joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62ecc0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
push edi
lea eax, [esp + 0x10]
xor edi, edi
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call ebp
mov ecx, dword [0x85550c]
mov edx, dword [0x855508]
mov eax, dword [esp + 0x28]
push ecx
push edx
push edi
push eax
call fcn.0078dc90
mov ecx, dword [esp + 0x10]
mov ebx, eax
mov eax, dword [esp + 0x14]
mov esi, edx
add ebx, ecx
adc esi, eax
cmp dword [0x855504], edi
jne 0x62ed25
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0062edb0
mov eax, dword [0x855504]
add esp, 4
cmp eax, edi
je 0x62eda3
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
push edx
mov dword [esp + 0x18], edi
call ebp
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, ebx
sub eax, ecx
mov ecx, esi
sbb ecx, edx
mov edx, dword [0x85550c]
push edx
mov edx, dword [0x855508]
push edx
push ecx
push eax
call fcn.007902c0
mov ecx, dword [0x855504]
push eax
call fcn.00661450
test eax, eax
je 0x62ed7a
mov ecx, dword [0x855504]
call fcn.00661260
mov dword [0x855504], edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edi
push eax
mov dword [esp + 0x20], edi
call ebp
mov ecx, dword [esp + 0x1c]
cmp ecx, esi
jl 0x62ed07
jg 0x62eda3
mov edx, dword [esp + 0x18]
cmp edx, ebx
jb 0x62ed07
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x630b90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 0x10]
push edi
mov edi, dword [esp + 8]
cmp eax, dword [edi + 0x10]
jne 0x630bdb
add eax, 0x1f
mov ecx, dword [ecx + 0x14]
cdq
and edx, 0x1f
push esi
add eax, edx
mov edx, dword [edi + 0x14]
sar eax, 5
shl eax, 2
xor esi, esi
test eax, eax
jle 0x630bd8
push ebx
sub edx, ecx
mov edi, eax
xor eax, eax
xor ebx, ebx
mov al, byte [edx + ecx]
mov bl, byte [ecx]
xor eax, ebx
xor ebx, ebx
mov bl, byte [eax + 0x855510]
add esi, ebx
inc ecx
dec edi
jne 0x630bbe
pop ebx
mov eax, esi
pop esi
pop edi
ret 4

Function at 0x630c20
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp eax, dword [esi + 0x10]
je 0x630c3d
fld dword [0x7cd7b4]
pop edi
pop esi
pop ebp
pop ecx
ret 4
add eax, 0x1f
mov ecx, dword [ecx + 0x14]
cdq
and edx, 0x1f
mov edi, dword [esi + 0x14]
add eax, edx
xor ebp, ebp
sar eax, 5
shl eax, 2
cmp eax, ebp
mov dword [esp + 0x14], ebp
jle 0x630ca5
push ebx
sub edi, ecx
mov dword [esp + 0x10], eax
xor edx, edx
xor eax, eax
mov dl, byte [ecx]
mov al, byte [edi + ecx]
mov esi, edx
mov edx, eax
xor edx, esi
xor ebx, ebx
or eax, esi
mov bl, byte [edx + 0x855510]
mov edx, dword [esp + 0x18]
add edx, ebx
mov dword [esp + 0x18], edx
xor edx, edx
mov dl, byte [eax + 0x855510]
mov eax, dword [esp + 0x10]
add ebp, edx
inc ecx
dec eax
mov dword [esp + 0x10], eax
jne 0x630c63
test ebp, ebp
mov dword [esp + 0x10], ebp
pop ebx
jne 0x630cb2
fld dword [0x7cd794]
pop edi
pop esi
pop ebp
pop ecx
ret 4
fild dword [esp + 0x14]
pop edi
pop esi
pop ebp
fidiv dword [esp]
fsubr dword [0x7cd794]
pop ecx
ret 4
Function at 0x6319b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x84
mov edx, dword [esp + 0x90]
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], eax
push 0x5546e0
push 3
lea eax, [esp + 0x3c]
xor ebx, ebx
lea ecx, [esp + 0x20]
push 0xc
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], 0x7df598
mov dword [esp + 0x40], edx
call fcn.00401000
mov eax, dword [esp + 0x98]
mov edi, 3
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x40], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x44], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x4c], ecx
mov ecx, dword [eax + 0x20]
fld dword [eax + 0x24]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x28]
mov dword [esp + 0x54], ecx
mov ecx, dword [eax + 0x2c]
fst dword [esp + 0x58]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x30]
fstp dword [esp + 0x70]
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x38]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x6c], edx
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x34]
mov dword [eax], ebx
lea edx, [esp + 0x64]
mov esi, 3
fld dword [edx]
fmul dword [ecx]
add ecx, 4
add edx, 4
fstp dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
and ebp, 0x7fffffff
dec esi
mov dword [esp + 0x10], ebp
fld dword [esp + 0x10]
fadd dword [eax]
fstp dword [eax]
jne 0x631a9d
add eax, 4
dec edi
jne 0x631a92
mov edx, dword [esp + 0x9c]
mov ecx, dword [esp + 0xa4]
mov al, 1
mov dword [esp + 0x88], edx
mov byte [esp + 0x8c], al
mov byte [esp + 0x8d], al
lea edx, [esp + 0x30]
lea eax, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov dword [esp + 0x98], eax
call fcn.00631780
mov ecx, dword [esp + 0x1c]
mov bl, al
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x7df598
cmp ecx, eax
je 0x631b34
lea ecx, [esp + 0x14]
call fcn.005ee710
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
cmp eax, ecx
jne 0x631b1f
lea ecx, [esp + 0x14]
call fcn.005ee2c0
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x84
ret 0x10
Function at 0x661290
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov edi, ecx
xor ebp, ebp
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [0x855c9c]
mov edx, dword [0x855c98]
mov eax, dword [esp + 0x34]
push ecx
push edx
push ebp
push eax
call fcn.0078dc90
mov ecx, dword [esp + 0x14]
lea esi, [edi + 0x54]
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
adc edx, eax
mov dword [esp + 0x2c], edx
cmp dword [esi + 8], ebp
je 0x6613b0
mov ecx, dword [esi]
mov ebx, dword [ecx + 4]
cmp ebx, ebp
mov dword [esp + 0x34], ebx
je 0x661300
mov edx, dword [ebx]
push ebp
mov ecx, ebx
call dword [edx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [esi]
mov ebp, 1
mov edx, dword [ecx + eax*4]
dec eax
cmp eax, 2
mov dword [esp + 0x10], edx
mov dword [esi + 8], eax
jb 0x661391
mov eax, dword [esi + 8]
lea edi, [ebp + ebp]
cmp edi, eax
je 0x661358
mov eax, dword [esi]
mov ebx, dword [eax + edi*4]
mov eax, dword [eax + edi*4 + 4]
test eax, eax
je 0x661353
test ebx, ebx
je 0x661354
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 8]
mov eax, dword [ebx]
mov ecx, ebx
fstp dword [esp + 0x14]
call dword [eax + 8]
fcomp dword [esp + 0x14]
fnstsw ax
test ah, 0x41
jne 0x661354
inc edi
mov ebx, dword [esp + 0x34]
mov ecx, dword [esi]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx + edi*4]
mov ecx, esi
push edx
push eax
call fcn.00664b70
test al, al
je 0x66138d
mov eax, dword [esi]
push ebp
mov ecx, dword [eax + edi*4]
mov dword [eax + ebp*4], ecx
mov edx, dword [esi]
mov ecx, dword [edx + ebp*4]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 8]
lea ecx, [edi + edi]
cmp ecx, eax
mov ebp, edi
jbe 0x66131a
mov edi, dword [esp + 0x1c]
mov edx, dword [esi]
mov eax, dword [esp + 0x10]
push ebp
mov dword [edx + ebp*4], eax
mov ecx, dword [esi]
mov ecx, dword [ecx + ebp*4]
mov edx, dword [ecx]
call dword [edx + 4]
test ebx, ebx
je 0x6613b0
lea eax, [ebx - 8]
test eax, eax
jne 0x6613b9
mov dword [edi + 0x28], 4
jmp 0x6613fa
mov ecx, dword [eax + 0x10]
mov edx, dword [edi + 0x38]
cmp ecx, edx
jne 0x6613f2
mov dword [edi + 0x28], 1
mov dword [edi + 0x64], eax
mov edx, dword [eax + 4]
inc edx
mov dword [eax + 4], edx
mov eax, dword [edi + 0x64]
test eax, eax
je 0x6613e9
mov byte [eax + 0x84], 1
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x6613db
mov ecx, edi
call fcn.00663760
jmp 0x6613fa
push eax
mov ecx, edi
call fcn.006626f0
mov eax, dword [edi + 0x28]
xor ebp, ebp
cmp eax, ebp
jne 0x661438
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebp
push edx
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
cmp eax, ecx
jl 0x6612e2
jg 0x661438
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
cmp ecx, eax
jb 0x6612e2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x66ccf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x5546e0
mov eax, dword [esi]
push 3
lea edx, [esp + 0x24]
push 0xc
mov cl, byte [eax + 0x38]
push edx
and ecx, 0xf
mov dword [esp + 0x28], 0x22
mov dword [esp + 0x24], ecx
call fcn.00401000
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x70]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x7c]
mov dword [esp + 0x24], edx
mov edx, dword [esi + 0x78]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0x80]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x8c]
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0x84]
mov dword [esp + 0x38], ecx
mov ecx, dword [esi + 0x90]
mov dword [esp + 0x44], eax
mov eax, dword [esi + 0x98]
mov dword [esp + 0x3c], edx
mov edx, dword [esi + 0x94]
mov dword [esp + 0x48], ecx
fld dword [esi + 0x88]
mov ecx, dword [esi + 0x9c]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0x54], ecx
fst dword [esp + 0x40]
fstp dword [esp + 0x58]
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], edx
lea eax, [esp + 0x64]
lea ecx, [esp + 0x1c]
mov ebx, 3
mov dword [eax], 0
lea edx, [esp + 0x4c]
mov edi, 3
fld dword [edx]
fmul dword [ecx]
add ecx, 4
add edx, 4
fstp dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
and ebp, 0x7fffffff
dec edi
mov dword [esp + 0x10], ebp
fld dword [esp + 0x10]
fadd dword [eax]
fstp dword [eax]
jne 0x66cdd1
add eax, 4
dec ebx
jne 0x66cdc2
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x80]
mov al, byte [esp + 0x84]
mov dword [esp + 0x70], ecx
mov cl, byte [esp + 0x88]
mov dword [esp + 0x78], edx
mov edx, dword [esi]
mov byte [esp + 0x74], al
mov byte [esp + 0x75], cl
push 0
mov ecx, dword [edx + 0x38]
mov eax, ecx
and ecx, 0xfffffff
shr eax, 0x1c
inc eax
shl eax, 0x1c
or ecx, eax
mov dword [edx + 0x38], ecx
mov ecx, dword [0x855444]
lea edx, [esp + 0x1c]
push edx
call fcn.00631780
mov esi, dword [esi]
pop edi
mov edx, dword [esi + 0x38]
mov ecx, edx
and edx, 0xfffffff
shr ecx, 0x1c
dec ecx
shl ecx, 0x1c
or edx, ecx
mov dword [esi + 0x38], edx
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 0xc
Function at 0x6720b0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x14
lea ecx, [esp]
push ebx
push 0x856078
call fcn.005e6fa0
mov al, byte [0x855f64]
mov ebx, dword [esp + 0x1c]
test al, 1
je 0x672104
mov ecx, dword [0x856090]
test ecx, ecx
je 0x672104
lea edx, [esp + 8]
mov dword [esp + 8], 0x3f800000
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 0x10], 0x3f800000
mov dword [esp + 0x14], 0x3f800000
mov eax, dword [ecx]
push edx
push ebx
call dword [eax + 4]
test byte [0x855f64], 2
je 0x67211b
push ebx
push 0x855f68
call fcn.0077acc0
add esp, 8
mov al, byte [0x855f64]
push esi
test al, 0x10
je 0x67215f
mov eax, dword [str._logfile.txt]
push 0x7f55dc
push eax
call fcn.0078ce49
mov esi, eax
add esp, 8
test esi, esi
je 0x67215f
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push esi
push ecx
push 1
push ebx
call fcn.0078cc8d
push esi
call fcn.0078cc10
add esp, 0x14
pop edi
mov al, byte [0x855f64]
pop esi
test al, 0x20
je 0x672170
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 4]
call fcn.005e6fd0
pop ebx
add esp, 0x14
ret

Function at 0x672510
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x855f6c]
sub esp, 0x814
test al, 0x80
je 0x672639
mov ecx, dword [esp + 0x818]
lea eax, [esp + 0x81c]
push eax
lea edx, [esp + 0x418]
push ecx
push edx
call fcn.0078dbe6
add esp, 0xc
lea eax, [esp + 0x414]
lea ecx, [esp + 0x14]
mov byte [esp + 0x813], 0
push eax
push str.NET_PROLIFIC:_s_n
push ecx
call fcn.0078cdc6
add esp, 0xc
lea ecx, [esp]
push 0x856078
call fcn.005e6fa0
test byte [0x855f64], 1
je 0x6725b5
mov ecx, dword [0x856090]
test ecx, ecx
je 0x6725b5
lea eax, [esp + 4]
mov dword [esp + 4], 0x3f800000
push eax
mov dword [esp + 0xc], 0x3f800000
mov dword [esp + 0x10], 0x3f800000
mov dword [esp + 0x14], 0x3f800000
mov edx, dword [ecx]
lea eax, [esp + 0x18]
push eax
call dword [edx + 4]
test byte [0x855f64], 2
je 0x6725d0
lea ecx, [esp + 0x14]
push ecx
push 0x855f68
call fcn.0077acc0
add esp, 8
mov al, byte [0x855f64]
push esi
test al, 0x10
je 0x67261b
mov edx, dword [str._logfile.txt]
push 0x7f55dc
push edx
call fcn.0078ce49
mov esi, eax
add esp, 8
test esi, esi
je 0x67261b
push edi
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push esi
push ecx
lea eax, [esp + 0x24]
push 1
push eax
call fcn.0078cc8d
push esi
call fcn.0078cc10
add esp, 0x14
pop edi
mov al, byte [0x855f64]
pop esi
test al, 0x20
je 0x672630
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp]
call fcn.005e6fd0
add esp, 0x814
ret
Function at 0x69df70
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0069dd10
jmp fcn.005d7b60
Function at 0x761470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x68
push esi
mov esi, ecx
mov ecx, dword [0x855650]
push edi
push eax
call fcn.006349a0
mov edi, eax
test edi, edi
je 0x76164c
push ebx
lea ecx, [esp + 0x24]
call fcn.0066d880
mov ecx, dword [esi + 0x774]
push ecx
lea ecx, [esp + 0x28]
call fcn.0066d920
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc8]
fstp dword [esp + 0x28]
mov ecx, esi
call fcn.00678990
fld dword [eax + 0x10c]
mov edx, dword [esp + 0x6c]
mov ecx, dword [esi + 0xbc8]
lea eax, [esp + 0x24]
or edx, 8
fstp dword [esp + 0x24]
push eax
mov dword [esp + 0x70], edx
call fcn.00780c90
mov ecx, dword [esi + 0xbc8]
push 1
call fcn.0077fa80
mov ecx, dword [esi + 0xbc8]
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x7c]
push edx
mov dword [ecx + 0x3c], 0x40a00000
mov ecx, dword [esi + 0xbc8]
push eax
push edi
call fcn.0077f480
mov ecx, dword [esi + 0xbc8]
xor ebx, ebx
xor eax, eax
mov dword [ecx + 0x68], 7
mov ecx, dword [edi + 0x28]
test ecx, ecx
lea edx, [ecx - 1]
mov dword [esp + 0x78], edx
jle 0x761584
push ebp
xor edx, edx
test eax, eax
jl 0x761548
cmp eax, ecx
jge 0x761548
mov edx, dword [edi + 0x1c]
mov edx, dword [edx + eax*4]
mov ebp, dword [esp + 0x80]
cmp dword [edx + 0x10], ebp
jne 0x761556
mov ebx, eax
xor edx, edx
test eax, eax
jl 0x761566
cmp eax, ecx
jge 0x761566
mov edx, dword [edi + 0x1c]
mov edx, dword [edx + eax*4]
mov ebp, dword [esp + 0x84]
cmp dword [edx + 0x10], ebp
jne 0x76157a
mov edx, eax
mov dword [esp + 0x7c], edx
jmp 0x76157e
mov edx, dword [esp + 0x7c]
inc eax
cmp eax, ecx
jl 0x761538
pop ebp
xor eax, eax
test ebx, ebx
jl 0x761594
cmp ebx, ecx
jge 0x761594
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + ebx*4]
mov ebx, dword [eax + 0x14]
mov dword [esp + 0x18], ebx
mov ebx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], eax
xor eax, eax
test edx, edx
pop ebx
jl 0x7615ba
cmp edx, ecx
jge 0x7615ba
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx + edx*4]
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0x18]
mov dword [esp + 8], edx
mov edx, dword [eax + 0x1c]
lea edi, [esi + 0xb14]
mov dword [esp + 0xc], ecx
push 1
mov ecx, edi
mov dword [esp + 0x14], edx
call fcn.007374d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0xb24], eax
mov eax, dword [esp + 8]
mov dword [esi + 0xb28], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xb2c], edx
mov edx, dword [esp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], edx
mov dword [esi + 0xb8c], 0x3f800000
mov dword [esi + 0xb90], 0x41200000
mov ecx, dword [esi + 0xa08]
mov eax, 2
cmp ecx, eax
je 0x761643
mov dword [esi + 0xa08], eax
lea ecx, [esp + 0x20]
call fcn.0066d910
pop edi
pop esi
add esp, 0x68
ret 0xc
Function at 0x771e40
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
push esi
push edi
push 0
push 2
mov esi, ecx
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x771e64
pop edi
xor al, al
pop esi
add esp, 0x14
ret 0xc
mov edi, dword [esp + 0x20]
mov word [esp + 0xc], 2
push edi
call sub.WSOCK32.dll_htons
mov word [esp + 0xe], ax
mov al, byte [esp + 0x24]
test al, al
je 0x771e89
push 0x7f000001
jmp 0x771e92
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x771e91
push eax
call sub.WSOCK32.dll_htonl
mov ecx, dword [esi + 4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push 0x10
push eax
push ecx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x771ec1
mov ecx, esi
call fcn.00771f20
pop edi
xor al, al
pop esi
add esp, 0x14
ret 0xc
mov edx, dword [esi + 4]
push 4
push 0x815b1c
push 0x1002
push 0xffff
push edx
mov dword [esi + 8], edi
call sub.WSOCK32.dll_setsockopt
mov eax, dword [esi + 4]
push 4
push 0x815b18
push 0x1001
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x14], 1
call sub.WSOCK32.dll_ioctlsocket
pop edi
mov al, 1
pop esi
add esp, 0x14
ret 0xc

Function at 0x772020
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], 4
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x772075
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push 0x1007
push 0xffff
push eax
call sub.WSOCK32.dll_getsockopt
mov eax, dword [esp + 4]
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push eax
push ecx
push 0x1007
push 0xffff
push edx
mov dword [esp + 0x1c], 0
call sub.WSOCK32.dll_setsockopt
pop esi
add esp, 8
ret
Function at 0x772850
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [ecx + 0xa7cc]
mov ecx, dword [ecx + 0xa7d0]
push ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 8], ecx
xor ecx, ecx
test ebx, ebx
mov dword [esp + 4], eax
jle 0x77289c
push esi
push edi
mov edi, dword [esp + 0x18]
mov al, byte [ecx + edi]
mov edx, ecx
and edx, 7
add al, cl
sub al, 0x32
lea esi, [esp + edx + 0xc]
mov dl, byte [esp + edx + 0xc]
xor al, dl
mov byte [ecx + edi], al
xor dl, al
inc ecx
mov byte [esi], dl
cmp ecx, ebx
jl 0x772878
pop edi
pop esi
pop ebx
add esp, 8
ret 8

Function at 0x7728b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [ecx + 0xa7cc]
mov ecx, dword [ecx + 0xa7d0]
push ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 4], eax
xor eax, eax
test ebp, ebp
mov dword [esp + 8], ecx
jle 0x7728fd
push esi
push edi
mov edi, dword [esp + 0x18]
mov dl, byte [eax + edi]
mov ecx, eax
and ecx, 7
lea esi, [esp + ecx + 0xc]
mov cl, byte [esp + ecx + 0xc]
xor cl, dl
mov dl, cl
mov byte [esi], cl
sub dl, al
add dl, 0x32
mov byte [eax + edi], dl
inc eax
cmp eax, ebp
jl 0x7728d8
pop edi
pop esi
pop ebp
add esp, 8
ret 8

Function at 0x772c80
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
add esp, 0x190
ret
Function at 0x772d90
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x58
push ebp
lea eax, [esp + 4]
push edi
push eax
push 0xf003f
push 0
push str.SoftwareGameSpyGameSpy_3DRegistration
push bind
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0xc]
mov ebp, eax
mov eax, dword [esp + 8]
push ecx
lea edx, [esp + 0x14]
push 0x86a9c4
neg ebp
push edx
push 0
sbb ebp, ebp
push str.Crypt
push eax
neg ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x772e04
mov edi, 0x86a9c4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x13
je 0x772f78
push esi
mov ecx, 0xf
mov esi, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x1c]
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x772e33
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edi, eax
jmp 0x772e35
xor edi, edi
push 0
call fcn.0078e45e
add esp, 4
mov esi, eax
call fcn.0079088c
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
xor esi, edi
je 0x772e5c
and esi, 0x7fffffff
jmp 0x772e61
mov esi, 1
mov dword [0x815b2c], esi
xor edi, edi
cmp edi, 4
je 0x772f07
cmp edi, 9
je 0x772f07
cmp edi, 0xe
je 0x772f07
mov eax, esi
and esi, 0xffff
shr eax, 0x10
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 4
add ecx, eax
lea edx, [ecx + ecx*2]
mov ecx, esi
lea edx, [eax + edx*2]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 4
add eax, ecx
lea eax, [eax + eax*2]
lea eax, [ecx + eax*2]
mov ecx, edx
and ecx, 0x7fff
shl ecx, 0x10
add eax, ecx
cmp eax, 0x7fffffff
jbe 0x772edf
and eax, 0x7fffffff
inc eax
shr edx, 0xf
add eax, edx
cmp eax, 0x7fffffff
jbe 0x772ef1
and eax, 0x7fffffff
inc eax
mov esi, eax
mov ecx, 0x3e
cdq
idiv ecx
mov dl, byte [esp + edx + 0x24]
mov byte [edi + 0x86a9c4], dl
jmp 0x772f0e
mov byte [edi + 0x86a9c4], 0x2d
inc edi
cmp edi, 0x13
jl 0x772e69
mov dword [0x815b2c], esi
mov byte [0x86a9d7], 0
test ebp, ebp
pop esi
je 0x772f51
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareGameSpyGameSpy_3DRegistration
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, 0x86a9c4
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 8]
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x86a9c4
push 1
push eax
push str.Crypt
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
push 0x86a9c9
push 0x86a9c8
call fcn.0078c350
push 4
push 0x86a9ce
push 0x86a9cc
call fcn.0078c350
push 4
push 0x86a9d3
push 0x86a9d0
call fcn.0078c350
add esp, 0x24
mov byte [0x86a9d4], 0
mov eax, 0x86a9c4
pop edi
pop ebp
add esp, 0x58
ret