joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5181f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x511
ja 0x518230
cmp dword [ebp - 8], 0x511
je 0x51823b
cmp dword [ebp - 8], 0x100
je 0x5182b0
cmp dword [ebp - 8], 0x501
je 0x5182ae
jmp 0x5182b2
cmp dword [ebp - 8], 0x565
je 0x51826e
jmp 0x5182b2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
je 0x51825c
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.00518430
jmp 0x51826c
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.005182d0
jmp 0x5182c8
mov edx, dword [ebp - 4]
add edx, 0x1e8
cmp dword [ebp + 0xc], edx
jne 0x5182ac
mov eax, dword [ebp - 4]
add eax, 0x590
push eax
mov ecx, 0x68d090
call fcn.0041aea0
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x438
call fcn.00432d00
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
call eax
jmp 0x5182c8
jmp 0x5182c8
jmp 0x5182c8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004428d0
jmp 0x5182ca
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x519930
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
sub eax, dword [ecx + 0xf98]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0xf9c]
jbe 0x519a17
push 0
push 0
mov eax, dword [0x6de30c]
mov edx, dword [eax]
mov ecx, dword [0x6de30c]
mov eax, dword [edx + 0x5c]
call eax
movzx ecx, al
test ecx, ecx
jne 0x519977
jmp 0x519a1f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
mov dword [edx + 0xf98], eax
mov eax, dword [0x6e0f74]
mov edx, dword [eax]
mov ecx, dword [0x6e0f74]
mov eax, dword [edx + 0x14]
call eax
movzx ecx, al
test ecx, ecx
jne 0x5199fd
mov edx, dword [0x6de30c]
mov eax, dword [edx]
mov ecx, dword [0x6de30c]
mov edx, dword [eax + 0x60]
call edx
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x6de310]
mov edx, dword [eax]
mov ecx, dword [0x6de310]
mov eax, dword [edx + 0x28]
call eax
test eax, eax
je 0x5199e3
mov ecx, dword [0x6de310]
mov edx, dword [ecx]
mov ecx, dword [0x6de310]
mov eax, dword [edx + 0x20]
call eax
push 0
push 1
call fcn.004652e0
add esp, 8
test eax, eax
je 0x5199fd
mov ecx, dword [ebp - 4]
call fcn.00519580
jmp 0x519a1f
call fcn.0043ac40
mov ecx, dword [0x6de30c]
mov edx, dword [ecx]
mov ecx, dword [0x6de30c]
mov eax, dword [edx + 0x60]
call eax
jmp 0x519a1f
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret
Function at 0x51c3d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x56a
ja 0x51c410
cmp dword [ebp - 0x10], 0x56a
je 0x51c58b
cmp dword [ebp - 0x10], 0x20a
je 0x51c58d
cmp dword [ebp - 0x10], 0x565
je 0x51c422
jmp 0x51c591
cmp dword [ebp - 0x10], 0x5c9
je 0x51c58f
jmp 0x51c591
mov ecx, dword [ebp - 0xc]
add ecx, 0x14c4
cmp dword [ebp + 0xc], ecx
jne 0x51c442
mov ecx, dword [ebp - 0xc]
call fcn.0051e390
call fcn.0051bb10
jmp 0x51c589
mov edx, dword [ebp - 0xc]
add edx, 0x2c4
cmp dword [ebp + 0xc], edx
jne 0x51c45f
push 1
mov ecx, dword [ebp - 0xc]
call fcn.0051c8c0
jmp 0x51c589
mov eax, dword [ebp - 0xc]
add eax, 0x5c4
cmp dword [ebp + 0xc], eax
jne 0x51c47b
push 2
mov ecx, dword [ebp - 0xc]
call fcn.0051c8c0
jmp 0x51c589
mov ecx, dword [ebp - 0xc]
add ecx, 0x8c4
cmp dword [ebp + 0xc], ecx
jne 0x51c498
push 3
mov ecx, dword [ebp - 0xc]
call fcn.0051c8c0
jmp 0x51c589
mov edx, dword [ebp - 0xc]
add edx, 0xbc4
cmp dword [ebp + 0xc], edx
jne 0x51c4cf
push 1
push 0x641178
push str.BingoMachine:ApplyAward
mov eax, dword [ebp - 0xc]
add eax, 0x1ba
push eax
mov ecx, dword [0x6de314]
push ecx
call fcn.00538d00
add esp, 0x14
jmp 0x51c589
mov edx, dword [ebp - 0xc]
add edx, 0xec4
cmp dword [ebp + 0xc], edx
jne 0x51c506
push 2
push 0x641178
push str.BingoMachine:ApplyAward
mov eax, dword [ebp - 0xc]
add eax, 0x1ba
push eax
mov ecx, dword [0x6de314]
push ecx
call fcn.00538d00
add esp, 0x14
jmp 0x51c589
mov edx, dword [ebp - 0xc]
add edx, 0x11c4
cmp dword [ebp + 0xc], edx
jne 0x51c589
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x8818]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
push 0x641178
push str.BingoMachine:ApplyRotate
mov eax, dword [ebp - 0xc]
add eax, 0x1ba
push eax
mov ecx, dword [0x6de314]
push ecx
call fcn.00538d00
add esp, 0x14
push 0
call dword [sym.imp.MSVCR80.dll__time32]
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x881c], eax
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1b9], 0
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [0x6de088]
push edx
push 0x51d350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x2c0], eax
jmp 0x51c5a5
jmp 0x51c5a5
jmp 0x51c5a5
jmp 0x51c5a5
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.004428d0
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51e3c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x68b740]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], ecx
push str.config.ini
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.engine.dll_void___cdecl_g_GetFullPath_char___unsigned_int__char_const__]
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
push 0
push str.AwardPosition
push str.Client
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612c78
mov esp, ebp
pop ebp
ret
Function at 0x525750
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x68b740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x358]
push ecx
call sub.MSVCR80.dll_strcpy
add esp, 8
push 0x646920
lea edx, [ebp - 0x358]
push edx
call sub.MSVCR80.dll_strcat
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x250]
push ecx
call sub.MSVCR80.dll_strcpy
add esp, 8
push 0x63b960
lea edx, [ebp - 0x250]
push edx
call sub.MSVCR80.dll_strcat
add esp, 8
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x358]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0xffffffff
jne 0x5257db
xor eax, eax
jmp 0x525940
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x358]
push eax
call sub.MSVCR80.dll_strcpy
add esp, 8
mov byte [ebp - 0x359], 1
movzx ecx, byte [ebp - 0x359]
test ecx, ecx
je 0x525929
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x5258ff
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00525710
add esp, 4
test eax, eax
je 0x525838
jmp 0x5257f8
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x250]
push eax
call sub.MSVCR80.dll_strcat
add esp, 8
mov ecx, dword [ebp - 0x148]
and ecx, 0x10
je 0x5258a5
lea edx, [ebp - 0x250]
push edx
call fcn.00525750
add esp, 4
test eax, eax
jne 0x525880
mov eax, dword [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x525940
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x250]
push eax
call sub.MSVCR80.dll_strcpy
add esp, 8
jmp 0x5258fd
mov ecx, dword [ebp - 0x148]
and ecx, 1
je 0x5258c5
push 0x80
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.MSVCR80.dll__chmod]
add esp, 8
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x5258e7
mov ecx, dword [ebp - 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x525940
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x250]
push eax
call sub.MSVCR80.dll_strcpy
add esp, 8
jmp 0x525924
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x525913
mov byte [ebp - 0x359], 0
jmp 0x525924
mov ecx, dword [ebp - 0x360]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x525940
jmp 0x5257f8
mov edx, dword [ebp - 0x360]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612c78
mov esp, ebp
pop ebp
ret
Function at 0x5266b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x68b740]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], 0
push str.config.ini
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.engine.dll_void___cdecl_g_GetFullPath_char___unsigned_int__char_const__]
add esp, 0xc
xor ecx, ecx
cmp dword [0x6de400], 4
sete cl
test ecx, ecx
je 0x526724
lea edx, [ebp - 0x110]
push edx
push 1
push str.CanOpenUrlWhenExit
push str.Client
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x114], eax
jmp 0x52672e
mov dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612c78
mov esp, ebp
pop ebp
ret

Function at 0x5267d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x5c], ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x5267fe
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x5c]
call fcn.00526820
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x526812
push 1
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
ret 8
Function at 0x5279c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x5279c9
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x527a0a
mov eax, dword [ebp - 0xc]
jmp 0x527a60
cmp dword [ebp - 4], 1
je 0x527a1d
cmp dword [ebp - 4], 2
je 0x527a1d
mov eax, 0xd
jmp 0x527a60
cmp dword [ebp + 0xc], 0
je 0x527a56
cmp dword [ebp - 8], 0
je 0x527a50
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 1
div ecx
test edx, edx
jne 0x527a47
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
movsx eax, byte [edx - 1]
test eax, eax
je 0x527a4e
mov eax, 0xd
jmp 0x527a60
jmp 0x527a56
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x530a40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x574
mov eax, dword [0x68b740]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x574], ecx
mov eax, dword [ebp - 0x574]
add eax, 0xc
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x440]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x438], edx
mov eax, dword [ebp - 0x438]
mov ecx, dword [eax]
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 4], edx
jne 0x530a9d
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [ebp - 0x440]
mov dword [ebp - 8], eax
jmp 0x530ada
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x444], edx
lea ecx, [ebp - 8]
call fcn.005345f0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x428], eax
mov ecx, dword [ebp - 0x444]
mov dword [ebp - 0x424], ecx
mov edx, dword [ebp - 0x574]
add edx, 0xc
mov dword [ebp - 0x45c], edx
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x430], 0
mov edx, dword [ebp - 0x458]
mov dword [ebp - 0x42c], edx
jne 0x530b16
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 8], 0
je 0x530b33
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x430]
je 0x530b39
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [ebp - 4]
xor eax, eax
cmp edx, dword [ebp - 0x42c]
sete al
movzx ecx, al
neg ecx
sbb ecx, ecx
add ecx, 1
movzx edx, cl
test edx, edx
je 0x530c46
cmp dword [ebp - 8], 0
jne 0x530b68
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 4]
jne 0x530b79
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
call fcn.0052c910
cmp dword [ebp + 8], eax
jne 0x530c41
mov ecx, dword [ebp - 0x574]
cmp dword [ecx + 0xc0], 0
je 0x530bf0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
jne 0x530bf0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov eax, dword [0x6dfb0c]
push eax
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 8
push 0
lea edx, [ebp - 0x418]
push edx
call fcn.004a5d20
add esp, 8
jmp 0x530c46
mov ecx, dword [ebp - 0xc]
call fcn.0052c960
movsx eax, ax
mov dword [ebp - 0x420], eax
mov cx, word [ebp - 0x420]
mov word [ebp - 0x432], cx
lea edx, [ebp - 0x432]
push edx
mov ecx, dword [ebp - 0x574]
call fcn.00530d90
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0052c910
push eax
call fcn.0048a870
add esp, 8
jmp 0x530c46
jmp 0x530aa8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00612c78
mov esp, ebp
pop ebp
ret 4
Function at 0x547a30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x630a69
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x68b740]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x68b740]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
mov esi, ecx
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 8]
push eax
lea ecx, [esi + 8]
mov dword [esp + 0x34], 0
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00612c78
add esp, 0x2c
ret 4
Function at 0x54fe80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x630d58
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x68b740]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebp, ebp
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov ecx, 0x1e0
lea eax, [esi + 0xb0]
lea ebx, [ebx]
mov dword [eax], 0xffffffff
add eax, 0x14
sub ecx, 1
jns 0x54fed0
mov ecx, 0x1e0
lea eax, [esi + 0x2644]
lea esp, [esp]
mov dword [eax], 0xffffffff
add eax, 0x14
sub ecx, 1
jns 0x54fef0
lea edi, [esi + 0x4c04]
mov ecx, edi
call fcn.00597740
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea ecx, [esi + 0x4c10]
mov dword [esp + 0x1c], ebp
call dword [sym.imp.engine.dll_public:_void___thiscall_KLinkArray::constructor_void_]
lea ecx, [esi + 0x4c1c]
mov byte [esp + 0x1c], 1
call dword [sym.imp.engine.dll_public:_void___thiscall_KLinkArray::constructor_void_]
mov dword [esi + 0x4c30], 0x64e65c
mov dword [esi + 0x4c40], ebp
mov dword [esi + 0x4c48], ebp
mov dword [esi + 0x4c44], ebp
mov dword [esi + 0x4c3c], ebp
lea edi, [esi + 0x4c60]
mov ecx, edi
mov byte [esp + 0x1c], 3
call fcn.00597740
mov dword [edi + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
push fcn.005e7430
push fcn.005e6f50
push 0xf
push 0x1c
lea eax, [esi + 0x4c70]
push eax
mov byte [esp + 0x30], 4
call fcn.00612f01
xor eax, eax
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x4c28], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x4c2c], ebp
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x4c50], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x56ebd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x56ebe7
cmp byte [eax + 7], 1
je 0x56ebe7
mov dword [esp + 4], eax
jmp fcn.0056d450
ret 4
Function at 0x586950
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x58695f
mov al, 1
pop esi
pop ecx
ret
push ebx
push ebp
push edi
push 0x2710
lea ecx, [esi + 0x6b5fc]
call fcn.00585050
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0x34], eax
call edi
cmp dword [esi + 0x34], 0
mov dword [esi + 0x30], eax
je 0x5869f3
test eax, eax
je 0x5869f3
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ebp, [esi + 0x6c]
push ebp
call edi
lea ebx, [esi + 0x54]
push ebx
call edi
lea eax, [esi + 0x3c]
push eax
call edi
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x5865b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x325bc], eax
je 0x5869e1
pop edi
pop ebp
pop ebx
mov byte [esi + 4], 1
mov al, 1
pop esi
pop ecx
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [esi + 0x3c]
push eax
call edi
push ebx
call edi
push ebp
call edi
mov ecx, dword [esi + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esi + 0x34]
xor ebx, ebx
push edx
mov dword [esi + 0x30], ebx
call edi
pop edi
pop ebp
mov dword [esi + 0x34], ebx
pop ebx
xor al, al
pop esi
pop ecx
ret
Function at 0x5923b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x68b740]
xor eax, esp
mov dword [esp + 0x20], eax
jmp 0x5923c4
mov eax, dword [0x8e48f4]
mov ecx, dword [eax + 0x8c44]
mov edx, dword [0x12c5540]
imul ecx, ecx, 0x113b8
lea ecx, [ecx + edx + 0x130d]
lea edx, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x5923e5
lea ecx, [esp]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
add ecx, 1
test al, al
jne 0x592400
sub ecx, edx
push esi
mov esi, ecx
and esi, 3
shr ecx, 2
lea edx, [esp + 4]
mov eax, 0x7da9
je 0x592433
nop
sub ecx, 1
lea eax, [eax + ecx + 0x66058fea]
xor dword [edx], eax
add edx, 4
test ecx, ecx
ja 0x592420
test esi, esi
jbe 0x592449
xor byte [edx], al
movzx ecx, byte [edx + 1]
add edx, 1
sub esi, 1
xor eax, ecx
test esi, esi
ja 0x592437
lea edx, [esp + 4]
push edx
mov byte [esp + 0x27], 0
call dword [sym.imp.engine.dll_unsigned_long_int___cdecl_g_HashString2Id_char_const__]
mov ecx, dword [esp + 0x28]
add esp, 4
add eax, 0x41
pop esi
xor ecx, esp
xor eax, 0x8235
call fcn.00612c78
add esp, 0x24
ret

Function at 0x592480
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x68b740]
xor eax, esp
mov dword [esp + 0x20], eax
jmp 0x592494
mov eax, dword [0x8e48f4]
mov ecx, dword [eax + 0x8c44]
mov edx, dword [0x12c5540]
imul ecx, ecx, 0x113b8
lea ecx, [ecx + edx + 0x130d]
lea edx, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x5924b5
lea ecx, [esp]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
add ecx, 1
test al, al
jne 0x5924d0
mov eax, dword [esp + 0x28]
sub ecx, edx
push esi
mov esi, ecx
and esi, 3
shr ecx, 2
lea edx, [esp + 4]
je 0x592503
mov edi, edi
sub ecx, 1
lea eax, [eax + ecx + 0x2e6d23c1]
xor dword [edx], eax
add edx, 4
test ecx, ecx
ja 0x5924f0
xor eax, esi
test esi, esi
jbe 0x59251f
lea esp, [esp]
xor byte [edx], al
sub esi, 1
add edx, 1
shr eax, 8
test esi, esi
ja 0x592510
lea eax, [esp + 4]
push eax
mov byte [esp + 0x27], 0
call dword [sym.imp.engine.dll_unsigned_long_int___cdecl_g_HashString2Id_char_const__]
mov ecx, dword [esp + 0x28]
add esp, 4
pop esi
xor ecx, esp
add eax, 0x41
call fcn.00612c78
add esp, 0x24
ret

Function at 0x59bd80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x632fa8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x68b740]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov edx, 1
mov dword [eax + 0x18], ecx
mov dword [eax + 4], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x18]
mov dword [eax], vtable.KTongRecordList.0
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret 4
Function at 0x5a01a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x633173
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x68b740]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov ebx, 1
push ebx
push 2
call fcn.0059b060
lea esi, [edi + 0x28]
xor eax, eax
mov dword [edi], vtable.KTongUnion.0
mov dword [esi + 0x18], eax
mov dword [esi + 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esi], vtable.KStructDataClass_struct_KTongUnion::tagKPrivateData_.0
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esp + 0x1c], eax
mov dword [esi + 0x38], eax
mov byte [esp + 0x1c], bl
lea ebx, [edi + 0x64]
push eax
mov ecx, ebx
call fcn.0059fbc0
mov eax, dword [edi + 8]
mov dword [eax], esi
mov ecx, dword [edi + 8]
mov dword [ecx + 4], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x5a0300
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6331a3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x68b740]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.KTongUnion.0
lea ecx, [esi + 0x64]
mov dword [esp + 0x14], 1
call fcn.0055bfb0
mov eax, dword [esi + 0x30]
test eax, eax
mov dword [esi + 0x28], vtable.KDataBaseClass.0
je 0x5a035c
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x30], 0
mov ecx, esi
mov dword [esi + 0x34], 1
mov dword [esp + 0x14], 0xffffffff
call fcn.0059b300
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret