joyce8/EMBER2024-capa huggingface dataset:
Function at 0x529e70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x208
mov eax, dword [0x6c9384]
xor eax, esp
mov dword [esp + 0x204], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x218]
xor ebp, ebp
mov esi, ecx
mov dword [esp + 0xc], edi
cmp edi, ebp
jne 0x529ea1
xor eax, eax
jmp 0x529f71
push 0x5a2d48
push edi
call fcn.00583b90
lea edx, [esi + 0x30]
add esp, 8
mov dword [esi + 4], eax
mov eax, edi
sub edx, edi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x529ec0
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x529e9a
push ebx
push 2
push ebp
push eax
call fcn.00587d9f
mov eax, dword [esi + 4]
push eax
call fcn.005880e7
mov ecx, dword [esi + 4]
push ebp
push ebp
push ecx
mov ebx, eax
call fcn.00587d9f
mov eax, dword [esi + 0x28]
add esp, 0x1c
cmp eax, ebp
je 0x529f07
push eax
call fcn.00584667
add esp, 4
mov dword [esi + 0x28], ebp
mov edx, dword [esi + 4]
push edx
push 1
lea edi, [esi + 0x18]
push 0xc
push edi
mov dword [esi + 0x14], ebp
mov dword [esi + 0x2c], ebp
call fcn.00587b93
mov eax, dword [edi]
sub eax, dword [esi + 0x1c]
add esp, 0x10
sub eax, dword [esi + 0x20]
lea ecx, [esi + 0x148]
push eax
call fcn.0057cdc0
test eax, eax
jne 0x529f8b
push eax
push 0x38
push str.MHFile.cpp
call fcn.0052f000
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push str.Bin_File_Version_Error_____s
push edx
call fcn.00583d3f
add esp, 0x18
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005837be
add esp, 0x208
ret 4
lea ecx, [esi + 0x148]
call fcn.0057cd70
test eax, eax
je 0x52a02b
lea edi, [ebx - 0xe]
push edi
call fcn.00583108
add esp, 4
mov dword [esi + 0x28], eax
test eax, eax
jne 0x529fc3
push eax
push 0x49
push str.MHFile.cpp
call fcn.0052f000
add esp, 0xc
jmp 0x529f6e
push edi
push 0
push eax
call fcn.00583f60
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 4]
add esp, 0xc
push ecx
push edi
push edx
push eax
lea ecx, [esi + 0x148]
call fcn.0057d180
test eax, eax
jne 0x52a00f
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push str.File_Open_Error_:__s
push edx
call fcn.00583d3f
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x1c]
jmp 0x529f65
mov ecx, dword [esi + 4]
push ecx
call fcn.00583946
mov eax, 1
add esp, 4
mov dword [esi + 4], ebp
mov dword [esi + 0x2c], eax
jmp 0x529f70
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esi + 0x24]
push 1
push eax
call fcn.00587b93
mov eax, dword [esi + 0x20]
add esp, 0x10
test eax, eax
je 0x52a062
push eax
call fcn.00583108
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x20]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x28], eax
call fcn.00587b93
add esp, 0x14
mov eax, dword [esi + 4]
push eax
push 1
lea ecx, [esi + 0x25]
push 1
push ecx
call fcn.00587b93
mov edx, dword [esi + 4]
push edx
call fcn.00583946
add esp, 0x14
mov ecx, esi
mov dword [esi + 4], ebp
call fcn.00529240
test eax, eax
je 0x529f6e
mov eax, 1
mov dword [esi + 0x2c], eax
jmp 0x529f70
Function at 0x52d9a0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x114
mov eax, dword [0x6c9384]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x18]
mov ebx, ecx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x52d9c7
movsx eax, byte [esi]
push eax
call fcn.0058848a
add esp, 4
test eax, eax
je 0x52da76
lea ecx, [esp + 0x18]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x52da0f
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.Error:__u_n
call fcn.00585c10
add esp, 8
xor eax, eax
jmp 0x52dae2
movsx edx, word [esi + 0xa]
movsx eax, word [esi + 8]
mov ecx, dword [esi + 4]
push edi
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
push str.name_s_naliases_s_naddrtype_d_nlength_d_n
call fcn.00585c10
mov eax, dword [esi + 0xc]
xor edi, edi
add esp, 0x14
cmp dword [eax], edi
je 0x52da75
movsx ecx, word [esi + 0xa]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
call fcn.005840a0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea edx, [esp + 0x20]
push 0x5a267c
push edx
call fcn.00583d3f
mov eax, dword [esi + 0xc]
inc edi
lea eax, [eax + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x52da37
pop edi
lea ecx, [esp + 0x18]
push ecx
push 0x20
push 0x6e18b4
call fcn.005883d5
mov edx, dword [0x6e1910]
mov esi, dword [esp + 0x130]
imul edx, edx, 0x58
add esp, 0xc
cmp si, word [edx + 0x6fbf80]
jne 0x52dabf
cmp dword [0x6e18d8], 0
je 0x52dabf
cmp dword [0x6e190c], 0
jne 0x52dabf
mov ecx, 0x6e18d8
call fcn.0051d730
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
mov eax, ecx
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
xor ecx, esp
call fcn.005837be
add esp, 0x114
ret 8
Function at 0x52db60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6c9384]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x38]
cmp byte [esi + 1], 0x52
push edi
mov edi, ecx
jb 0x52db95
push 0
push 0xb9
push str.MHNetwork.cpp
call fcn.0052f000
add esp, 0xc
lea eax, [esp + 0xc]
push ebx
mov dword [esp + 0x10], 0x56734661
mov dword [esp + 0x14], 0x31313561
mov dword [esp + 0x18], 0x76465341
mov dword [esp + 0x1c], 0x534d6163
mov dword [esp + 0x20], 0x215e5953
mov dword [esp + 0x24], 0x76732440
mov dword [esp + 0x28], 0x3172415a
mov dword [esp + 0x2c], 0x21405e26
mov dword [esp + 0x30], 0x7866732a
mov byte [esp + 0x34], 0
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x52dbf0
sub eax, ecx
mov ecx, eax
xor edx, edx
lea ebx, [ecx - 1]
mov eax, ebp
div ebx
dec ecx
pop ebx
mov al, byte [esp + edx + 0xc]
xor byte [esi + 1], al
xor edx, edx
mov eax, ebp
div ecx
mov cl, byte [esp + edx + 0xc]
xor byte [esi + 2], cl
mov dl, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x52dc43
mov edi, dword [edi + 0x114]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push ebp
push esi
push eax
push edi
call edx
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005837be
add esp, 0x2c
ret 8
Function at 0x52f000
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x6c9384]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6e2628], 0
je 0x52f05a
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push 0x6e2528
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6e2528
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x52f055
int3
jmp 0x52f226
cmp dword [ebp + 0x10], 0
je 0x52f082
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d__msg:_s_
lea eax, [ebp - 0x118]
push eax
call fcn.00583d3f
add esp, 0x14
jmp 0x52f09e
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d_
lea eax, [ebp - 0x118]
push eax
call fcn.00583d3f
add esp, 0x10
mov byte [ebp - 0x218], 0
push 0xff
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.00583f60
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx ecx, word [ebp - 0x12]
push ecx
movzx edx, word [ebp - 0x14]
push edx
push str.._Log_Assert__4d_02d_02d.txt
lea eax, [ebp - 0x218]
push eax
call fcn.00583d3f
add esp, 0x14
cmp dword [0x6e2680], 0
jne 0x52f226
push 0
lea ecx, [ebp - 0x2b0]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
jne 0x52f17f
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5b27b4
lea ecx, [ebp - 0x218]
push ecx
call fcn.00583b90
add esp, 8
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
je 0x52f17a
call fcn.0052f380
push eax
lea edx, [ebp - 0x118]
push edx
push str._stime:_s_n
mov eax, dword [ebp - 0x2b4]
push eax
call fcn.005837cd
add esp, 0x10
mov ecx, dword [ebp - 0x2b4]
push ecx
call fcn.00583946
add esp, 4
jmp 0x52f226
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x224]
shl ecx, 0x10
or ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x220], 0xf4240
ja 0x52f21c
push 0x5b27b4
lea eax, [ebp - 0x218]
push eax
call fcn.00583b90
add esp, 8
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
je 0x52f21a
call fcn.0052f380
push eax
lea ecx, [ebp - 0x118]
push ecx
push str._stime:_s_n
mov edx, dword [ebp - 0x2b8]
push edx
call fcn.005837cd
add esp, 0x10
mov eax, dword [ebp - 0x2b8]
push eax
call fcn.00583946
add esp, 4
jmp 0x52f226
mov dword [0x6e2680], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005837be
mov esp, ebp
pop ebp
ret
Function at 0x530280
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
mov eax, dword [0x6c9384]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x218], 0
push 0x1ff
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.00583f60
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x5302d8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_line:_d__msg:_s_
lea ecx, [ebp - 0x218]
push ecx
call fcn.00583d3f
add esp, 0x14
jmp 0x5302f4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_line:_d_
lea ecx, [ebp - 0x218]
push ecx
call fcn.00583d3f
add esp, 0x10
mov byte [ebp - 0x318], 0
push 0xff
push 0
lea edx, [ebp - 0x317]
push edx
call fcn.00583f60
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0xe]
push ecx
movzx edx, word [ebp - 0x12]
push edx
movzx eax, word [ebp - 0x14]
push eax
push str.._Log_Debug__4d_02d_02d.txt
lea ecx, [ebp - 0x318]
push ecx
call fcn.00583d3f
add esp, 0x14
cmp dword [0x6e29c8], 0
jne 0x53047c
push 0
lea edx, [ebp - 0x3b0]
push edx
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0xffffffff
jne 0x5303d5
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5b27b4
lea edx, [ebp - 0x318]
push edx
call fcn.00583b90
add esp, 8
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
je 0x5303d0
call fcn.0052f380
push eax
lea eax, [ebp - 0x218]
push eax
push str._stime:_s_n
mov ecx, dword [ebp - 0x3b4]
push ecx
call fcn.005837cd
add esp, 0x10
mov edx, dword [ebp - 0x3b4]
push edx
call fcn.00583946
add esp, 4
jmp 0x53047c
lea eax, [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x31c], eax
mov edx, dword [ebp - 0x324]
shl edx, 0x10
or edx, dword [ebp - 0x31c]
mov dword [ebp - 0x320], edx
mov eax, dword [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x320], 0xf4240
ja 0x530472
push 0x5b27b4
lea ecx, [ebp - 0x318]
push ecx
call fcn.00583b90
add esp, 8
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
je 0x530470
call fcn.0052f380
push eax
lea edx, [ebp - 0x218]
push edx
push str._stime:_s_n
mov eax, dword [ebp - 0x3b8]
push eax
call fcn.005837cd
add esp, 0x10
mov ecx, dword [ebp - 0x3b8]
push ecx
call fcn.00583946
add esp, 4
jmp 0x53047c
mov dword [0x6e29c8], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005837be
mov esp, ebp
pop ebp
ret
Function at 0x5525a0
Capabilities:
Print debug messages

Disassembly:
push ebp
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov eax, dword [edi + 0x4c]
add eax, 0x493e0
cmp ebp, eax
jbe 0x552608
cmp dword [edi + 0x10], 0
jle 0x5525fa
push esi
lea ecx, [edi + 4]
call fcn.0057e720
mov esi, eax
test esi, esi
je 0x5525f9
mov ecx, dword [esi + 8]
push ecx
call fcn.0054d6e0
mov edx, dword [esi + 4]
add esp, 4
push edx
lea ecx, [edi + 0x20]
call fcn.00433b00
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
push 0x5b4ff0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [edi + 0x4c], ebp
pop edi
pop ebp
ret
Function at 0x558580
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov esi, ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x5585b9
pop esi
xor eax, eax
pop ebp
pop ecx
ret 4
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
push esi
push ebp
call edi
test al, al
jne 0x5585e3
push 0
push 0x45
push str.TileManager.cpp
call fcn.0052f000
add esp, 0xc
push 0
lea edx, [esp + 0x14]
push edx
push 4
lea ebx, [esi + 4]
push ebx
push ebp
call edi
test al, al
jne 0x558608
push 0
push 0x47
push str.TileManager.cpp
call fcn.0052f000
add esp, 0xc
mov eax, dword [ebx]
imul eax, dword [esi]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00583108
mov dword [esi + 8], eax
mov eax, dword [ebx]
imul eax, dword [esi]
add esp, 4
xor edi, edi
test eax, eax
je 0x558684
mov ecx, dword [esi + 8]
push 0
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x24]
push eax
push ebp
lea ebx, [ecx + edi*2]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test al, al
jne 0x558659
push 0
push 0x53
jmp 0x558664
cmp dword [esp + 0x10], 0
jne 0x558671
push 0
push 0x55
push str.TileManager.cpp
call fcn.0052f000
add esp, 0xc
mov cx, word [esp + 0x18]
mov word [ebx], cx
mov edx, dword [esi + 4]
imul edx, dword [esi]
inc edi
cmp edi, edx
jb 0x558634
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
Function at 0x5672d0
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x5672ee
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.0052f000
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x567306
cmp esi, 0x11
je 0x567306
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
ret 4
Function at 0x57d180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
mov eax, dword [0x6c9384]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x74c], ecx
cmp dword [ebp + 8], 0
jne 0x57d1a6
xor eax, eax
jmp 0x57d40b
cmp dword [ebp + 0xc], 0
jne 0x57d1b3
xor eax, eax
jmp 0x57d40b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x744], eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
lea edx, [ebp - 0x331]
push edx
call fcn.00587b93
add esp, 0x10
mov eax, dword [ebp - 0x74c]
add eax, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0x33c], 0
push 0x200
push 0
lea ecx, [ebp - 0x330]
push ecx
call fcn.00583f60
add esp, 0xc
lea edx, [ebp - 0x130]
push edx
push str._02X
mov eax, dword [ebp - 4]
push eax
call fcn.005847e9
add esp, 0xc
test eax, eax
jle 0x57d254
cmp dword [ebp - 0x33c], 0x200
jge 0x57d254
mov ecx, dword [ebp - 0x33c]
mov dl, byte [ebp - 0x130]
mov byte [ebp + ecx - 0x330], dl
mov eax, dword [ebp - 0x33c]
add eax, 1
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 4], ecx
jmp 0x57d1ff
push 0x100
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.0057bc20
add esp, 0xc
mov cl, byte [ebp + 0x14]
mov byte [ebp - 5], cl
mov dword [ebp - 0x338], 0
jmp 0x57d290
mov edx, dword [ebp - 0x338]
add edx, 0x10
mov dword [ebp - 0x338], edx
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x744]
jge 0x57d38a
mov ecx, dword [ebp + 8]
push ecx
push 0x10
push 1
lea edx, [ebp - 0x740]
push edx
call fcn.00587b93
add esp, 0x10
cmp eax, 0x10
je 0x57d305
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea eax, [ebp - 0x740]
push eax
call fcn.00583f60
add esp, 0xc
push 0x118
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.00583f60
add esp, 0xc
xor eax, eax
jmp 0x57d40b
lea edx, [ebp - 0x740]
push edx
lea eax, [ebp - 0x740]
push eax
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.0057bf20
add esp, 0x10
mov dword [ebp - 0x748], 0
jmp 0x57d33f
mov edx, dword [ebp - 0x748]
add edx, 1
mov dword [ebp - 0x748], edx
cmp dword [ebp - 0x748], 0x10
jge 0x57d385
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x748]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x748]
mov dl, byte [ebp + edx - 0x740]
mov byte [ecx + eax], dl
movsx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x748]
mov edx, dword [ebp + 0xc]
movsx ecx, byte [edx + ecx]
add eax, ecx
mov byte [ebp - 5], al
jmp 0x57d330
jmp 0x57d281
mov edx, dword [ebp + 8]
push edx
push 1
push 1
lea eax, [ebp - 0x129]
push eax
call fcn.00587b93
add esp, 0x10
movsx ecx, byte [ebp - 0x331]
movsx edx, byte [ebp - 0x129]
cmp ecx, edx
jne 0x57d3c2
movsx eax, byte [ebp - 0x331]
movsx ecx, byte [ebp - 5]
cmp eax, ecx
je 0x57d406
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea edx, [ebp - 0x740]
push edx
call fcn.00583f60
add esp, 0xc
push 0x118
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00583f60
add esp, 0xc
xor eax, eax
jmp 0x57d40b
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.005837be
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5837be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6c9384]
jne 0x5837c8
repz ret
jmp fcn.0058ac9a

Function at 0x5958ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6c9384]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0058e5bc
and dword [ebp - 0x14], 0
cmp dword [0x702a28], 0
mov dword [ebp - 0x18], eax
jne 0x59595f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x595a07
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x595a07
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5bccfc
push ebx
mov dword [0x702a28], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x702a2c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x702a30], eax
call edi
push eax
call esi
mov dword [0x702a38], eax
test eax, eax
je 0x59595f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x702a34], eax
mov eax, dword [0x702a34]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x5959b8
cmp dword [0x702a38], ecx
je 0x5959b8
push eax
call esi
push dword [0x702a38]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x5959b8
test ebx, ebx
je 0x5959b8
call edi
test eax, eax
je 0x5959af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x5959af
test byte [ebp - 8], 1
jne 0x5959b8
or dword [ebp + 0x10], 0x200000
jmp 0x5959eb
mov eax, dword [0x702a2c]
cmp eax, dword [ebp - 0x18]
je 0x5959eb
push eax
call esi
test eax, eax
je 0x5959eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5959eb
mov eax, dword [0x702a30]
cmp eax, dword [ebp - 0x18]
je 0x5959eb
push eax
call esi
test eax, eax
je 0x5959eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x702a28]
call esi
test eax, eax
je 0x595a07
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x595a09
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005837be
leave
ret
Function at 0x401050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44146e
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x45066c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7c], edi
mov dword [0x453434], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
lea esi, [edi + 0x38]
lea eax, [esi + 4]
mov byte [edi], bl
mov dword [edi + 4], 0x4457b8
mov dword [edi + 8], str.Bianya.exe
mov dword [edi + 0xc], str.BYSpeed.exe
mov dword [edi + 0x10], str.Unins.exe
mov dword [edi + 0x14], str.PlayerUpdate.exe
mov dword [edi + 0x30], 0xa
mov byte [edi + 0x34], 1
mov dword [esi], eax
mov byte [eax], bl
push 0x4457f5
or eax, 0xffffffff
call fcn.004137c0
lea esi, [edi + 0x90]
lea eax, [esi + 4]
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x80], 0x1010000
mov byte [edi + 0x84], 1
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [esi], eax
mov byte [eax], bl
push str.huvs__.uts.icl522__km.wj3_32513__77_keord
or eax, 0xffffffff
call fcn.004137c0
lea ebx, [edi + 0xd4]
xor eax, eax
mov dword [ebp - 0x58], ebx
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 3
call dword [sym.imp.SensApi.dll_IsNetworkAlive]
test eax, eax
je 0x401134
push ebx
call fcn.00405140
mov byte [ebp - 4], 4
xor ebx, ebx
push 0x58
mov dword [edi + 0xec], ebx
call fcn.00423460
add esp, 4
cmp eax, ebx
je 0x401233
mov dword [edi + 0xe8], eax
mov dword [eax], eax
mov eax, dword [edi + 0xe8]
mov dword [eax + 4], eax
mov eax, dword [edi + 0xe8]
mov dword [eax + 8], eax
mov ecx, dword [edi + 0xe8]
mov byte [ecx + 0x54], 1
mov edx, dword [edi + 0xe8]
mov byte [edx + 0x55], 1
mov byte [ebp - 4], 5
mov edx, dword [esi]
xor eax, eax
mov ecx, edx
cmp byte [edx], al
je 0x4011a0
mov edi, edi
xor byte [ecx], al
inc eax
inc ecx
cmp eax, 5
jne 0x40119b
xor eax, eax
cmp byte [ecx], 0
jne 0x401190
push edx
or eax, 0xffffffff
call fcn.004137c0
push 0xa0
call fcn.00423460
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 6
cmp eax, ebx
je 0x4011c9
push eax
call fcn.0041b3d0
jmp 0x4011cb
xor eax, eax
lea ecx, [ebp - 0x54]
mov dword [edi + 0x7c], eax
call fcn.004012c0
mov eax, dword [eax]
push eax
or eax, 0xffffffff
lea esi, [edi + 0x38]
call fcn.004137c0
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
cmp eax, ecx
je 0x4011f7
push eax
call fcn.00423ad1
add esp, 4
push ebx
lea edx, [ebp - 0x6c]
push edx
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042304b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x58], ebx
call fcn.00423160
push 0x44c500
lea edx, [ebp - 0x78]
push edx
mov dword [ebp - 0x78], vtable.std::bad_alloc.0
call fcn.00425ae2
int3
Function at 0x4012c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x45066c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x108], 0
call fcn.0042c010
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
push 0x26
push 0
mov dword [ebp - 0x10c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x401333
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 0x108]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esi + 4]
lea edx, [ebp - 0x108]
mov dword [esi], eax
mov byte [eax], 0
push edx
or eax, 0xffffffff
call fcn.004137c0
push 0x445828
mov eax, esi
call fcn.004136c0
push str.Bianya
mov eax, esi
call fcn.004136c0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042304b
mov esp, ebp
pop ebp
ret