joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9f00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push esi
mov esi, ecx
call ebx
cmp dword [esi + 0xf4], 0
jne 0x4a9f24
mov dword [esi + 0xf4], eax
sub eax, dword [esi + 0xf4]
cmp eax, 0x1388
jbe 0x4aa006
mov ecx, dword [esi + 0xd0]
mov eax, dword [esi + 0xdc]
mov dword [esi + 0xe4], eax
test ecx, ecx
jle 0x4a9f5f
jmp 0x4a9f50
test eax, eax
je 0x4a9f5c
mov eax, dword [eax]
mov dword [esi + 0xe4], eax
dec ecx
jne 0x4a9f50
push edi
push 0
push 2
mov dword [ebp - 0x1a8], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4aa005
lea ecx, [ebp - 0x1a8]
push ecx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4a9ff6
nop
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0x80]
push 0x5a4038
push eax
call fcn.0056ecd0
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
mov ecx, esi
call fcn.004a5280
test eax, eax
je 0x4a9fe5
mov ecx, 0x6e6608
call fcn.0051adb0
push 0x230
mov ecx, 0x6d8178
call fcn.004ca5b0
push eax
push 1
push 0x179e
push 0x6d5870
call fcn.00442d20
add esp, 0x10
lea edx, [ebp - 0x1a8]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4a9f90
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [esi + 0xf4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bc460
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x6c1ba5], 0
push esi
mov esi, ecx
je 0x4bc483
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
mov dword [0x6d70b8], eax
mov byte [0x6c1ba5], 0
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xc]
mov edx, eax
sub edx, ecx
mov dword [0x6d70b8], eax
cmp eax, ecx
jae 0x4bc49a
dec edx
mov dword [0x6d70a0], edx
mov dword [esi + 0xc], eax
mov eax, dword [0x6d70a0]
add dword [0x6d70a4], eax
add dword [esi + 8], eax
cmp dword [esi + 8], 0x5265c00
jb 0x4bc4c4
inc dword [esi + 4]
add dword [esi + 8], 0xfad9a400
pop esi
ret
Function at 0x4c4ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c4af2
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp + 8]
push ecx
push 0x520
lea edx, [edi + 0x524]
push edx
push esi
call ebx
test eax, eax
jne 0x4c4b22
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
push 0
lea eax, [ebp + 8]
push eax
push 0xc0
add edi, 0xb04
push edi
push esi
call ebx
push esi
test eax, eax
je 0x4c4b13
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
Function at 0x4c8a80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x5a52d8
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c8ab6
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
je 0x4c8af6
cmp dword [ebp - 8], 0x61208
jne 0x4c8af6
push 0
lea edx, [ebp - 4]
push edx
push 0xac
add ebx, 4
push ebx
push esi
call edi
test eax, eax
jne 0x4c8b06
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], 0xac
push esi
ja 0x4c8af7
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c8b30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push str.._ini_GameOption.opt
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c8b95
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 4]
push ecx
push esi
mov dword [ebp - 4], 0x61208
call edi
push 0
lea edx, [ebp - 8]
push edx
push 0xac
add ebx, 4
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c9670
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x9720], eax
push edi
lea edi, [ecx + 0x9720]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
mov eax, dword [ecx + 0x9708]
mov ecx, dword [ecx + eax*4 + 0x96e0]
push edx
mov dword [ebp - 8], edi
call fcn.0042f640
test eax, eax
je 0x4c984b
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4c96e5
cmp ecx, 0xffb9f145
je 0x4c96e5
cmp ecx, 0xff01d1f7
je 0x4c96e5
cmp ecx, 0xfff0ff00
je 0x4c96e5
cmp ecx, 0xfff7b618
je 0x4c96e5
cmp ecx, 0xffebc3ce
jne 0x4c984b
push ebx
lea ebx, [eax + 4]
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c96f0
sub eax, edx
push esi
mov dword [ebp - 0x10], eax
mov esi, 0
je 0x4c9706
mov esi, ebx
xor ebx, ebx
cmp byte [esi], 0x5b
jne 0x4c9849
xor ecx, ecx
inc esi
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 4], ecx
cmp eax, ecx
jle 0x4c9849
cmp byte [ecx + esi], 0x5d
jne 0x4c9794
xor eax, eax
lea edi, [ebx + 1]
push edi
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
lea eax, [ebp - 0x24]
push esi
push eax
mov dword [ebp - 0xc], 1
mov byte [ebp - 0x24], 0
call fcn.0051bcc0
push 5
push 0x5a53fc
push esi
call fcn.0057145a
add esp, 0x18
test eax, eax
je 0x4c977a
push 5
push 0x5a5404
push esi
call fcn.0057145a
add esp, 0xc
test eax, eax
jne 0x4c979f
cmp dword [ebp + 8], 0
jne 0x4c979f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ebx, edi
mov edi, dword [ebp - 8]
mov dword [ebp + 8], 1
jmp 0x4c9795
inc ebx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, eax
jl 0x4c9725
jmp 0x4c97a2
mov edi, dword [ebp - 8]
cmp ebx, 0x10
jg 0x4c9849
cmp dword [ebp - 0xc], 0
je 0x4c9849
cmp dword [ebp + 8], 0
je 0x4c97c0
add ebx, 2
jmp 0x4c97c1
inc ebx
push ebx
push esi
push edi
call fcn.0051bcc0
mov ecx, dword [0x6c77c0]
add esp, 0xc
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c9849
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x12
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4c981c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x12
push edi
push eax
mov byte [eax], 0
call fcn.0051bcc0
add esp, 0xc
push esi
push 7
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
push 0x65e
mov ecx, 0x6d8178
call fcn.004ca5b0
push eax
push 0x1d
push 0x6d8178
call fcn.004cb820
add esp, 0x10
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4e4380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fa5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push 0x3d
lea eax, [esi + 0x4c]
push ebx
push eax
mov dword [esi], vtable.COBalloonName.0
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x148], ebx
mov byte [esi + 0x14c], bl
mov dword [esi + 0x90], 0xffffff
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.0056e7c0
xor eax, eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov byte [esi + 0xa4], al
mov dword [esi + 0xa5], eax
mov dword [esi + 0xa9], eax
mov dword [esi + 0xad], eax
mov dword [esi + 0xb1], eax
mov dword [esi + 0xb5], eax
mov dword [esi + 0xb9], eax
mov dword [esi + 0xbd], eax
mov dword [esi + 0xc1], eax
mov byte [esi + 0xc5], al
mov dword [esi + 0xc6], eax
mov dword [esi + 0xca], eax
mov dword [esi + 0xce], eax
mov dword [esi + 0xd2], eax
mov dword [esi + 0xd6], eax
mov dword [esi + 0xda], eax
mov dword [esi + 0xde], eax
mov dword [esi + 0xe2], eax
mov byte [esi + 0xe6], al
mov dword [esi + 0xe7], eax
mov dword [esi + 0xeb], eax
mov dword [esi + 0xef], eax
mov dword [esi + 0xf3], eax
mov dword [esi + 0xf7], eax
mov dword [esi + 0xfb], eax
mov dword [esi + 0xff], eax
mov dword [esi + 0x103], eax
mov byte [esi + 0x107], al
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], eax
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], eax
mov dword [esi + 0x118], eax
mov dword [esi + 0x11c], eax
mov dword [esi + 0x120], eax
mov dword [esi + 0x124], eax
mov byte [esi + 0x128], al
mov dword [esi + 0x129], eax
mov dword [esi + 0x12d], eax
mov dword [esi + 0x131], eax
mov dword [esi + 0x135], eax
push 0x144
mov byte [esi + 0x139], al
call fcn.0056ee41
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4e453f
mov ecx, eax
call fcn.00430400
jmp 0x4e4541
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x154], eax
mov dword [esi + 0x150], ebx
mov dword [esi + 0x168], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x13c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4e70b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fbb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [edi], vtable.CQuestManager.0
mov dword [ebp - 0x10], edi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
mov dword [ebp - 4], esi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], esi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], esi
mov dword [edi + 0x4c], esi
mov dword [edi + 0x50], esi
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
mov dword [edi + 0x5c], esi
mov dword [edi + 0x60], esi
mov dword [edi + 0x70], esi
mov dword [edi + 0x74], esi
mov dword [edi + 0x78], esi
mov dword [edi + 0x7c], esi
mov dword [edi + 0x80], esi
mov dword [edi + 0x84], esi
lea ecx, [edi + 0x98]
mov byte [ebp - 4], 3
call fcn.004e6ad0
lea ecx, [edi + 0x144]
mov byte [ebp - 4], 4
call fcn.004e9fd0
push 0x3e8
lea ecx, [edi + 4]
mov byte [ebp - 4], 5
call fcn.00562410
push 0xc8
lea ecx, [edi + 0x28]
call fcn.00562410
push 0x3e8
lea ecx, [edi + 0x4c]
call fcn.00562410
push 0x64
lea ecx, [edi + 0x70]
call fcn.00562410
push 4
call fcn.0056ee41
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 6
cmp eax, esi
je 0x4e719d
mov ecx, eax
call fcn.004e8eb0
jmp 0x4e719f
xor eax, eax
push 0x80
mov dword [edi + 0x94], eax
lea eax, [edi + 0xc0]
push esi
push eax
call fcn.0056e7c0
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [edi + 0x140], esi
mov dword [edi + 0x178], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4e9fd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58fc9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esi], vtable.CNewbieGuide.0
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
push 0x60
mov dword [ebp - 4], edi
call fcn.00562410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4eee10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590226
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
push edi
mov edi, ecx
mov dword [edi], vtable.CPKManager.0
mov dword [ebp - 0x10], edi
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
lea ecx, [edi + 0x40]
mov dword [ebp - 4], eax
call fcn.00569de0
push 3
lea ecx, [edi + 0x1c]
mov byte [ebp - 4], 1
mov dword [edi + 0xc], 0xea60
call fcn.00562410
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4f17b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f186c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 4]
push ecx
push 4
lea edx, [ebp + 8]
push edx
push esi
call edi
test eax, eax
je 0x4f1804
cmp dword [ebp + 8], 0x6060801
je 0x4f1814
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [ebp - 4]
push eax
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push esi
call edi
push esi
test eax, eax
je 0x4f1805
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebx + 0x1c], 0
je 0x4f186b
mov ecx, dword [0x6d617c]
test ecx, ecx
je 0x4f186b
mov edx, dword [ebp - 0xc]
push edx
call fcn.00491db0
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x6d617c]
push eax
call fcn.004911d0
fld dword [ebp - 8]
push 0
push ecx
fstp dword [esp]
push 0
mov ecx, 0x7034c0
call fcn.005480b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4f1880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x6d617c]
sub esp, 0x14
test ecx, ecx
je 0x4f190a
push esi
call fcn.00491da0
fld dword [0x703500]
mov edx, dword [ebp + 8]
push 0
push 0x80
push 2
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [0x6d617c]
mov cx, word [eax + 0x688]
fstp dword [ebp - 0xc]
push 0
push 0x40000000
push edx
mov word [ebp - 0x14], cx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4f1909
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 4]
push ecx
push esi
mov dword [ebp - 4], 0x6060801
call edi
push 0
lea edx, [ebp - 8]
push edx
push 0xc
lea eax, [ebp - 0x14]
push eax
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4f2710
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x4f27fb
push ebx
push edi
push 0
mov ecx, 0x703de8
call fcn.005551b0
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [ebp - 0x104]
push str._sData
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
push 0
lea ecx, [ebp - 0x104]
push ecx
call ebx
mov edx, dword [esi + 0x18]
push edx
push 0
mov ecx, 0x703de8
call fcn.005551b0
push eax
lea eax, [ebp - 0x104]
push str._sData_d
push eax
call edi
add esp, 0x10
push 0
lea ecx, [ebp - 0x104]
push ecx
call ebx
mov bl, byte [ebp + 8]
test bl, 1
je 0x4f27c3
mov eax, dword [esi + 0x18]
push eax
push eax
push 0
mov ecx, 0x703de8
call fcn.005551b0
push eax
lea edx, [ebp - 0x104]
push str._sData_d_d.UII
push edx
call edi
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
mov ecx, esi
call fcn.004f20f0
test bl, 2
je 0x4f27f9
mov eax, dword [esi + 0x18]
push eax
push eax
push 0
mov ecx, 0x703de8
call fcn.005551b0
push eax
lea ecx, [ebp - 0x104]
push str._sData_d_d.UIS
push ecx
call edi
add esp, 0x14
lea edx, [ebp - 0x104]
push edx
mov ecx, esi
call fcn.004f1880
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4f9810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59060b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esi], vtable.CGuildFieldWar.0
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
push 0x14
mov dword [ebp - 4], edi
call fcn.00562410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4fe270
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59079d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi], vtable.CEventMap.0
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
lea ecx, [esi + 0x58]
mov dword [ebp - 4], ebx
call fcn.0042cd10
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 1
call fcn.0042cd10
lea ecx, [esi + 0x98]
mov byte [ebp - 4], 2
call fcn.0042cd10
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 3
call fcn.0042cd10
push 0x3e8
lea ecx, [esi + 4]
mov byte [ebp - 4], 4
call fcn.00562410
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0xd8], ebx
xor eax, eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov byte [esi + 0x48], al
mov dword [esi + 0x54], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x501c40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5908a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
push 0xa
mov byte [ebp - 4], 1
call fcn.00562410
push 0x14
lea ecx, [esi + 0x24]
call fcn.00562410
mov ecx, esi
call fcn.005013b0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x506870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x5a849c
xor bl, bl
push eax
mov esi, ecx
mov byte [ebp - 1], bl
call fcn.0056ec72
mov edi, eax
add esp, 8
test edi, edi
je 0x506949
push edi
push 0x118
lea ecx, [esi + 0x14]
push 1
push ecx
call fcn.0056f629
add esp, 0x10
cmp eax, 0x118
jne 0x506914
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x11c]
lea ecx, [eax + edx*2]
cmp dword [esi + 0x120], ecx
jne 0x506914
mov edx, dword [esi + 0x124]
push edx
call fcn.0056e108
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
je 0x506914
mov ebx, dword [esi + 0x124]
push edi
push ebx
push 1
push eax
call fcn.0056f629
add esp, 0x10
cmp ebx, eax
jne 0x506911
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x11c]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov byte [ebp - 1], 1
mov bl, byte [ebp - 1]
push edi
call fcn.0056e971
add esp, 4
test bl, bl
jne 0x506938
mov eax, dword [esi + 0x10]
test eax, eax
je 0x506938
push eax
call fcn.0056ee2b
add esp, 4
mov dword [esi + 0x10], 0
pop edi
mov byte [esi + 0x128], bl
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x507ef0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x5097a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x590a98
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x5098e8
cmp byte [edi + 0x49], bl
je 0x5098e8
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
jne 0x5097f3
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x509815
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
push esi
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x50982e
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x50986d
dec eax
je 0x509871
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x5098d0
call fcn.00429240
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x509881
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, ecx
je 0x5098aa
cmp ebx, 0x10
jae 0x509890
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0056eb3c
add esp, 0x10
cmp esi, eax
jne 0x5098c8
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x5098cd
test esi, esi
jne 0x509822
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.005095b0
jmp 0x50981c
lea ecx, [ebp - 0x2c]
jmp 0x509855
lea ecx, [ebp - 0x2c]
call fcn.00429240
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x50b960
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push 0xff
lea eax, [ebp - 0x100]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x100]
push 0x5c
push ecx
call fcn.00571990
mov byte [eax + 1], 0
mov eax, dword [ebp + 0x14]
add esp, 8
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x50b997
push esi
push edi
lea edi, [ebp - 0x100]
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x50b9b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x100]
push edx
mov edx, dword [ebp + 8]
push 0xff
mov ecx, eax
mov eax, dword [ebp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret