joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5238e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x480
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x47c], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
push esi
call ecx
test eax, eax
je 0x52393a
push 0x7c9
mov ecx, 0x6f63d0
call fcn.004d54d0
push eax
push 0x1d
push 0x6f63d0
call fcn.004d6a60
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x47c]
xor ecx, esp
call fcn.005825b3
add esp, 0x480
ret
mov eax, dword [0x717484]
mov dword [esp + 4], 0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push 0x5c0d70
push eax
mov eax, dword [ecx + 0x134]
call eax
test eax, eax
je 0x523922
cmp dword [esi + 0xc], 0
jne 0x5239a1
push str.bdcap32.dll
mov ecx, esi
call fcn.00523fc0
test eax, eax
jns 0x523985
push 0x7ca
jmp 0x523908
mov ecx, dword [esi]
mov edx, dword [ecx + 0xc]
push str.e5b68af6
push str.EYA_LUNAPLUS_20100218
push esi
call edx
cmp dword [esi + 0xc], 0
je 0x523ab1
lea ecx, [esp + 0x18]
call fcn.00523f20
mov eax, dword [esi]
mov ecx, dword [eax + 0x40]
push 0x3c
push 0x1e
push esi
call ecx
mov ecx, esi
call fcn.00523b50
push 0
mov ecx, 0x6e4700
call fcn.005685c0
push eax
lea edx, [esp + 0x27c]
push str._sScreenShot
push edx
call fcn.00582c5f
add esp, 0xc
push 0
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x523a0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x523a0a
push 0x7cc
jmp 0x523908
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x16]
movzx eax, word [esp + 0x14]
movzx ecx, word [esp + 0x12]
push 0x5c0e44
push edx
movzx edx, word [esp + 0x18]
push eax
movzx eax, word [esp + 0x1a]
push ecx
movzx ecx, word [esp + 0x1a]
push edx
movzx edx, word [esp + 0x1c]
push eax
push ecx
push edx
push str.Capture
lea eax, [esp + 0x29c]
push eax
push str._s_s__d__02d__02d__02d__02d__02d__03d._s
lea ecx, [esp + 0x3a8]
push 0x104
push ecx
call fcn.00582ce3
add esp, 0x34
lea edx, [esp + 0x37c]
push edx
push 0x7cd
mov ecx, 0x6f63d0
call fcn.004d54d0
push eax
push 0x1d
push 0x6f63d0
call fcn.004d6a60
mov eax, dword [esp + 0x14]
add esp, 0x10
push eax
push 4
push 0
lea ecx, [esp + 0x388]
push ecx
push esi
call fcn.00524110
test eax, eax
js 0x523922
mov ecx, dword [esp + 0x480]
pop esi
xor ecx, esp
mov eax, 1
call fcn.005825b3
add esp, 0x480
ret
Function at 0x526090
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x208
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x204], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x218]
xor ebp, ebp
mov esi, ecx
mov dword [esp + 0xc], edi
cmp edi, ebp
jne 0x5260c1
xor eax, eax
jmp 0x526191
push 0x5b1660
push edi
call fcn.00582c01
lea edx, [esi + 0x30]
add esp, 8
mov dword [esi + 4], eax
mov eax, edi
sub edx, edi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x5260e0
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x5260ba
push ebx
push 2
push ebp
push eax
call fcn.00585184
mov eax, dword [esi + 4]
push eax
call fcn.005854cc
mov ecx, dword [esi + 4]
push ebp
push ebp
push ecx
mov ebx, eax
call fcn.00585184
mov eax, dword [esi + 0x28]
add esp, 0x1c
cmp eax, ebp
je 0x526127
push eax
call fcn.0058264a
add esp, 4
mov dword [esi + 0x28], ebp
mov edx, dword [esi + 4]
push edx
push 1
lea edi, [esi + 0x18]
push 0xc
push edi
mov dword [esi + 0x14], ebp
mov dword [esi + 0x2c], ebp
call fcn.00582f4b
mov eax, dword [edi]
sub eax, dword [esi + 0x1c]
add esp, 0x10
sub eax, dword [esi + 0x20]
lea ecx, [esi + 0x148]
push eax
call fcn.0057bca0
test eax, eax
jne 0x5261ab
push eax
push 0x38
push str.MHFile.cpp
call fcn.0052b690
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push str.Bin_File_Version_Error_____s
push edx
call fcn.00582c5f
add esp, 0x18
push 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005825b3
add esp, 0x208
ret 4
lea ecx, [esi + 0x148]
call fcn.0057bc80
test eax, eax
je 0x52624b
lea edi, [ebx - 0xe]
push edi
call fcn.00581ac8
add esp, 4
mov dword [esi + 0x28], eax
test eax, eax
jne 0x5261e3
push eax
push 0x49
push str.MHFile.cpp
call fcn.0052b690
add esp, 0xc
jmp 0x52618e
push edi
push 0
push eax
call fcn.005825d0
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 4]
add esp, 0xc
push ecx
push edi
push edx
push eax
lea ecx, [esi + 0x148]
call fcn.0057bf40
test eax, eax
jne 0x52622f
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push str.File_Open_Error_:__s
push edx
call fcn.00582c5f
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x1c]
jmp 0x526185
mov ecx, dword [esi + 4]
push ecx
call fcn.00582900
mov eax, 1
add esp, 4
mov dword [esi + 4], ebp
mov dword [esi + 0x2c], eax
jmp 0x526190
mov edx, dword [esi + 4]
push edx
push 1
lea eax, [esi + 0x24]
push 1
push eax
call fcn.00582f4b
mov eax, dword [esi + 0x20]
add esp, 0x10
test eax, eax
je 0x526282
push eax
call fcn.00581ac8
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x20]
push ecx
push edx
push 1
push eax
mov dword [esi + 0x28], eax
call fcn.00582f4b
add esp, 0x14
mov eax, dword [esi + 4]
push eax
push 1
lea ecx, [esi + 0x25]
push 1
push ecx
call fcn.00582f4b
mov edx, dword [esi + 4]
push edx
call fcn.00582900
add esp, 0x14
mov ecx, esi
mov dword [esi + 4], ebp
call fcn.00525420
test eax, eax
je 0x52618e
mov eax, 1
mov dword [esi + 0x2c], eax
jmp 0x526190
Function at 0x528a60
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5a9317
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x6e50b4]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov eax, dword [0x6f48ac]
mov esi, dword [esp + 0x4c]
test eax, eax
je 0x528cee
test esi, esi
je 0x528cee
cmp byte [eax + 0x450], 0
je 0x528cee
cmp dword [0x6fc684], esi
jne 0x528ad1
mov eax, dword [0x6f5768]
sub eax, dword [0x6fc680]
cmp eax, 0x64
jbe 0x528cee
mov ecx, esi
call fcn.0049f300
cmp al, 0x14
je 0x528cee
mov al, byte [esp + 0x50]
test al, 1
je 0x528bfd
mov eax, dword [esi + 0x129]
cmp dword [0x6f5424], eax
jne 0x528cee
mov ecx, dword [0x6f48ac]
cmp byte [ecx + 0x149], 0
je 0x528b31
push 0x531
mov ecx, 0x6f63d0
call fcn.004d54d0
push eax
push 0x1d
push 0x6f63d0
call fcn.004d6a60
add esp, 0xc
jmp 0x528cee
push esi
call fcn.00527f50
add esp, 4
test eax, eax
je 0x528cee
mov edx, dword [0x6f48ac]
cmp byte [edx + 0x451], 0
je 0x528ba1
mov eax, dword [esi + 0x129]
push eax
mov ecx, 0x6d86e0
call fcn.004cb840
test eax, eax
je 0x528b6d
push 0x276
jmp 0x528b12
mov eax, dword [0x6f48ac]
push esi
push eax
call fcn.0040cf00
mov ecx, eax
call fcn.00502540
test eax, eax
je 0x528b8b
push 0x3a4
jmp 0x528b12
mov ecx, dword [0x6f48ac]
push esi
push ecx
mov ecx, 0x6e0b68
call fcn.00505440
test eax, eax
jne 0x528b84
lea ecx, [esp + 8]
call fcn.00545560
push 0
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x4c], 0
call fcn.00545200
mov ecx, dword [0x6f48ac]
lea edx, [esp + 8]
push edx
call fcn.0045f820
mov ecx, dword [0x6f48ac]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.004053d0
mov ecx, eax
call fcn.0053d420
mov edx, dword [0x6f5768]
mov dword [0x6fc680], edx
lea ecx, [esp + 8]
jmp 0x528cdb
test al, 4
je 0x528cee
mov eax, dword [0x6f48ac]
cmp byte [eax + 0x149], 0
jne 0x528b0d
push esi
call fcn.00527f50
add esp, 4
test eax, eax
je 0x528cee
mov ecx, dword [0x6f48ac]
cmp byte [ecx + 0x451], 0
je 0x528c85
mov eax, dword [esi + 0x129]
push eax
mov ecx, 0x6d86e0
call fcn.004cb840
test eax, eax
jne 0x528b66
mov edx, dword [0x6f48ac]
push esi
push edx
call fcn.0040cf00
mov ecx, eax
call fcn.00502540
test eax, eax
jne 0x528b84
mov eax, dword [0x6f48ac]
push esi
push eax
mov ecx, 0x6e0b68
call fcn.00505440
test eax, eax
jne 0x528b84
lea ecx, [esp + 0x20]
call fcn.00545560
push 0
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], 1
call fcn.00545200
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [0x6f48ac]
call fcn.0045f820
mov eax, dword [0x6f48ac]
push 0
lea edx, [esp + 0x24]
push edx
push eax
call fcn.004053d0
mov ecx, eax
call fcn.0053d420
mov ecx, dword [0x6f5768]
mov dword [0x6fc680], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], 0xffffffff
mov dword [0x6fc684], esi
call fcn.005451f0
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005825b3
add esp, 0x40
ret 8
Function at 0x52a030
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x114
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x18]
mov ebx, ecx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x52a057
movsx eax, byte [esi]
push eax
call fcn.0058586a
add esp, 4
test eax, eax
je 0x52a0cf
lea ecx, [esp + 0x18]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x52a13a
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp dword [eax], edi
je 0x52a0ce
nop
movsx edx, word [esi + 0xa]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00583ac0
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x20]
push 0x5b1924
push eax
call fcn.00582c5f
mov ecx, dword [esi + 0xc]
inc edi
lea eax, [ecx + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x52a090
pop edi
lea edx, [esp + 0x18]
push edx
push 0x20
push 0x6fba68
call fcn.005857b5
mov eax, dword [0x6fbaa8]
mov esi, dword [esp + 0x130]
imul eax, eax, 0x58
add esp, 0xc
cmp si, word [eax + 0x716560]
jne 0x52a117
cmp dword [0x6fba88], 0
je 0x52a117
cmp dword [0x6fbaa4], 0
jne 0x52a117
mov ecx, 0x6fba88
call fcn.0051c400
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
mov eax, ecx
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
xor ecx, esp
call fcn.005825b3
add esp, 0x114
ret 8

Function at 0x52a1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x3c]
mov bl, 0x53
push edi
mov edi, ecx
cmp byte [esi + 1], bl
jb 0x52a1f7
push 0
push 0xb6
push str.MHNetwork.cpp
call fcn.0052b690
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x56734661
mov dword [esp + 0x14], 0x31313561
mov byte [esp + 0x18], 0x41
mov byte [esp + 0x19], bl
mov dword [esp + 0x1a], 0x61637646
mov byte [esp + 0x1e], 0x4d
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], bl
mov dword [esp + 0x21], 0x40215e59
mov dword [esp + 0x25], 0x5a767324
mov dword [esp + 0x29], 0x26317241
mov dword [esp + 0x2d], 0x2a21405e
mov dword [esp + 0x31], 0x786673
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x52a254
sub eax, ecx
mov ecx, eax
xor edx, edx
lea ebx, [ecx - 1]
mov eax, ebp
div ebx
dec ecx
mov al, byte [esp + edx + 0x10]
xor byte [esi + 1], al
xor edx, edx
mov eax, ebp
div ecx
mov cl, byte [esp + edx + 0x10]
xor byte [esi + 2], cl
mov dl, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x52a2a6
mov edi, dword [edi + 0x114]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push ebp
push esi
push eax
push edi
call edx
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005825b3
add esp, 0x2c
ret 8
Function at 0x52b690
Capabilities:
Get file size

Disassembly:
sub esp, 0x2a0
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x29c], eax
cmp dword [0x6fcc08], 0
mov ecx, dword [esp + 0x2a4]
mov eax, dword [esp + 0x2ac]
je 0x52b70b
push eax
mov eax, dword [esp + 0x2ac]
push eax
push ecx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push 0x6fcb08
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6fcb08
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x52b84e
int3
mov edx, dword [esp + 0x2a8]
test eax, eax
je 0x52b730
push eax
push edx
push ecx
lea eax, [esp + 0x1a8]
push str._s_line:_d__msg:_s_
push eax
call fcn.00582c5f
add esp, 0x14
jmp 0x52b747
push edx
push ecx
lea eax, [esp + 0x1a4]
push str._s_line:_d_
push eax
call fcn.00582c5f
add esp, 0x10
push 0xff
lea ecx, [esp + 0xa1]
push 0
push ecx
mov byte [esp + 0xa8], 0
call fcn.005825d0
add esp, 0xc
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0xa]
movzx ecx, word [esp + 6]
movzx edx, word [esp + 4]
push eax
push ecx
push edx
lea eax, [esp + 0xa8]
push str.._Log_Assert__4d_02d_02d.txt
push eax
call fcn.00582c5f
add esp, 0x14
cmp dword [0x6fcc60], 0
jne 0x52b84e
push esi
push edi
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x52b81e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xa4]
push 0x5c1424
push eax
call fcn.00582c01
mov esi, eax
add esp, 8
test esi, esi
je 0x52b84c
call fcn.0052b980
push eax
lea ecx, [esp + 0x1a8]
push ecx
push str._stime:_s_n
push esi
call fcn.005835d1
push esi
call fcn.00582900
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.005825b3
add esp, 0x2a0
ret
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x52b7ca
mov dword [0x6fcc60], 1
pop edi
pop esi
mov ecx, dword [esp + 0x29c]
xor ecx, esp
call fcn.005825b3
add esp, 0x2a0
ret
Function at 0x52c8f0
Capabilities:
Get file size

Disassembly:
sub esp, 0x3a0
mov eax, dword [0x6e50b4]
xor eax, esp
mov dword [esp + 0x39c], eax
push esi
mov esi, dword [esp + 0x3b0]
push edi
mov edi, dword [esp + 0x3ac]
push 0x1ff
lea eax, [esp + 0x1a9]
push 0
push eax
mov byte [esp + 0x1b0], 0
call fcn.005825d0
add esp, 0xc
test esi, esi
je 0x52c958
mov ecx, dword [esp + 0x3b0]
push esi
push ecx
push edi
lea edx, [esp + 0x1b0]
push str._s_line:_d__msg:_s_
push edx
call fcn.00582c5f
add esp, 0x14
jmp 0x52c976
mov eax, dword [esp + 0x3b0]
push eax
push edi
lea ecx, [esp + 0x1ac]
push str._s_line:_d_
push ecx
call fcn.00582c5f
add esp, 0x10
push 0xff
lea edx, [esp + 0xa9]
push 0
push edx
mov byte [esp + 0xb0], 0
call fcn.005825d0
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0xc]
push ecx
push edx
push eax
lea ecx, [esp + 0xb0]
push str.._Log_Debug__4d_02d_02d.txt
push ecx
call fcn.00582c5f
add esp, 0x14
cmp dword [0x6fcfa8], 0
jne 0x52ca79
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x52ca4b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xa4]
push 0x5c1424
push ecx
call fcn.00582c01
mov esi, eax
add esp, 8
test esi, esi
je 0x52ca79
call fcn.0052b980
push eax
lea edx, [esp + 0x1a8]
push edx
push str._stime:_s_n
push esi
call fcn.005835d1
push esi
call fcn.00582900
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.005825b3
add esp, 0x3a0
ret
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 8]
shl esi, 0x10
push edi
or esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xf4240
jbe 0x52c9f7
mov dword [0x6fcfa8], 1
mov ecx, dword [esp + 0x3a4]
pop edi
pop esi
xor ecx, esp
call fcn.005825b3
add esp, 0x3a0
ret
Function at 0x53be90
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x5aaab8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6e50b4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
push 0xa
lea ecx, [esi + 0x48]
mov byte [esp + 0x24], 1
call fcn.0057cc80
lea ecx, [esi + 0x68]
mov byte [esp + 0x20], 2
call fcn.0053e140
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov dword [esi + 0x10c], edi
mov dword [esi + 0x110], edi
mov dword [esi + 0x114], edi
mov dword [esi + 0x124], edi
mov dword [esi + 0x128], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0x130], edi
mov dword [esi + 0x134], edi
mov dword [esi + 0x138], edi
mov dword [esi + 0x148], edi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x150], edi
mov dword [esi + 0x154], edi
mov dword [esi + 0x158], edi
mov dword [esi + 0x15c], edi
push 0x80
push str.g_PoolSTLIST
push 0x6e2c88
mov byte [esp + 0x2c], 9
call fcn.00583ef0
add esp, 0xc
mov dword [0x6e2c84], 0x32
cmp dword [0x6e2c7c], edi
jne 0x53c01f
push 0x64
push 0x6e2c7c
call fcn.0053d7d0
mov eax, dword [0x6e2c7c]
add esp, 8
mov dword [0x6e2c80], eax
push 0x1e
lea ecx, [esi + 0x94]
mov dword [esi + 0x64], edi
call fcn.0053d720
push 0x1e
lea ecx, [esi + 0xb8]
call fcn.0053d720
push 0x1e
lea ecx, [esi + 0xdc]
call fcn.0053d720
push 0x1e
lea ecx, [esi + 0x100]
call fcn.0053d720
push 3
lea ecx, [esi + 0x124]
call fcn.0053d720
mov dword [esi + 0x16c], edi
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x540c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ab18b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6e50b4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 8]
xor edi, edi
mov dword [esi], vtable.CSkillObjectTargetList.0
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
push 1
mov dword [esp + 0x1c], edi
call fcn.0053d720
mov eax, dword [esp + 0x20]
movzx ecx, word [eax + 0xb7]
mov word [esi + 0x30], cx
movzx edx, word [eax + 0xad]
mov word [esi + 0x32], dx
mov dword [esi + 0x2c], edi
movzx ecx, word [eax + 0x27]
mov word [esi + 0x34], cx
movzx edx, word [eax + 0x29]
mov word [esi + 0x36], dx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x54a350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ab876
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6e50b4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CEngineObject.0
mov edx, 0xffff
push 0xa
lea ecx, [esi + 0x40]
mov dword [esi + 0x30], 1
mov word [esi + 0x34], dx
call fcn.0057cc80
xor ebx, ebx
push 0xa
lea ecx, [esi + 0x5c]
mov dword [esp + 0x1c], ebx
call fcn.0057cc80
push 0xa
lea ecx, [esi + 0x78]
mov byte [esp + 0x1c], 1
call fcn.0057cc80
fld1
fstp dword [esi + 8]
mov dword [esi + 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], 0xffffffff
mov byte [esi + 0x28], bl
mov dword [esi + 0x20], 1
mov dword [esi + 0x3c], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x94], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x54be20
Capabilities:
Print debug messages

Disassembly:
push ebp
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov eax, dword [edi + 0x4c]
add eax, 0x493e0
cmp ebp, eax
jbe 0x54be88
cmp dword [edi + 0x10], 0
jle 0x54be7a
push esi
lea ecx, [edi + 4]
call fcn.0057d0f0
mov esi, eax
test esi, esi
je 0x54be79
mov ecx, dword [esi + 8]
push ecx
call fcn.00546c30
mov edx, dword [esi + 4]
add esp, 4
push edx
lea ecx, [edi + 0x20]
call fcn.0043eb00
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
push 0x5c3c78
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [edi + 0x4c], ebp
pop edi
pop ebp
ret
Function at 0x551060
Capabilities:
Print debug messages

Disassembly:
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
jne 0x55106f
xor eax, eax
ret 8
jmp 0x5559a0
mov edx, dword [esp + 4]
fld dword [edx]
sub esp, 8
fld qword [0x5b7dc8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jnp 0x555aa4
fldz
fcom dword [edx]
fnstsw ax
test ah, 0x41
je 0x555aa2
fld dword [edx + 8]
fcomp st(2)
fnstsw ax
fstp st(1)
test ah, 1
je 0x555aa4
fcomp dword [edx + 8]
fnstsw ax
test ah, 0x41
je 0x555aa6
push esi
fnstcw word [esp + 0x10]
mov esi, dword [esp + 0x14]
fld dword [esi + 8]
fld qword [0x5b69f8]
movzx eax, word [esp + 0x10]
fdiv st(1), st(0)
or eax, 0xc00
mov dword [esp + 0x14], eax
fldcw word [esp + 0x14]
fxch st(1)
fistp qword [esp + 4]
mov eax, dword [esp + 4]
push eax
fldcw word [esp + 0x14]
fld dword [esi]
fdiv st(1)
fnstcw word [esp + 0x14]
movzx eax, word [esp + 0x14]
or eax, 0xc00
mov dword [esp + 0x18], eax
fldcw word [esp + 0x18]
fistp qword [esp + 8]
mov eax, dword [esp + 8]
push eax
fldcw word [esp + 0x18]
fld dword [edx + 8]
fdiv st(1)
fnstcw word [esp + 0x18]
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x1c], eax
fldcw word [esp + 0x1c]
fistp qword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
fldcw word [esp + 0x1c]
fdivr dword [edx]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x20], eax
fldcw word [esp + 0x20]
fistp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
push edx
fldcw word [esp + 0x20]
call fcn.00554aa0
pop esi
add esp, 8
ret 8
fstp st(0)
fstp st(0)
push str._____________________________.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add esp, 8
ret 8
Function at 0x5527c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1f4], 0
push edi
je 0x55286f
mov edi, dword [esp + 0x14]
test edi, edi
je 0x55286f
push 0
push 1
push 0x719250
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
je 0x55286f
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [0x71923c], ecx
mov edx, dword [eax + 4]
mov dword [0x719240], edx
mov eax, dword [eax + 8]
mov dword [0x719244], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov dword [0x719230], ecx
mov edx, dword [eax + 4]
mov dword [0x719234], edx
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x18]
mov dword [0x719238], eax
mov ecx, dword [esi + 0x1f4]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x552730
push 0
push 0
mov dword [0x71924c], ecx
mov dword [0x719248], edi
mov dword [0x6e3a90], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x552876
push eax
push 0x719250
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
xor eax, eax
pop esi
ret 0x10
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x568580
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x56859e
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.0052b690
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x5685b6
cmp esi, 0x11
je 0x5685b6
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
ret 4