joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x4c
mov eax, dword [0x1003b270]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x60]
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov edi, dword [esp + 0x5c]
test edi, edi
mov dword [esp + 0x54], eax
je 0x100093ac
test ebp, ebp
je 0x100093ac
mov al, 0x98
mov byte [esp + 0x15], al
mov byte [esp + 0x1b], al
xor eax, eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov byte [esp + 0x10], 0xa
mov byte [esp + 0x11], 0x3d
mov byte [esp + 0x12], 0xdb
mov byte [esp + 0x13], 0
mov byte [esp + 0x14], 0x13
mov byte [esp + 0x16], 0x47
mov byte [esp + 0x17], 0x57
mov byte [esp + 0x18], 0x9c
mov byte [esp + 0x19], 1
mov byte [esp + 0x1a], 0x84
mov byte [esp + 0x1c], 0x70
mov byte [esp + 0x1d], 0xb0
mov byte [esp + 0x1e], 0x5e
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x7c
mov byte [esp + 0x21], 0x32
mov byte [esp + 0x22], 0xdd
mov byte [esp + 0x23], 0xe3
mov byte [esp + 0x24], 0x9d
mov byte [esp + 0x25], 7
mov byte [esp + 0x26], 0x4e
mov byte [esp + 0x27], 0x3a
mov byte [esp + 0x28], 0xa5
mov byte [esp + 0x29], 0x97
mov byte [esp + 0x2a], 0x5d
mov byte [esp + 0x2b], 0xc6
mov byte [esp + 0x2c], 0x4c
mov byte [esp + 0x2d], 0xd
mov byte [esp + 0x2e], 0x83
mov byte [esp + 0x2f], 0x11
mov byte [esp + 0x30], 0
mov dword [esp + 0x4d], eax
mov ecx, 0x20
lea esp, [esp]
movzx edx, byte [esp + eax + 0x10]
mov dl, byte [edx + str.http:__vas._s_interface_chathall_buy.htmlhttp:__vas._s_interface_chathall_buy.html_uid_I64dmcheck_snickname_shttp:__www0._s_interface_chathall_buy_aristocrat_vip.html_oemid_duid_I64dmcheck_snickname_shttp:__vip.17guagua.com]
mov byte [esp + eax + 0x30], dl
add eax, 1
sub ecx, 1
jne 0x10009340
push esi
xor esi, esi
call fcn.10016550
test eax, eax
mov dword [esp + 0x10], eax
je 0x10009397
mov edx, dword [eax]
push 0x20
lea ecx, [esp + 0x38]
push ecx
mov ecx, eax
call dword [edx + 4]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push ebx
push ebp
push eax
push edi
push 1
call dword [edx + 8]
lea ecx, [esp + 0x10]
push ecx
mov esi, eax
call fcn.10015ec0
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.1001590b
add esp, 0x4c
ret
mov ecx, dword [esp + 0x54]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1001590b
add esp, 0x4c
ret
Function at 0x10009510
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002ac98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4b0
mov eax, dword [0x1003b270]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
mov dword [esp + 0x4b0], eax
mov eax, dword [ebp + 0x10]
push edi
push 0x1002d578
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], eax
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
xor edi, edi
push ecx
mov dword [esp + 0x4c8], edi
call fcn.100093c0
mov edx, dword [eax]
push edx
lea eax, [esp + 0x18]
push 0x1002da38
push eax
mov byte [esp + 0x4d4], 1
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::Format]
add esp, 0x10
lea ecx, [esp + 0xc]
mov byte [esp + 0x4c4], 0
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov word [esp + 0x20], di
xor eax, eax
mov ecx, 0x20
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
push 0x40
lea ecx, [esp + 0x28]
push ecx
push 0x1002da34
push str.commender
push str.commend
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 2
jbe 0x10009604
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.MSVCR71.dll__wtoi64]
add esp, 4
test edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
jl 0x10009604
jg 0x100095fc
test eax, eax
jbe 0x10009604
mov byte [ebx], 1
jmp 0x100096a2
cmp byte [ebx], 0
jne 0x100096a2
xor eax, eax
mov word [esp + 0xa8], 0
mov ecx, 0x100
lea edi, [esp + 0xaa]
rep stosd dword es:[edi], eax
push str.http:__www.guagua.cn
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0x200
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT]
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xb4]
push ecx
push str.guagua_rec_id
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator_class_ATL::CSimpleStringT_]
push eax
call dword [sym.imp.WININET.dll_InternetGetCookieExW]
test eax, eax
je 0x10009698
mov edx, dword [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xb4]
push str.guagua_rec_id_d:_I64d:_d
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.MSVCR71.dll_swscanf]
mov dl, byte [esp + 0x28]
add esp, 0x14
mov byte [ebx], dl
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x4bc]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x4b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001590b
mov esp, ebp
pop ebp
ret
Function at 0x10009b80
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x38], edi
mov dword [esi + 0x14], eax
je 0x10009bb6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
cmp edi, 0xbb8
jge 0x10009bb5
push 0xa
call ebx
add edi, 0xa
cmp dword [esi + 0x38], 0
jne 0x10009ba0
pop ebx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x10009bd7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x38], 0
pop edi
pop esi
ret 4
Function at 0x1000ba90
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x1000b6d0
push 0
push 0
call dword [sym.imp.MSVCR71.dll__beginthreadex]
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x38], eax
pop esi
mov eax, ecx
ret

Function at 0x1000bad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1003b270]
xor eax, esp
cmp dword [esp + 0x1c], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
je 0x1000bbee
push ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
jle 0x1000bbed
test eax, eax
je 0x1000bbed
push esi
mov esi, dword [esp + 0x30]
test esi, esi
jle 0x1000bbec
lea eax, [ebp + ebp]
cmp esi, eax
jle 0x1000bbec
push ebx
push esi
call sub.MFC71U.DLL_SerializeElements
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000bbeb
mov ecx, esi
mov edx, ecx
push edi
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
xor esi, esi
test ebp, ebp
rep stosb byte es:[edi], al
mov byte [esp + 0x14], 0x30
mov byte [esp + 0x15], 0x31
mov byte [esp + 0x16], 0x32
mov byte [esp + 0x17], 0x33
mov byte [esp + 0x18], 0x34
mov byte [esp + 0x19], 0x35
mov byte [esp + 0x1a], 0x36
mov byte [esp + 0x1b], 0x37
mov byte [esp + 0x1c], 0x38
mov byte [esp + 0x1d], 0x39
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x62
mov byte [esp + 0x20], 0x63
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x23], 0x66
pop edi
jle 0x1000bbc9
mov ecx, ebx
mov eax, dword [esp + 0x28]
movzx eax, byte [esi + eax]
mov edx, eax
shr edx, 4
mov dl, byte [esp + edx + 0x10]
mov byte [ecx], dl
and eax, 0xf
mov al, byte [esp + eax + 0x10]
add ecx, 1
mov byte [ecx], al
add esi, 1
add ecx, 1
cmp esi, ebp
jl 0x1000bba0
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push eax
push ebx
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
call sub.MFC71U.DLL_operator_new
add esp, 4
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1001590b
add esp, 0x18
ret 0x10
Function at 0x1000bff0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1002b189
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x1003b270]
xor eax, esp
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0xc], eax
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_8]
lea eax, [esp + 8]
push eax
push 5
push 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x104
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_CRecordset::GetBoundParamIndex]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0xffffffffffffffff
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_CDC::ReleaseAttribDC]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push str.GGPlayer_FilesConfig
lea ecx, [esp + 8]
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::operator]
lea eax, [esp + 4]
push eax
mov ecx, esi
call dword [sym.imp.MFC71U.DLL_ATL::CStringT::CStringT_7]
lea ecx, [esp + 4]
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::CSimpleStringT]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1001590b
add esp, 0x18
ret 4
Function at 0x1000e930
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x494], 0
je 0x1000e944
xor eax, eax
pop esi
pop ecx
ret 8
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x1000e8d0
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x490], eax
mov dword [esi], ecx
mov dword [esi + 4], edx
mov eax, 1
pop esi
pop ecx
ret 8

Function at 0x1000edb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
mov eax, dword [0x1003b270]
xor eax, esp
push ebx
push esi
lea esi, [ecx + 0x1080]
push edi
mov ecx, esi
mov dword [esp + 0x30], eax
mov word [esp + 0xc], 0x7b
mov word [esp + 0xe], 0x7d
mov word [esp + 0x10], 0x3a
mov word [esp + 0x12], 0x22
mov word [esp + 0x14], 0x7c
mov word [esp + 0x16], 0x3c
mov word [esp + 0x18], 0x3e
mov word [esp + 0x1a], 0x3f
mov word [esp + 0x1c], 0x5b
mov word [esp + 0x1e], 0x5d
mov word [esp + 0x20], 0x3b
mov word [esp + 0x22], 0x27
mov word [esp + 0x24], 0x5c
mov word [esp + 0x26], 0x2c
mov word [esp + 0x28], 0x2e
mov word [esp + 0x2a], 0x2f
mov word [esp + 0x2c], 0
call dword [sym.imp.MFC71U.DLL_CRichEditView::EditStreamCallBack]
push 0
call dword [sym.imp.MSVCR71.dll_time]
push eax
call dword [sym.imp.MSVCR71.dll_srand]
mov ebx, dword [sym.imp.MSVCR71.dll_rand]
add esp, 8
mov edi, 8
call ebx
and eax, 0x8000000f
jns 0x1000ee71
dec eax
or eax, 0xfffffff0
inc eax
mov ax, word [esp + eax*2 + 0xc]
mov ecx, esi
push eax
call dword [sym.imp.MFC71U.DLL_ATL::CSimpleStringT::operator]
sub edi, 1
jne 0x1000ee63
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001590b
add esp, 0x28
ret

Function at 0x10012040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002b8b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov eax, dword [0x1003b270]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, dword [ecx + 0x10]
mov eax, dword [esp + 0x20]
cmp eax, esi
mov dword [esp + 0x18], 0
jbe 0x1001208f
mov edx, dword [ecx + 0xc]
push edi
lea edi, [esp + 0x28]
push edi
sub eax, esi
push eax
add edx, esi
push edx
push ecx
call fcn.10011b00
pop edi
jmp 0x100120a6
jae 0x100120a6
mov edx, dword [ecx + 0xc]
add esi, edx
push esi
push ecx
add edx, eax
push edx
push ecx
lea eax, [esp + 0x14]
push eax
call fcn.100119e0
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.1001590b
add esp, 0x18
ret 0x30
Function at 0x100163a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x7c
mov eax, dword [0x1003b270]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x20]
push esi
push eax
call fcn.100165a0
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
push ecx
push edx
lea eax, [esp + 0x30]
push eax
call fcn.10016f30
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.10017000
mov eax, dword [esp + 0xa4]
add esp, 0x18
mov byte [esp + 4], 0x30
mov byte [esp + 5], 0x31
mov byte [esp + 6], 0x32
mov byte [esp + 7], 0x33
mov byte [esp + 8], 0x34
mov byte [esp + 9], 0x35
mov byte [esp + 0xa], 0x36
mov byte [esp + 0xb], 0x37
mov byte [esp + 0xc], 0x38
mov byte [esp + 0xd], 0x39
mov byte [esp + 0xe], 0x61
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x10], 0x63
mov byte [esp + 0x11], 0x64
mov byte [esp + 0x12], 0x65
mov byte [esp + 0x13], 0x66
xor esi, esi
lea esp, [esp]
movzx ecx, byte [esp + esi + 0x14]
mov edx, ecx
shr edx, 4
movzx edx, byte [esp + edx + 4]
mov byte [eax], dl
and ecx, 0xf
movzx ecx, byte [esp + ecx + 4]
mov byte [eax + 1], cl
movzx ecx, byte [esp + esi + 0x15]
add eax, 1
mov edx, ecx
shr edx, 4
movzx edx, byte [esp + edx + 4]
mov byte [eax + 1], dl
and ecx, 0xf
movzx ecx, byte [esp + ecx + 4]
add eax, 1
mov byte [eax + 1], cl
movzx ecx, byte [esp + esi + 0x16]
add eax, 1
mov edx, ecx
shr edx, 4
movzx edx, byte [esp + edx + 4]
mov byte [eax + 1], dl
add eax, 1
and ecx, 0xf
movzx ecx, byte [esp + ecx + 4]
mov byte [eax + 1], cl
movzx ecx, byte [esp + esi + 0x17]
add eax, 1
mov edx, ecx
shr edx, 4
movzx edx, byte [esp + edx + 4]
add eax, 1
and ecx, 0xf
movzx ecx, byte [esp + ecx + 4]
mov byte [eax], dl
add eax, 1
mov byte [eax], cl
add esi, 4
add eax, 1
cmp esi, 0x10
jl 0x10016440
mov ecx, dword [esp + 0x7c]
pop esi
call fcn.1001590b
add esp, 0x7c
ret

Function at 0x100165a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x10017990
Capabilities:
Encrypt data using rc6

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
push edi
mov dword [ebx], 0xb7e15163
mov eax, 1
jmp 0x100179b0
mov ecx, dword [ebx + eax*4 - 4]
sub ecx, 0x61c88647
mov dword [ebx + eax*4], ecx
add eax, 1
cmp eax, 0x2c
jb 0x100179b0
mov eax, dword [esp + 0x38]
shr eax, 5
je 0x100179da
mov esi, dword [esp + 0x34]
mov ecx, eax
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
add eax, 0xffffffff
mov dword [esp + 0x3c], eax
xor esi, esi
xor edx, edx
xor ecx, ecx
xor eax, eax
mov edi, 0x84
mov edi, edi
mov ebp, dword [ebx + edx*4]
add ebp, ecx
add ebp, eax
rol ebp, 3
mov eax, ebp
mov ebp, dword [esp + esi*4 + 0x10]
add ecx, eax
add ebp, ecx
rol ebp, cl
cmp edx, 0x2b
mov dword [ebx + edx*4], eax
mov ecx, ebp
mov dword [esp + esi*4 + 0x10], ecx
jne 0x10017a18
xor edx, edx
jmp 0x10017a1b
add edx, 1
cmp esi, dword [esp + 0x3c]
jne 0x10017a25
xor esi, esi
jmp 0x10017a28
add esi, 1
sub edi, 1
jne 0x100179f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1001a460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1001a479
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x1001a48d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x1001a4ae
cmp esi, eax
jae 0x1001a487
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x1001a4a0
cmp esi, eax
jae 0x1001a487
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x1001a580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002bcab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd80
mov eax, dword [0x1003b270]
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0xd84], eax
mov dword [esp + 0xc], 0
call fcn.10006f70
mov cx, word [ebx + 0x30]
mov dx, word [ebx + 0x32]
mov eax, dword [ebx + 0xc]
mov word [esp + 0x24], cx
mov ecx, dword [ebx + 0x3c]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebx + 0x94]
mov word [esp + 0x26], dx
mov dl, byte [ebx + 0x88]
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 0x90]
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x30], dl
mov edx, dword [ebx + 0x98]
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], edx
lea esi, [ebx + 0x40]
mov ecx, 8
lea edi, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x61]
mov ecx, 8
lea edi, [esp + 0x65]
rep movsd dword es:[edi], dword [esi]
push 0x200
lea eax, [ebx + 0x9c]
push eax
lea ecx, [esp + 0xf2]
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCR71.dll_wcsncpy]
push ecx
call esi
push 0x40
lea edx, [ebx + 0x49e]
push edx
lea eax, [esp + 0x500]
push eax
call esi
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x520]
mov edx, dword [ebx + 0x524]
add esp, 0x18
test eax, eax
mov dword [esp + 0x570], ecx
mov dword [esp + 0x574], edx
je 0x1001a6ad
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1001a6ad
call fcn.10001040
mov dword [esp + 0x578], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [ebx + 0x528]
mov dword [esp + 0x580], edx
call fcn.1001fba0
mov byte [esp + 0x580], 0
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x581]
rep stosd dword es:[edi], eax
push 1
stosw word es:[edi], ax
push 0x800
lea ecx, [esp + 0x588]
push ecx
lea ecx, [esp + 0x1c]
stosb byte es:[edi], al
call fcn.10008a60
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0xd98], 0
call fcn.10006f90
lea ecx, [esp + 0x10]
call fcn.10008a80
push eax
lea eax, [esp + 0x584]
push eax
call fcn.1001eab0
add esp, 8
test eax, eax
je 0x1001a769
mov ecx, eax
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1001a720
mov ebx, dword [ebp + 0x10]
sub ecx, esi
mov edi, ecx
movzx ecx, word [ebx]
cmp edi, ecx
jge 0x1001a75f
cmp edi, 0x500
jg 0x1001a75f
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], 1
mov byte [edx], 0
mov ecx, eax
sub esi, eax
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x1001a752
mov word [ebx], di
push eax
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0xd94], 0xffffffff
call fcn.1000df20
mov ecx, dword [esp + 0xd8c]
mov eax, dword [esp + 0xc]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xd84]
call fcn.1001590b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001a960
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x1001a9a5
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1001a9a5
push esi
push edi
mov edi, dword [esp + 0x10]
xor dl, dl
jmp 0x1001a980
mov esi, dword [eax + 0xc]
movzx ecx, dl
shl ecx, 2
mov esi, dword [ecx + esi]
test esi, esi
je 0x1001a99c
mov esi, dword [esi]
inc dl
cmp dl, 0xa
mov dword [ecx + edi], esi
jb 0x1001a980
pop edi
movzx ax, dl
pop esi
ret 8
xor ax, ax
ret 8

Function at 0x1001b0d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x408
mov eax, dword [0x1003b270]
push esi
push edi
mov dword [esp + 0x40c], eax
mov edx, ecx
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0xff
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
add edx, 0x184c
push edx
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push str._sdataLoginError000.dat
push eax
call dword [sym.imp.MSVCR71.dll_swprintf]
lea ecx, [esp + 0x14]
push 0x1003431c
push ecx
call dword [sym.imp.MSVCR71.dll__wfopen]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1001b172
push 2
push 0
push esi
call dword [sym.imp.MSVCR71.dll_fseek]
mov edx, dword [ebp + 8]
push esi
push 1
push 0x318
push edx
call dword [sym.imp.MSVCR71.dll_fwrite]
push esi
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 0x20
mov eax, 1
mov ecx, dword [esp + 0x40c]
call fcn.1001590b
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x40c]
xor eax, eax
call fcn.1001590b
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001bf30
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x1002bd5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x1c], eax
push edi
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x24], eax
push 6
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], eax
call fcn.100017c0
add esp, 4
test al, al
je 0x1001bf9a
push str.CLoginSessionImpl::ConnectFourBackupDomain___Begin_Connect_4_Backup_Domain__n
push 0x393
push str..LoginSessionImpl.cpp
push 6
call fcn.10001810
add esp, 0xc
push eax
call fcn.10001a30
add esp, 8
lea esi, [edi + 0x530]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [edi + 0x1838], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
lea ebx, [ebx]
push 0x120
call sub.MFC71U.DLL_CWordArray::CWordArray
mov ebx, eax
add esp, 4
mov dword [esp + 0x18], ebx
cmp ebx, ebp
mov dword [esp + 0x34], ebp
je 0x1001c004
mov edi, ebx
mov ebp, 0xa
mov ecx, edi
call fcn.10008f40
add edi, 0x1c
dec ebp
jne 0x1001bfe2
xor eax, eax
mov ecx, 0x48
mov edi, ebx
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
mov eax, ebx
xor ebp, ebp
jmp 0x1001c006
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
push ebp
push eax
push 0x1001be20
push ebp
push ebp
mov dword [esp + 0x4c], 0xffffffff
mov word [eax + 0x11a], si
mov dword [eax + 0x11c], edi
call dword [sym.imp.MSVCR71.dll__beginthreadex]
add esp, 0x18
mov dword [esp + esi*4 + 0x1c], eax
inc esi
cmp esi, 4
jl 0x1001bfc0
push 0x1d4c0
push 1
lea edx, [esp + 0x24]
push edx
push 4
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor ebx, ebx
lea esi, [edi + 0x1828]
cmp ebx, dword [edi + 0x1838]
je 0x1001c076
mov ecx, dword [esi]
cmp ecx, ebp
je 0x1001c076
mov eax, dword [ecx]
call dword [eax + 0x10]
push esi
call fcn.10027df0
add esp, 4
mov dword [esi], ebp
inc ebx
add esi, 4
cmp ebx, 4
jl 0x1001c058
mov ecx, dword [edi + 0x28]
pop edi
xor eax, eax
pop esi
cmp ecx, 2
mov ecx, dword [esp + 0x24]
pop ebp
sete al
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x1001cdc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x724
mov eax, dword [0x1003b270]
push ebx
push esi
push edi
mov dword [esp + 0x72c], eax
mov edx, ecx
xor eax, eax
mov word [esp + 0x328], 0
mov ecx, 0xff
lea edi, [esp + 0x32a]
rep stosd dword es:[edi], eax
add edx, 0x184c
push edx
stosw word es:[edi], ax
lea eax, [esp + 0x32c]
push str._sdataLoginError000.dat
push eax
call dword [sym.imp.MSVCR71.dll_swprintf]
lea ecx, [esp + 0x334]
push 0x1002d77c
push ecx
call dword [sym.imp.MSVCR71.dll__wfopen]
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x1001ced0
push 0
push 0
push ebx
call dword [sym.imp.MSVCR71.dll_fseek]
push ebx
push 1
lea edx, [esp + 0x24]
xor eax, eax
push 0x318
mov ecx, 0xc6
lea edi, [esp + 0x28]
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x1c
cmp eax, 1
jne 0x1001cec6
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x1001ce9e
cmp eax, 0x3e8
jge 0x1001ce9e
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
mov edx, dword [esi + 4]
lea eax, [esp + 0x10]
push eax
push edx
push esi
call fcn.1001bb80
mov ecx, dword [ebp + 8]
push 1
mov edi, eax
call fcn.1001bbc0
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
push ebx
xor eax, eax
mov ecx, 0xc6
lea edi, [esp + 0x14]
push 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push 0x318
push ecx
call dword [sym.imp.MSVCR71.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x1001ce66
push ebx
call dword [sym.imp.MSVCR71.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0x72c]
mov eax, 1
call fcn.1001590b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4