]
push ecx
mov edx, dword [ebp - 0xd18]
push edx
mov eax, dword [ebp - 0xd14]
push eax
mov ecx, dword [ebp - 0xd10]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0xcf4]
push eax
call fcn.0065c981
add esp, 0x20
push 1
push 0x40
push 0xa
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0xdc8]
call fcn.00499460
mov dword [ebp - 4], 0
push 0x4990d0
push 0xa
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0xcf4]
push eax
lea ecx, [ebp - 0xdc8]
push ecx
call fcn.00498d00
add esp, 8
push eax
call fcn.00498d00
add esp, 8
push eax
call fcn.004782e0
add esp, 8
mov ecx, eax
call fcn.00499a90
lea ecx, [ebp - 0xdc8]
call fcn.0049bae0
call fcn.0049b920
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc8]
call fcn.00499b40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret
Function at 0x49bd30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], ecx
mov ecx, dword [ebp - 0x408]
call fcn.00499ff0
push 0x6bff14
mov eax, dword [ebp + 8]
push eax
call fcn.0065bf95
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jne 0x49bd87
mov ecx, dword [ebp + 8]
push ecx
push str._s_cant_be_opened_n
call fcn.0065c67c
add esp, 8
jmp 0x49bde8
mov edx, dword [ebp - 0x40c]
push edx
push 0x400
push 1
lea eax, [ebp - 0x404]
push eax
call fcn.0065c270
add esp, 0x10
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
je 0x49bdce
mov ecx, dword [ebp - 0x410]
push ecx
lea edx, [ebp - 0x404]
push edx
mov ecx, dword [ebp - 0x408]
call fcn.0049b170
jmp 0x49bd87
mov ecx, dword [ebp - 0x408]
call fcn.00499f30
mov eax, dword [ebp - 0x40c]
push eax
call fcn.0065bb1c
add esp, 4
mov eax, dword [ebp - 0x408]
add eax, 0x68
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret 4
Function at 0x4aa630
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jbe 0x4aa64e
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.004faa20
add esp, 8
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [ebp + ecx - 0x14], edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp + eax - 0x14], ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jae 0x4aa6ab
imul edx, dword [ebp - 8], 0x1000193
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x4aa682
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x54af50
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
call fcn.004c94f0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.0054aea0
push 0x6d1a58
mov ecx, dword [ebp + 8]
push ecx
call fcn.0065bf95
add esp, 8
mov dword [ebp - 0x2c], eax
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cvtss2sd xmm0, dword [ebp - 0x20]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x24]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x28]
sub esp, 8
movsd qword [esp], xmm0
push str.CenterPos__f__f__f_n
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.005c2a40
add esp, 0x24
cvtss2sd xmm0, dword [ebp - 0x10]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0xc]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 8]
sub esp, 8
movsd qword [esp], xmm0
push str.CameraSetting__f__f__f_n
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.005c2a40
add esp, 0x24
cvtss2sd xmm0, dword [ebp - 0x14]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x18]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x1c]
sub esp, 8
movsd qword [esp], xmm0
push str.CmrPos__f__f__f_n
push 0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005c2a40
add esp, 0x24
cvttss2si eax, dword [ebp - 0x14]
push eax
cvttss2si ecx, dword [ebp - 0x18]
push ecx
cvttss2si edx, dword [ebp - 0x1c]
push edx
cvttss2si eax, dword [ebp - 0x10]
push eax
cvttss2si ecx, dword [ebp - 0xc]
push ecx
cvttss2si edx, dword [ebp - 8]
push edx
cvttss2si eax, dword [ebp - 0x20]
push eax
cvttss2si ecx, dword [ebp - 0x24]
push ecx
cvttss2si edx, dword [ebp - 0x28]
push edx
push str.Line__x__dy__dz__ddistance__dpitch__drot__dup__dview__dcross__d__n
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.005c2a40
add esp, 0x30
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0065bb1c
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret 4

Function at 0x551f90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x554600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x6d39d0
push 0x6d39d4
call fcn.0065bf95
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x554628
xor al, al
jmp 0x554653
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x2638
push ecx
call fcn.0065c270
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.0065bb1c
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x554660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2634], 0
jne 0x554677
jmp 0x5546f0
push 0x6d39e4
call dword [sym.imp.python27.dll_Py_BuildValue]
add esp, 4
push eax
push str.OnSaveInterfaceStatus
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2634]
push edx
call fcn.0064d780
add esp, 0xc
push 0x6d3a00
push str.interface.cfg
call fcn.0065bf95
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5546c7
push str.Cannot_open_interface.cfg
call fcn.005aaeb0
add esp, 4
jmp 0x5546f0
mov eax, dword [ebp - 8]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x2638
push ecx
call fcn.0065c5e5
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.0065bb1c
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x556fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x762dc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x34]
push eax
push 3
mov ecx, dword [ebp - 0x2c]
call fcn.005c89b0
movzx ecx, al
test ecx, ecx
jne 0x556ff0
mov al, 1
jmp 0x557129
movzx esi, word [ebp - 0x33]
mov ecx, dword [ebp - 0x2c]
call fcn.005c8900
cmp esi, eax
jle 0x557007
mov al, 1
jmp 0x557129
lea edx, [ebp - 0x50]
push edx
push 7
mov ecx, dword [ebp - 0x2c]
call fcn.005c8b90
movzx eax, al
test eax, eax
jne 0x557023
xor al, al
jmp 0x557129
movzx ecx, word [ebp - 0x4f]
sub ecx, 7
mov word [ebp - 0x20], cx
mov edx, dword [ebp - 0x4d]
mov dword [ebp - 0x40], edx
movzx eax, word [ebp - 0x20]
push eax
call fcn.006551fb
add esp, 4
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
movzx eax, word [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.005c8b90
movzx ecx, al
test ecx, ecx
jne 0x55707b
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
push eax
call fcn.005d0680
add esp, 4
xor al, al
jmp 0x557129
mov ecx, 0x79ec28
call fcn.00461a70
push eax
call fcn.005ab610
add esp, 4
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.005949a0
add esp, 4
push eax
lea ecx, [ebp - 0x1c]
call fcn.00461700
push 0x6d3fb4
lea ecx, [ebp - 0x1c]
call fcn.00461a70
push eax
call fcn.0065bf95
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x5570e5
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
push eax
call fcn.005d0680
add esp, 4
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x1c]
call fcn.00462020
mov al, byte [ebp - 0x21]
jmp 0x557129
mov ecx, dword [ebp - 0x30]
push ecx
push 1
movzx edx, word [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.0065c5e5
add esp, 0x10
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0065bb1c
add esp, 4
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
call fcn.005d0680
add esp, 4
mov byte [ebp - 0x22], 1
lea ecx, [ebp - 0x1c]
call fcn.00462020
mov al, byte [ebp - 0x22]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0065b5b4
mov esp, ebp
pop ebp
ret
Function at 0x557a30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
lea eax, [ebp - 0xc]
push eax
push 1
call dword [sym.imp.DevIL.dll_ilGenImages]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.DevIL.dll_ilBindImage]
push 0x600
call dword [sym.imp.DevIL.dll_ilEnable]
push 0x602
call dword [sym.imp.DevIL.dll_ilOriginFunc]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.DevIL.dll_ilLoad]
movzx eax, al
test eax, eax
jne 0x557a88
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 2
xor al, al
jmp 0x557b9a
push 0xde4
call dword [sym.imp.DevIL.dll_ilGetInteger]
cmp eax, 0x40
je 0x557aa8
mov edx, dword [ebp + 0xc]
mov dword [edx], 3
xor al, al
jmp 0x557b9a
push 0xde5
call dword [sym.imp.DevIL.dll_ilGetInteger]
cmp eax, 0x80
je 0x557aca
mov eax, dword [ebp + 0xc]
mov dword [eax], 4
xor al, al
jmp 0x557b9a
lea ecx, [ebp - 0xc]
push ecx
push 1
call dword [sym.imp.DevIL.dll_ilDeleteImages]
call dword [sym.imp.DevIL.dll_ilShutDown]
push 0x6d3fe8
mov edx, dword [ebp + 8]
push edx
call fcn.0065bf95
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x557aff
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0065f2a7
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.0065f6ba
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x394], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.0065f2a7
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x394]
push ecx
call fcn.006551fb
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x39c], eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x394]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x39c]
push edx
call fcn.0065c270
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.0065bb1c
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.005affd0
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 0x398], eax
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x559800
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6aecef
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x762dc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0055cbc0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CGuildMarkManager.0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004cdd10
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004cdd10
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004aba90
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00461390
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.0055cb90
mov byte [ebp - 4], 5
push str.mark
call fcn.006a3078
add esp, 4
mov dword [ebp - 0x14], 0
jmp 0x5598aa
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x1900
jae 0x5598c8
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004ae1f0
jmp 0x5598a1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret