joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51d0d0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_GetThreadPriority]
mov dword [ebp - 0x1c], eax
push 2
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x51d10d
xor eax, eax
xor edx, edx
jmp 0x51d199
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
push 0
push 0x64
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.005ce020
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
adc ecx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov ebx, dword [ebp - 0x2c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jl 0x51d146
jg 0x51d162
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x10]
jb 0x51d146
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x30]
rdtsc
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.kernel32.dll_GetCurrentThread]
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push 0
push 0x64
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.005ce0d0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x51d320
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov dword [ebp - 0x14], 0
jmp 0x51d34c
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [0x6a1adc]
jge 0x51d38b
mov eax, dword [0x6a1b18]
sub eax, dword [0x6a1b14]
cdq
mov ecx, 0x18
idiv ecx
cmp dword [ebp - 0x14], eax
jb 0x51d374
call fcn.005cbe1d
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x18
add edx, dword [0x6a1b14]
push edx
call fcn.0051d3e0
add esp, 4
jmp 0x51d343
mov dword [0x6a1adc], 0
lea eax, [ebp - 8]
mov dword [ebp - 0xec], eax
mov ebx, dword [ebp - 0xec]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
sbb edx, dword [ebp - 0xc]
add ecx, dword [0x6a1668]
mov eax, dword [0x6a166c]
adc eax, edx
mov dword [0x6a1668], ecx
mov dword [0x6a166c], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51dae0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
jne 0x51daf5
mov dword [ebp + 8], 0x1105
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c0], 1
jmp 0x51db21
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x9c0]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c0], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c0], 0x270
jge 0x51db94
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x9c0]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ecx*4 - 4]
shr ecx, 0x1e
mov eax, dword [ebp - 4]
xor ecx, dword [eax + edx*4 - 4]
imul ecx, ecx, 0x6c078965
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x9c0]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9c0]
mov eax, dword [ebp - 4]
mov dword [eax + edx*4], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x9c0]
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 4]
mov edx, dword [esi + edx*4]
mov dword [eax + ecx*4], edx
jmp 0x51db0c
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x51dbc0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x9c0], 0x270
jl 0x51dcf5
mov dword [ebp - 8], 0
jmp 0x51dbee
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xe3
jge 0x51dc45
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4]
and ecx, 0x80000000
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + edx*4 + 4]
and edx, 0x7fffffff
or ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4 + 0x634]
mov ecx, dword [ebp - 4]
and ecx, 1
xor eax, dword [ecx*4 + 0x65225c]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + edx*4], eax
jmp 0x51dbe5
jmp 0x51dc50
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x26f
jge 0x51dca6
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + eax*4]
and edx, 0x80000000
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax*4 + 4]
and eax, 0x7fffffff
or edx, eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
xor ecx, dword [eax + edx*4 - 0x38c]
mov edx, dword [ebp - 4]
and edx, 1
xor ecx, dword [edx*4 + 0x65225c]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [edx + eax*4], ecx
jmp 0x51dc47
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x9bc]
and ecx, 0x80000000
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
and eax, 0x7fffffff
or ecx, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
shr ecx, 1
mov edx, dword [ebp - 0xc]
xor ecx, dword [edx + 0x630]
mov eax, dword [ebp - 4]
and eax, 1
xor ecx, dword [eax*4 + 0x65225c]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x9bc], ecx
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x9c0], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x9c0]
add eax, 1
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x9c0], eax
mov edx, dword [ebp - 4]
shr edx, 0xb
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
and eax, 0x7fffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x521d00
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov dword [ebp - 0x32c], ecx
mov eax, dword [ebp - 0x32c]
movzx ecx, byte [eax + 0xf6]
test ecx, ecx
jne 0x521ec0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x110], 0
movzx edx, byte [ebp + 8]
test edx, edx
je 0x521d7c
cmp dword [ebp - 0x218], 0x40
jae 0x521d78
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 8]
mov dword [ebp + eax*4 - 0x214], edx
mov eax, dword [ebp - 0x218]
add eax, 1
mov dword [ebp - 0x218], eax
xor ecx, ecx
jne 0x521d4a
movzx edx, byte [ebp + 0xc]
test edx, edx
je 0x521db6
cmp dword [ebp - 0x320], 0x40
jae 0x521db2
mov eax, dword [ebp - 0x320]
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 8]
mov dword [ebp + eax*4 - 0x31c], edx
mov eax, dword [ebp - 0x320]
add eax, 1
mov dword [ebp - 0x320], eax
xor ecx, ecx
jne 0x521d84
cmp dword [ebp - 0x110], 0x40
jae 0x521de4
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax + 8]
mov dword [ebp + edx*4 - 0x10c], ecx
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
xor eax, eax
jne 0x521db6
mov dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 8]
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp - 0x324], edx
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x320]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0x40
call sub.WSOCK32.DLL_select
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x521e54
push 6
mov ecx, dword [ebp - 0x32c]
call fcn.00521cd0
xor al, al
jmp 0x521ec2
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 8]
push edx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x521e7f
push 6
mov ecx, dword [ebp - 0x32c]
call fcn.00521cd0
xor al, al
jmp 0x521ec2
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 8]
push edx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x521e9d
mov al, 1
jmp 0x521ec2
lea eax, [ebp - 0x320]
push eax
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 8]
push edx
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x521ebb
mov al, 1
jmp 0x521ec2
jmp 0x521d0f
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x5230a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0xf4], 1
cmp dword [0x6a1494], 0
je 0x5230cd
mov ecx, dword [0x6a1494]
movzx edx, byte [ecx + 0x581]
test edx, edx
je 0x5230cd
jmp 0x5230ea
mov eax, dword [ebp - 4]
mov byte [eax + 0xf5], 1
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x522c20
call fcn.005cd7b1
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x525c20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ff980
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x4c]
push eax
call fcn.00528e20
add esp, 0xc
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 4], 0
push 0
mov edx, dword [ebp - 0x7c]
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.00526860
add esp, 0xc
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.00407a40
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x18], 0x10
jb 0x525ca9
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x80], ecx
jmp 0x525caf
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x80]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004079f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret

Function at 0x525e00
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 8], eax
movzx eax, byte [0x6522c9]
test eax, eax
je 0x525e8b
mov byte [ebp - 1], 0
push 0x9c
push 0
lea ecx, [ebp - 0xa8]
push ecx
call fcn.005ccbd0
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x525e72
mov dword [ebp - 0xa8], 0x94
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x525e72
xor al, al
jmp 0x525e90
mov byte [0x6522c9], 0
cmp dword [ebp - 0xa4], 6
sbb ecx, ecx
add ecx, 1
mov byte [0x6a27c9], cl
mov al, byte [0x6a27c9]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret
Function at 0x52b580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x174], ecx
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax + 4]
movzx edx, byte [ecx + 0x581]
test edx, edx
je 0x52b5b2
jmp 0x52b6af
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwarePopCapBeta
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x52b6af
mov dword [ebp - 0x10c], 0x100
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x110]
push eax
push 0
push str.Name
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x52b63d
lea edx, [ebp - 0x108]
push edx
call fcn.005cdf90
add esp, 4
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebp - 0x174]
add ecx, 0x164
call fcn.0040b080
mov dword [ebp - 0x10c], 0x100
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0
push str.Password
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x52b6a5
lea eax, [ebp - 0x108]
push eax
call fcn.005cdf90
add esp, 4
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x140]
push ecx
lea edx, [ebp - 0x108]
push edx
mov ecx, dword [ebp - 0x174]
add ecx, 0x180
call fcn.0040b080
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret
Function at 0x52b6c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
movzx edx, byte [ecx + 0x581]
test edx, edx
je 0x52b6df
jmp 0x52b7be
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0x6130e0
push 0
push str.SoftwarePopCapBeta
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x52b7be
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x178]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x164
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x18], 0x10
jb 0x52b740
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x24], ecx
jmp 0x52b749
mov edx, dword [ebp - 0x14]
add edx, 4
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
push 1
push 0
push str.Name
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x194]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x180
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x18], 0x10
jb 0x52b790
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x28], edx
jmp 0x52b799
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 1
push 0
push str.Password
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x539c60
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x601718
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a0], ecx
mov eax, dword [ebp - 0x1a0]
cmp dword [eax + 0x28], 0
jne 0x539ca4
xor eax, eax
jmp 0x539e00
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
push str.SexyCacheReq_d
lea ecx, [ebp - 0x124]
push ecx
call fcn.005cc868
add esp, 0xc
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp + 0x10]
add eax, 0x304
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [ebp - 0x128], eax
mov ecx, dword [ebp + 0x10]
add ecx, 0x304
push ecx
push 0
push 0
push 0xf001f
mov edx, dword [ebp - 0x128]
push edx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x10
jb 0x539d23
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1a4], eax
jmp 0x539d2f
mov ecx, dword [ebp + 8]
add ecx, 4
mov dword [ebp - 0x1a4], ecx
mov edx, dword [ebp - 0x1a4]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005d14a0
add esp, 8
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x18], 0x10
jb 0x539d59
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1a8], eax
jmp 0x539d65
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x1a8], ecx
mov edx, dword [ebp - 0x1a8]
push edx
mov eax, dword [ebp - 0x1c]
add eax, 0x100
push eax
call fcn.005d14a0
add esp, 8
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x300], edx
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
add edx, 0x304
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x12c], ecx
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x1a0]
add ecx, 0x2c
call fcn.0053edc0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x140], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x53a390
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6a1a70], 0
jne 0x53a400
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.gPakInterfaceP__d
lea eax, [ebp - 0x108]
push eax
call fcn.005cc868
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [0x6a1a70], eax
push 4
push 0
push 0
push 0xf001f
mov edx, dword [0x6a1a70]
push edx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [0x6a1a74], eax
mov eax, dword [0x6a1a74]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret

Function at 0x53a510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.0053a390
test eax, eax
je 0x53a544
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x6a1a74]
mov edx, dword [ecx]
mov eax, dword [0x6a1a74]
mov ecx, dword [eax]
mov edx, dword [edx]
mov eax, dword [edx + 0x14]
call eax
jmp 0x53a55f
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005cd555
add esp, 0x10
pop ebp
ret

Function at 0x559710
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6a27f8], 0
jne 0x559780
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.gPakInterfaceP__d
lea eax, [ebp - 0x108]
push eax
call fcn.005cc868
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [0x6a27f8], eax
push 4
push 0
push 0
push 0xf001f
mov edx, dword [0x6a27f8]
push edx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [0x6a27fc], eax
mov eax, dword [0x6a27fc]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret

Function at 0x559840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.00559710
test eax, eax
je 0x559874
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x6a27fc]
mov edx, dword [ecx]
mov eax, dword [0x6a27fc]
mov ecx, dword [eax]
mov edx, dword [edx]
mov eax, dword [edx + 0x14]
call eax
jmp 0x55988f
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005cd555
add esp, 0x10
pop ebp
ret
Function at 0x560f50
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x654c54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6a2f50], 0
jne 0x560fc0
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.gPakInterfaceP__d
lea eax, [ebp - 0x108]
push eax
call fcn.005cc868
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov dword [0x6a2f50], eax
push 4
push 0
push 0
push 0xf001f
mov edx, dword [0x6a2f50]
push edx
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov dword [0x6a2f54], eax
mov eax, dword [0x6a2f54]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cbcb1
mov esp, ebp
pop ebp
ret

Function at 0x5610d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.00560f50
test eax, eax
je 0x561104
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x6a2f54]
mov edx, dword [ecx]
mov eax, dword [0x6a2f54]
mov ecx, dword [eax]
mov edx, dword [edx]
mov eax, dword [edx + 0x14]
call eax
jmp 0x56111f
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005cd555
add esp, 0x10
pop ebp
ret