joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5225a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6dc4f0]
xor eax, ebp
mov dword [ebp - 0xc], eax
push esi
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x44], 0
je 0x5225c8
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x5225d4
mov al, 1
jmp 0x52274d
mov dword [ebp - 4], 8
call fcn.005229d0
push eax
mov eax, dword [ebp - 0x4c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x30], eax
call fcn.005229d0
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.005229b0
add esp, 8
movzx eax, al
test eax, eax
je 0x522617
xor al, al
jmp 0x52274d
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00522760
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x28]
call fcn.00523600
mov ecx, eax
call fcn.005227a0
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.004307e0
add esi, eax
push esi
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00523600
mov ecx, eax
call fcn.005227a0
push eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + 0x44]
call fcn.00522940
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x52268b
cmp dword [ebp - 0x50], 1
je 0x522692
cmp dword [ebp - 0x50], 3
je 0x52271e
jmp 0x52272f
mov eax, dword [ebp - 0x4c]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00523600
mov ecx, eax
call fcn.005227a0
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp - 0x2c], edx
je 0x5226ee
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 1
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.00523600
mov ecx, eax
call fcn.005227a0
push eax
call fcn.005967a0
add esp, 0x10
cmp dword [ebp - 0x2c], eax
je 0x5226ee
mov byte [ebp - 0x45], 0
lea ecx, [ebp - 0x28]
call fcn.00430bc0
mov al, byte [ebp - 0x45]
jmp 0x52274d
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x52270a
mov byte [ebp - 0x46], 1
lea ecx, [ebp - 0x28]
call fcn.00430bc0
mov al, byte [ebp - 0x46]
jmp 0x52274d
cmp dword [ebp - 0x2c], 0
jne 0x52271c
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00522210
jmp 0x522740
mov byte [ebp - 0x47], 1
lea ecx, [ebp - 0x28]
call fcn.00430bc0
mov al, byte [ebp - 0x47]
jmp 0x52274d
mov byte [ebp - 0x48], 0
lea ecx, [ebp - 0x28]
call fcn.00430bc0
mov al, byte [ebp - 0x48]
jmp 0x52274d
jmp 0x522623
pop esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0059641f
mov esp, ebp
pop ebp
ret
Function at 0x5268d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6dc4f0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xff
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x108]
push ecx
call fcn.0051d130
add esp, 8
mov byte [eax + 1], 0
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.00596df0
add esp, 8
lea ecx, [ebp - 0x108]
push ecx
push 0xff
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059641f
mov esp, ebp
pop ebp
ret

Function at 0x527d80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.PingManager.0
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.005484b0
push 0x1e
mov ecx, dword [ebp - 4]
add ecx, 8
call fcn.00548400
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], 0
push 0
push 0
push 0
push 0x5280d0
push 0
push 0
call fcn.0059adda
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x528310
Capabilities:
Create raw socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x6dc4f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a4], ecx
xor eax, eax
mov word [ebp - 0x198], ax
push 0x18e
push 0
lea ecx, [ebp - 0x196]
push ecx
call fcn.00596250
add esp, 0xc
lea edx, [ebp - 0x198]
push edx
push 0x102
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x528364
xor al, al
jmp 0x52840b
push 1
push 3
push 2
call sub.WSOCK32.dll_socket
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1a4]
cmp dword [edx + 4], 0xffffffff
jne 0x52838b
xor al, al
jmp 0x52840b
mov dword [ebp - 0x19c], 0x7d0
push 4
lea eax, [ebp - 0x19c]
push eax
push 0x1006
push 0xffff
mov ecx, dword [ebp - 0x1a4]
mov edx, dword [ecx + 4]
push edx
call sub.WSOCK32.dll_setsockopt
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xffffffff
jne 0x5283ca
xor al, al
jmp 0x52840b
mov dword [ebp - 0x19c], 0x7d0
push 4
lea eax, [ebp - 0x19c]
push eax
push 0x1005
push 0xffff
mov ecx, dword [ebp - 0x1a4]
mov edx, dword [ecx + 4]
push edx
call sub.WSOCK32.dll_setsockopt
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xffffffff
jne 0x528409
xor al, al
jmp 0x52840b
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059641f
mov esp, ebp
pop ebp
ret
Function at 0x532900
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
mov eax, dword [0x6dc4f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x484], ecx
mov eax, dword [ebp - 0x484]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x484]
push edx
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
je 0x532957
push 0x7c9
mov ecx, 0x6ed7f0
call fcn.004de2a0
push eax
push 0x1d
push 0x6ed7f0
call fcn.004df650
add esp, 0xc
xor eax, eax
jmp 0x532b32
mov dword [ebp - 4], 0
mov ecx, dword [0x70e474]
mov edx, dword [ecx]
mov eax, dword [0x70e474]
push eax
mov ecx, dword [edx + 0x10]
call ecx
mov dword [ebp - 0x488], eax
lea edx, [ebp - 4]
push edx
push 0x5c4d68
mov eax, dword [ebp - 0x488]
push eax
mov ecx, dword [ebp - 0x488]
mov edx, dword [ecx]
mov eax, dword [edx + 0x134]
call eax
test eax, eax
jne 0x5329a2
xor eax, eax
jmp 0x532b32
mov ecx, dword [ebp - 0x484]
call fcn.00533580
test eax, eax
jne 0x532a09
push str.bdcap32.dll
mov ecx, dword [ebp - 0x484]
call fcn.005333c0
test eax, eax
jge 0x5329eb
push 0x7ca
mov ecx, 0x6ed7f0
call fcn.004de2a0
push eax
push 0x1d
push 0x6ed7f0
call fcn.004df650
add esp, 0xc
xor eax, eax
jmp 0x532b32
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
mov ecx, dword [ebp - 0x484]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x484]
push eax
mov ecx, dword [edx + 0xc]
call ecx
mov ecx, dword [ebp - 0x484]
call fcn.00533580
test eax, eax
je 0x532b2d
lea ecx, [ebp - 0x378]
call fcn.00533290
push 0x3c
push 0x1e
mov edx, dword [ebp - 0x484]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x484]
push ecx
mov edx, dword [eax + 0x40]
call edx
mov ecx, dword [ebp - 0x484]
call fcn.00532bf0
push 0
mov ecx, 0x6dbb30
call fcn.00579d20
push eax
push str._sScreenShot
lea eax, [ebp - 0x480]
push eax
call fcn.00596934
add esp, 0xc
push 0
lea ecx, [ebp - 0x480]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x532ab1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x532ab1
push 0x7cc
mov ecx, 0x6ed7f0
call fcn.004de2a0
push eax
push 0x1d
push 0x6ed7f0
call fcn.004df650
add esp, 0xc
xor eax, eax
jmp 0x532b32
push 0x104
lea edx, [ebp - 0x110]
push edx
push 0x5c4e60
push str.Capture
lea eax, [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x484]
call fcn.005335a0
lea ecx, [ebp - 0x110]
push ecx
push 0x7cd
mov ecx, 0x6ed7f0
call fcn.004de2a0
push eax
push 0x1d
push 0x6ed7f0
call fcn.004df650
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
push 4
push 0
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x484]
push ecx
call fcn.00533620
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jge 0x532b2d
xor eax, eax
jmp 0x532b32
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0059641f
mov esp, ebp
pop ebp
ret
Function at 0x5370a0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff8
push esi
mov esi, ecx
cmp eax, 0x4e
ja case.0x5370bc.10
movzx eax, byte [eax + 0x537228]
jmp dword [eax*4 + 0x5371f4]
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x40], 1
je case.0x5370bc.10
call fcn.00536410
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00536490
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00536510
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00536580
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x40], 1
je case.0x5370bc.10
call fcn.005365f0
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00536600
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00536340
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x38]
test ecx, ecx
je case.0x5370bc.10
push 8
call fcn.00446960
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00536640
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, dword [esi + 4]
call fcn.00536830
mov eax, 1
pop esi
pop ebp
ret 0x10
mov ecx, 0x6cd410
call fcn.004471b0
mov eax, 1
pop esi
pop ebp
ret 0x10
mov dword [esi + 0xc], 1
mov eax, 1
pop esi
pop ebp
ret 0x10
cmp dword [esi + 0xc], 0
je case.0x5370bc.10
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je case.0x5370bc.10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x5370bc.10
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ecx, dword [esi + 4]
push eax
call fcn.00536f70
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x5393f0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6dc4f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x104]
mov ebx, ecx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x539414
movsx eax, byte [esi]
push eax
call fcn.0059b5ea
add esp, 4
test eax, eax
je 0x5394a5
lea ecx, [ebp - 0x104]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x539452
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059641f
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp dword [eax], edi
je 0x5394a4
lea esp, [esp]
movsx edx, word [esi + 0xa]
mov eax, dword [eax]
push edx
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00596f10
mov edx, dword [ebp - 0x110]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [ebp - 0x104]
push 0x5b5944
push eax
call fcn.00596934
mov ecx, dword [esi + 0xc]
inc edi
lea eax, [ecx + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x539460
pop edi
lea edx, [ebp - 0x104]
push edx
push 0x20
push 0x6f2e9c
call fcn.0059b535
mov eax, dword [0x6f2ee0]
mov esi, dword [ebp + 0xc]
imul eax, eax, 0x58
add esp, 0xc
cmp si, word [eax + 0x70d550]
jne 0x5394eb
cmp dword [0x6f2ec0], 0
je 0x5394eb
cmp dword [0x6f2edc], 0
jne 0x5394eb
mov ecx, 0x6f2ec0
call fcn.00528e90
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x104]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059641f
mov esp, ebp
pop ebp
ret 8
Function at 0x539590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6dc4f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov bl, 0x53
push edi
mov edi, ecx
mov dword [ebp - 0x30], eax
cmp byte [esi + 1], bl
jb 0x5395c9
push 0
push 0xb6
push str.MHNetwork.cpp
call fcn.0053aa40
add esp, 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x56734661
mov dword [ebp - 0x28], 0x31313561
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], bl
mov dword [ebp - 0x22], 0x61637646
mov byte [ebp - 0x1e], 0x4d
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x1c], bl
mov dword [ebp - 0x1b], 0x40215e59
mov dword [ebp - 0x17], 0x5a767324
mov dword [ebp - 0x13], 0x26317241
mov dword [ebp - 0xf], 0x2a21405e
mov dword [ebp - 0xb], 0x786673
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x539618
sub eax, ecx
mov ecx, eax
mov eax, dword [ebp - 0x30]
xor edx, edx
lea ebx, [ecx - 1]
div ebx
lea ebx, [ecx - 1]
mov ecx, dword [ebp - 0x30]
mov eax, ecx
movzx edx, byte [ebp + edx - 0x2c]
xor byte [esi + 1], dl
xor edx, edx
div ebx
mov al, byte [ebp + edx - 0x2c]
xor byte [esi + 2], al
movzx edx, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x539672
mov edi, dword [edi + 0x114]
mov edx, dword [edi]
push ecx
push esi
push eax
mov eax, dword [edx + 0x14]
push edi
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0059641f
mov esp, ebp
pop ebp
ret 8
Function at 0x53aa40
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x6dc4f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6f3bf8], 0
je 0x53aa9a
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push 0x6f3af8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6f3af8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x53aa95
int3
jmp 0x53ac66
cmp dword [ebp + 0x10], 0
je 0x53aac2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d__msg:_s_
lea eax, [ebp - 0x118]
push eax
call fcn.00596934
add esp, 0x14
jmp 0x53aade
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d_
lea eax, [ebp - 0x118]
push eax
call fcn.00596934
add esp, 0x10
mov byte [ebp - 0x218], 0
push 0xff
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.00596250
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx ecx, word [ebp - 0x12]
push ecx
movzx edx, word [ebp - 0x14]
push edx
push str.._Log_Assert__4d_02d_02d.txt
lea eax, [ebp - 0x218]
push eax
call fcn.00596934
add esp, 0x14
cmp dword [0x6f3c50], 0
jne 0x53ac66
push 0
lea ecx, [ebp - 0x2b0]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
jne 0x53abbf
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5c546c
lea ecx, [ebp - 0x218]
push ecx
call fcn.005968d6
add esp, 8
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
je 0x53abba
call fcn.0053adc0
push eax
lea edx, [ebp - 0x118]
push edx
push str._stime:_s_n
mov eax, dword [ebp - 0x2b4]
push eax
call fcn.00597b81
add esp, 0x10
mov ecx, dword [ebp - 0x2b4]
push ecx
call fcn.005965d5
add esp, 4
jmp 0x53ac66
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x224]
shl ecx, 0x10
or ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x220], 0xf4240
ja 0x53ac5c
push 0x5c546c
lea eax, [ebp - 0x218]
push eax
call fcn.005968d6
add esp, 8
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
je 0x53ac5a
call fcn.0053adc0
push eax
lea ecx, [ebp - 0x118]
push ecx
push str._stime:_s_n
mov edx, dword [ebp - 0x2b8]
push edx
call fcn.00597b81
add esp, 0x10
mov eax, dword [ebp - 0x2b8]
push eax
call fcn.005965d5
add esp, 4
jmp 0x53ac66
mov dword [0x6f3c50], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059641f
mov esp, ebp
pop ebp
ret
Function at 0x53bcc0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
mov eax, dword [0x6dc4f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x218], 0
push 0x1ff
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.00596250
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x53bd18
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_line:_d__msg:_s_
lea ecx, [ebp - 0x218]
push ecx
call fcn.00596934
add esp, 0x14
jmp 0x53bd34
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_line:_d_
lea ecx, [ebp - 0x218]
push ecx
call fcn.00596934
add esp, 0x10
mov byte [ebp - 0x318], 0
push 0xff
push 0
lea edx, [ebp - 0x317]
push edx
call fcn.00596250
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0xe]
push ecx
movzx edx, word [ebp - 0x12]
push edx
movzx eax, word [ebp - 0x14]
push eax
push str.._Log_Debug__4d_02d_02d.txt
lea ecx, [ebp - 0x318]
push ecx
call fcn.00596934
add esp, 0x14
cmp dword [0x6f3f98], 0
jne 0x53bebc
push 0
lea edx, [ebp - 0x3b0]
push edx
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0xffffffff
jne 0x53be15
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5c546c
lea edx, [ebp - 0x318]
push edx
call fcn.005968d6
add esp, 8
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
je 0x53be10
call fcn.0053adc0
push eax
lea eax, [ebp - 0x218]
push eax
push str._stime:_s_n
mov ecx, dword [ebp - 0x3b4]
push ecx
call fcn.00597b81
add esp, 0x10
mov edx, dword [ebp - 0x3b4]
push edx
call fcn.005965d5
add esp, 4
jmp 0x53bebc
lea eax, [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x31c], eax
mov edx, dword [ebp - 0x324]
shl edx, 0x10
or edx, dword [ebp - 0x31c]
mov dword [ebp - 0x320], edx
mov eax, dword [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x320], 0xf4240
ja 0x53beb2
push 0x5c546c
lea ecx, [ebp - 0x318]
push ecx
call fcn.005968d6
add esp, 8
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
je 0x53beb0
call fcn.0053adc0
push eax
lea edx, [ebp - 0x218]
push edx
push str._stime:_s_n
mov eax, dword [ebp - 0x3b8]
push eax
call fcn.00597b81
add esp, 0x10
mov ecx, dword [ebp - 0x3b8]
push ecx
call fcn.005965d5
add esp, 4
jmp 0x53bebc
mov dword [0x6f3f98], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059641f
mov esp, ebp
pop ebp
ret
Function at 0x55deb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x4c]
add ecx, 0x493e0
mov dword [ebp - 4], eax
cmp eax, ecx
jbe 0x55df20
cmp dword [edi + 0x10], 0
jle 0x55df0f
push esi
lea ecx, [edi + 4]
call fcn.005911c0
mov esi, eax
test esi, esi
je 0x55df0e
mov edx, dword [esi + 8]
push edx
call fcn.00558f40
mov eax, dword [esi + 4]
add esp, 4
push eax
lea ecx, [edi + 0x20]
call fcn.0050ea50
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
push 0x5c7cb8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
mov dword [edi + 0x4c], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x560dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
cmp dword [eax], 0x10
je 0x560f4f
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
push 0x94
mov dword [ebp + 8], esi
add esi, 0x364
push 0
push esi
call fcn.00596250
add esp, 0xc
mov ecx, edi
call fcn.0055f240
push 0
mov ecx, edi
call fcn.0055f250
test eax, eax
je 0x560f37
push ebx
jmp 0x560e20
mov edi, dword [eax]
mov ecx, eax
call fcn.0055ef40
mov ecx, dword [ebp + 8]
mov bl, al
add bl, byte [ecx + 0x536]
mov ecx, 0x710178
mov byte [ebp - 4], bl
mov edx, dword [ebp - 4]
push edx
call fcn.00560710
test eax, eax
je case.0x560e64.10
movzx ecx, word [edi + 0x2c]
add ecx, 0xfffffffd
cmp ecx, 0x75
ja case.0x560e64.10
movzx ecx, byte [ecx + 0x560f9c]
jmp dword [ecx*4 + 0x560f58]
movzx edx, word [edi + 0x30]
mov eax, dword [eax]
mov dword [esi + edx*4 - 4], eax
jmp case.0x560e64.10
movzx ecx, word [edi + 0x30]
fld dword [eax + 8]
fstp dword [ebp - 8]
test cx, cx
je case.0x560e64.10
fld dword [eax + 4]
fstp dword [esi + ecx*4 + 0x24]
fld dword [ebp - 8]
fstp dword [esi + ecx*4 + 0x3c]
jmp case.0x560e64.10
mov ecx, dword [eax + 0xc]
mov dword [esi + 0x5c], ecx
jmp case.0x560e64.10
mov edx, dword [eax + 0x10]
mov dword [esi + 0x58], edx
jmp case.0x560e64.10
mov eax, dword [eax + 0x14]
mov dword [esi + 0x60], eax
jmp case.0x560e64.10
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x64], ecx
jmp case.0x560e64.10
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x68], edx
jmp case.0x560e64.10
mov eax, dword [eax + 0x20]
mov dword [esi + 0x6c], eax
jmp case.0x560e64.10
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x70], ecx
jmp case.0x560e64.10
mov edx, dword [eax + 0x20]
mov dword [esi + 0x74], edx
jmp case.0x560e64.10
mov eax, dword [eax + 0x20]
mov dword [esi + 0x78], eax
jmp case.0x560e64.10
fld dword [eax + 0x24]
movzx ecx, bl
fstp dword [esi + 0x7c]
mov word [esi + 0x80], cx
jmp case.0x560e64.10
fld dword [eax + 0x28]
fstp dword [esi + 0x84]
jmp case.0x560e64.10
mov edx, dword [eax + 0x2c]
mov dword [esi + 0x88], edx
jmp case.0x560e64.10
mov eax, dword [eax + 0x30]
mov dword [esi + 0x8c], eax
jmp case.0x560e64.10
mov ecx, dword [eax + 0x34]
mov dword [esi + 0x90], ecx
mov ecx, dword [ebp + 0x10]
push 0
call fcn.0055f250
test eax, eax
jne 0x560e20
pop ebx
mov ecx, dword [0x6de73c]
call fcn.0044fce0
mov ecx, dword [0x6de73c]
call fcn.0044f990
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x562de0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
jne 0x562df3
xor eax, eax
pop ebp
ret 8
pop ebp
jmp fcn.005673a0
Function at 0x5642f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x1f4], 0
push edi
je 0x56439d
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x56439d
push 0
push 1
push 0x710240
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x56439d
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [0x7101ec], ecx
mov edx, dword [eax + 4]
mov dword [0x7101f0], edx
mov eax, dword [eax + 8]
mov dword [0x7101f4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [0x7101e0], ecx
mov edx, dword [eax + 4]
mov dword [0x7101e4], edx
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0x14]
mov dword [0x7101e8], eax
mov ecx, dword [esi + 0x1f4]
lea eax, [ebp + 0x10]
push eax
push 0
push 0
push 0x564260
push 0
push 0
mov dword [0x71023c], ecx
mov dword [0x710238], edi
mov dword [0x6daec0], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x5643a5
push eax
push 0x710240
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x579ce0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x579d00
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.0053aa40
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x579d18
cmp esi, 0x11
je 0x579d18
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
pop ebp
ret 4