joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402458
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402497
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402497
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402497
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402497
cmp dword [ecx + 0x74], 0xe
jbe 0x402497
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x406280
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4062ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4062ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40662d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4159d8
push 0x4159d0
push str.FlsAlloc
push 0x1f
call fcn.00406910
mov esi, eax
add esp, 0x10
test esi, esi
je 0x406661
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x406667
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4066ab
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4159e8
push 0x4159e0
push str.FlsGetValue
push 0x21
call fcn.00406910
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4066e2
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4066ea
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4159f0
push 0x4159e8
push str.FlsSetValue
push 0x22
call fcn.00406910
mov esi, eax
add esp, 0x10
test esi, esi
je 0x406724
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40be6b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40bf08
push ebx
push esi
call fcn.0040bf0b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bd6f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40beb5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bf07
push edi
push eax
call fcn.00408858
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40bed5
call fcn.00407bb2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bf06
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bd6f
add esp, 0x20
test eax, eax
jne 0x40bef4
push edi
call fcn.00407bb2
jmp 0x40befc
push ebx
call fcn.00407bb2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x424a40ca
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x235774
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x40891e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
add edx, edx
call fcn.00408938
xor dword [eax], ebx
sub esi, 0xe1f907c3
inc eax
cmp eax, edi
jne fcn.0040891e
ret
Function at 0x402000
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.kernel32.dll_GetACP]
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
call fcn.0040142a
push 0x7eff
push 0
call fcn.00401451
call dword [0x40652a]
adc eax, 0x40652a
mov dword [0x403071], eax
mov ebx, 0x7f00
push ebx
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov ebx, 0x403059
mov dword [0x403069], 0x400000
mov dword [0x40306d], 0
push ebx
call dword [sym.imp.user32.dll_RegisterClassA]
call fcn.0040100f
push edi
sbb byte [eax], al
xor bh, byte [ecx - 0x19]
xchg esi, eax
push es
add byte [ebp + ebp + 0x7d9e3], cl
mov eax, 0xd29a9e8
add bh, dl
and cl, byte [eax]
daa
adc dword [eax], eax
in al, dx
dec edx
or eax, 0x9f00120d
jno 0x40201e
or dword [edi], ecx
add byte [edx + 0x50], ch
stosd dword es:[edi], eax
push cs
verw word [esi + 0x1040c48c]
add byte [ebx], ah
hlt

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x421fe0
Capabilities:
Get geographical location

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jle 0x42206e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp dword [esp + 0x18], 0x2d
jne 0x42202c
push 0
push str.tabukojugacefofehevugijumapo_lezegiyoritatureguhikihubumuw_xaxeharufutogokurulumifadasovac_vubecifuwibugawiculedodov_cezotoburosuhipijavor
call edi
push str.fidodekodinifobuyox
push str.mayuretubayazihexe
push str.fetodidibamonasuyifiluhib
push str.vizuzecizeyasufuhizosusi
call ebx
push 0
call ebp
call fcn.00421f30
mov ecx, dword [esp + 0x14]
xor byte [esi + ecx], al
cmp dword [esp + 0x18], 0xf
jne 0x422064
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push str.lavenoxatorav
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [esp + 0x18]
jl 0x422002
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc], 0x2d
pop esi
jne 0x42208a
mov dword [0x433a08], 0xa62e7790
mov dword [0x433a0c], 0xffffffff
ret
Function at 0x422430
Capabilities:
Access the windows event log
Set file attributes

Disassembly:
mov eax, dword [0x4339fc]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov ebp, 0x1519a5
lea esp, [esp]
mov dword [0x433664], 0x8e46a7b8
cmp eax, 0x3dc
jne 0x42247a
push 0
push str.gajaracuvegipozatoxesom
call esi
push str.kimezufiyutodojaxejuweg
push 0
push 0
call edi
mov eax, dword [0x4339fc]
dec ebp
jne 0x422450
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
xor esi, esi
mov ebp, 0xec58acac
lea ebx, [ebx]
cmp eax, 0x997
jne 0x4224a2
push 0
push 0
call edi
mov eax, dword [0x4339fc]
cmp esi, 0x846373
jne 0x4224b9
mov eax, dword [0x431ad0]
add eax, 0xa231
mov dword [0x4339fc], eax
cmp eax, 0x141
jne 0x4224d0
mov dword [0x433238], ebp
mov dword [0x43323c], 0xffffffff
inc esi
cmp esi, 0x123c962
jl 0x422490
call fcn.004220d0
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
Function at 0x41e6b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x49e598]
push ebx
xor ebx, ebx
push ebp
push esi
cmp eax, ebx
push edi
mov ebp, ecx
je 0x41e735
mov edx, eax
mov eax, dword [0x49e594]
dec edx
lea esi, [eax + 1]
mov dword [0x49e598], edx
cmp esi, 0x10
jl 0x41e6dc
mov esi, 1
lea ecx, [esi + esi*8]
shl ecx, 5
cmp byte [ecx + 0x49f7e8], bl
jne 0x41e70b
inc esi
cmp esi, 0x10
jl 0x41e6f5
mov esi, 1
cmp esi, eax
je 0x41e8d5
lea edx, [esi + esi*8]
shl edx, 5
cmp byte [edx + 0x49f7e8], bl
je 0x41e6ea
xor edx, edx
mov ecx, esi
call dword [0x49e638]
cmp byte [0x4b60f4], bl
je 0x41e735
mov eax, dword [0x4bf19c]
mov ecx, dword [0x4bf1a4]
cmp eax, ecx
jne 0x41e735
xor dl, dl
mov ecx, esi
call fcn.00428c50
call fcn.00417270
mov esi, eax
mov al, byte [0x4b6573]
or edi, 0xffffffff
cmp al, bl
je 0x41e7a5
cmp esi, ebx
jle 0x41e79f
mov dword [0x495b40], edi
mov dword [0x495b44], edi
mov byte [0x4b64f4], bl
mov byte [0x4b64f5], bl
call fcn.0040f830
mov edx, 1
mov ecx, esi
call dword [0x49e638]
mov al, byte [0x4b60f4]
mov byte [0x4b6573], bl
cmp al, bl
je 0x41e7a5
mov ecx, dword [0x4bf19c]
mov eax, dword [0x4bf1a4]
cmp ecx, eax
jne 0x41e7a5
mov dl, 1
mov ecx, esi
call fcn.00428c50
jmp 0x41e7a5
mov byte [0x4b6573], bl
mov eax, dword [ebp]
cmp eax, ebx
mov al, byte [0x4b64f5]
jne 0x41e87a
cmp al, bl
jne 0x41e87e
cmp dword [0x49e590], ebx
jne 0x41e8d5
mov eax, dword [0x495b40]
cmp esi, ebx
jle 0x41e85a
cmp esi, eax
je 0x41e7e5
call fcn.0040f830
mov byte [0x4b64f4], bl
cmp byte [0x4b6570], bl
jne 0x41e819
mov ecx, 2
call fcn.0040fc50
test eax, eax
jne 0x41e807
mov edx, esi
mov ecx, 2
call fcn.0040fa00
mov al, byte [0x4b6570]
mov byte [0x4b64f4], 1
cmp al, bl
je 0x41e84f
jmp 0x41e821
cmp byte [0x4b64f4], bl
je 0x41e84f
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x41e84f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x41e84f
mov byte [0x4b64f5], 1
mov dword [0x495b44], esi
or dword [ebp], 0x40000000
mov dword [0x495b40], esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, edi
je 0x41e863
call fcn.0040f830
mov dword [0x495b40], edi
pop edi
pop esi
mov byte [0x4b64f4], bl
mov byte [0x4b64f5], bl
pop ebp
pop ebx
ret
cmp al, bl
je 0x41e8d5
cmp byte [0x4b6570], bl
jne 0x41e8d5
mov ecx, dword [0x495b44]
cmp esi, ecx
jne 0x41e8b8
xor edx, edx
call dword [0x49e638]
cmp byte [0x4b60f4], bl
je 0x41e8b8
mov edx, dword [0x4bf19c]
mov eax, dword [0x4bf1a4]
cmp edx, eax
jne 0x41e8b8
xor dl, dl
mov ecx, esi
call fcn.00428c50
mov dword [0x495b40], edi
mov dword [0x495b44], edi
mov byte [0x4b64f4], bl
mov byte [0x4b64f5], bl
call fcn.0040f830
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41f300
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov ebp, ecx
push 0x10
call esi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x41f328
push 0x10
call edi
test ah, 0x80
jne 0x41f328
xor bl, bl
jmp 0x41f32a
mov bl, 1
push 0x12
call esi
test ah, 0x80
jne 0x41f337
push 0x12
call edi
push 0x11
call esi
test ah, 0x80
jne 0x41f34d
push 0x11
call edi
test ah, 0x80
jne 0x41f34d
xor cl, cl
jmp 0x41f34f
mov cl, 1
lea eax, [ebp - 0xd]
cmp eax, 0x1b
ja case.0x41f363.20
xor edx, edx
mov dl, byte [eax + 0x41f448]
jmp dword [edx*4 + 0x41f428]
test bl, bl
je 0x41f39f
test cl, cl
jne 0x41f39f
xor eax, eax
mov ax, word [0x4bf1d4]
add eax, 2
cmp eax, 0xa
jle 0x41f397
pop edi
pop esi
pop ebp
mov word [0x4bf1d4], 0xa
mov byte [0x4b64d2], 1
pop ebx
ret
add word [0x4bf1d4], 2
pop edi
pop esi
pop ebp
mov byte [0x4b64d2], 1
pop ebx
ret
test bl, bl
je 0x41f3df
test cl, cl
jne 0x41f3df
xor ecx, ecx
mov cx, word [0x4bf1d4]
sub ecx, 2
jns 0x41f3d6
pop edi
pop esi
pop ebp
mov word [0x4bf1d4], 0
mov byte [0x4b64d3], 1
pop ebx
ret
add word [0x4bf1d4], 0xfffe
pop edi
pop esi
pop ebp
mov byte [0x4b64d3], 1
pop ebx
ret
pop edi
pop esi
pop ebp
mov byte [0x4b64d0], 1
pop ebx
ret
pop edi
pop esi
pop ebp
mov byte [0x4b64d1], 1
pop ebx
ret
pop edi
pop esi
pop ebp
mov byte [0x4b64d4], 1
pop ebx
ret
pop edi
pop esi
pop ebp
mov byte [0x4b64d5], 1
pop ebx
ret
mov byte [0x4b64d6], 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x420be0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov edx, 0x100
mov ecx, 0xa
push 0x10
call fcn.0046cda0
mov ecx, 0x49d510
call fcn.00407220
xor edx, edx
mov ecx, str.AllowMultipleInstances
push 0
push 0
call fcn.004077a0
test eax, eax
jne 0x420c27
mov ecx, str.Cool_Pool
call fcn.00460390
test eax, eax
jne 0x420e61
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 0x320
jg 0x420c3d
mov byte [0x49d516], 1
push esi
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [0x51da08], eax
push 0x258
push 0x320
push 0xffffe19f
push 0xffffe19f
push 0xca0000
call fcn.0044d820
mov ecx, eax
mov edx, 0x4210d0
call fcn.00460430
mov eax, dword [0x51da28]
mov dword [0x51da08], 0
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push str.Cool_Pool_requires_at_least_16_bit_video_mode
push 0xc
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor ecx, ecx
cmp eax, 0x10
setl cl
push ecx
call fcn.00432060
mov edx, dword [0x51da28]
add esp, 8
push esi
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
mov cl, byte [0x49d516]
call fcn.00416210
call fcn.00435410
mov edx, str.common.tbv
lea ecx, [esp + 4]
push 0
call fcn.004356d0
mov edx, 0xd
mov ecx, str.DataCommon
call fcn.00462a90
mov edx, 8
lea ecx, [esp + 4]
call fcn.00462a90
mov edx, str.misctext.tbt
mov ecx, 0x1770
push 0
call fcn.0046ba60
mov edx, str.eightball.tbv
lea ecx, [esp + 4]
push str.games
call fcn.004356d0
xor dl, dl
mov ecx, str.data_sound_sx_4001.wav
call fcn.00463310
test al, al
pop esi
jne 0x420d5c
mov edx, 3
lea ecx, [esp]
call fcn.00462a90
test al, al
je 0x420d5c
mov ecx, 0x178c
call fcn.0044d8d0
push eax
push 1
call fcn.00432060
add esp, 8
add esp, 0x104
ret
mov ecx, 3
call fcn.00462ab0
mov al, byte [0x49d516]
test al, al
je 0x420d74
call fcn.0043ff60
push 0x20
call fcn.0047e2df
add esp, 4
test eax, eax
je 0x420d90
mov ecx, eax
call fcn.00445be0
mov dword [0x51b79c], eax
jmp 0x420d9a
mov dword [0x51b79c], 0
call fcn.00420520
call fcn.00438220
mov edx, 2
mov ecx, str.Disconnect
push 0
push 0
call fcn.004077a0
mov word [0x4960dc], ax
push 8
call fcn.0047e2df
add esp, 4
test eax, eax
je 0x420dd9
mov ecx, eax
call fcn.0044e1f0
mov dword [0x51d9a8], eax
jmp 0x420de3
mov dword [0x51d9a8], 0
call fcn.00415ff0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x420e02
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x420e26
push 0
push 0
mov ecx, str.eightball
call fcn.004385b0
mov edx, eax
mov ecx, str.LastGameID
call fcn.004077a0
mov byte [0x4b0d38], al
call fcn.00420e70
mov ecx, dword [0x496844]
cmp ecx, 4
je 0x420e5c
call fcn.0043c520
sub eax, 3
je 0x420e40
dec eax
je 0x420e52
jmp 0x420e45
call fcn.00420e70
mov ecx, dword [0x496844]
cmp ecx, 4
je 0x420e5c
jmp 0x420e31
mov dword [0x496844], 4
call fcn.00420f80
add esp, 0x104
ret
Function at 0x420f80
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
call fcn.0043cb90
mov cl, 1
call fcn.004281b0
call fcn.00428a80
mov esi, dword [0x4b64d8]
xor ebx, ebx
cmp esi, ebx
je 0x420faf
mov ecx, esi
call fcn.00418220
push esi
call fcn.0047e2ed
add esp, 4
mov dword [0x4b64d8], ebx
call fcn.004489d0
call fcn.00446f20
call fcn.00438630
call fcn.004384f0
call fcn.00436120
cmp byte [0x49d510], bl
je 0x420fdd
call fcn.00416510
jmp 0x420fe2
call fcn.00416b30
call fcn.00448420
mov esi, dword [0x4fdf68]
cmp esi, ebx
je 0x421001
mov ecx, esi
call fcn.004408d0
push esi
call fcn.0047e2ed
add esp, 4
mov esi, dword [0x51b79c]
mov dword [0x4fdf68], ebx
cmp esi, ebx
je 0x421021
mov ecx, esi
call fcn.00445e00
push esi
call fcn.0047e2ed
add esp, 4
mov esi, dword [0x51d9a8]
mov dword [0x51b79c], ebx
cmp esi, ebx
je 0x421041
mov ecx, esi
call fcn.0044e200
push esi
call fcn.0047e2ed
add esp, 4
xor edx, edx
push ebx
mov dx, word [0x4960dc]
push ebx
mov ecx, str.Disconnect
mov dword [0x51d9a8], ebx
call fcn.00407800
mov ecx, 0x49d510
call fcn.00407590
mov ecx, 0x1f40
call fcn.0046bd20
mov ecx, 0x1770
call fcn.0046bd20
call fcn.0046ce90
mov eax, dword [0x51f318]
push eax
call fcn.0047e4ff
pop esi
pop ebx
nop
nop
nop
nop
Function at 0x428440
Capabilities:
Log keystrokes via polling

Disassembly:
mov al, byte [0x4b64d4]
push ebx
xor ebx, ebx
push esi
cmp al, bl
push edi
je 0x42853c
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x42853c
mov byte [0x4b64d4], bl
mov byte [0x4bf1f4], 1
mov ecx, dword [0x4bf1c8]
cmp byte [0x4b64d7], bl
je 0x428604
cmp ecx, ebx
je 0x42860d
mov esi, ecx
mov byte [0x4b64d7], bl
cmp esi, ebx
je 0x428532
mov ecx, dword [esi + 0x100]
cmp ecx, ebx
je 0x4284c3
call fcn.00407eb0
mov edi, dword [esi + 0x100]
cmp edi, ebx
je 0x4284c3
mov ecx, edi
call fcn.00407eb0
push edi
call fcn.0047e2ed
add esp, 4
dec word [0x4bf1fe]
jne 0x428521
mov edi, dword [0x4bf204]
cmp edi, ebx
je 0x4284e6
mov ecx, edi
call fcn.00407eb0
push edi
call fcn.0047e2ed
add esp, 4
mov edi, dword [0x4bf208]
cmp edi, ebx
je 0x428500
mov ecx, edi
call fcn.00407eb0
push edi
call fcn.0047e2ed
add esp, 4
mov ecx, 0x40
xor eax, eax
mov edi, 0x4bf07c
mov dword [0x4bf204], ebx
mov dword [0x4bf208], ebx
mov word [0x4bf1fc], bx
rep stosd dword es:[edi], eax
push esi
mov dword [esi + 0x100], ebx
mov byte [esi], bl
call fcn.0047e2ed
add esp, 4
pop edi
mov dword [0x4bf1c8], ebx
pop esi
pop ebx
ret
cmp byte [0x4bf1f4], bl
je 0x428470
mov ecx, dword [0x4bf1c8]
mov byte [0x4bf1f4], bl
cmp ecx, ebx
je 0x428476
xor edx, edx
call fcn.00426660
mov esi, dword [0x4bf1c8]
cmp esi, ebx
je 0x4285f7
mov ecx, dword [esi + 0x100]
cmp ecx, ebx
je 0x42859a
call fcn.00407eb0
mov edi, dword [esi + 0x100]
cmp edi, ebx
je 0x42859a
mov ecx, edi
call fcn.00407eb0
push edi
call fcn.0047e2ed
add esp, 4
dec word [0x4bf1fe]
jne 0x4285e6
mov ecx, dword [0x4bf204]
cmp ecx, ebx
je 0x4285b4
push 1
call fcn.00429710
mov ecx, dword [0x4bf208]
cmp ecx, ebx
je 0x4285c5
push 1
call fcn.00429710
mov ecx, 0x40
xor eax, eax
mov edi, 0x4bf07c
mov dword [0x4bf204], ebx
mov dword [0x4bf208], ebx
mov word [0x4bf1fc], bx
rep stosd dword es:[edi], eax
push esi
mov dword [esi + 0x100], ebx
mov byte [esi], bl
call fcn.0047e2ed
add esp, 4
xor ecx, ecx
mov dword [0x4bf1c8], ecx
jmp 0x428476
cmp ecx, ebx
je 0x42860d
call fcn.0042ac70
pop edi
pop esi
pop ebx
ret
Function at 0x42a8f0
Capabilities:
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x234
push ebx
push ebp
push esi
push edi
push str.ICMP.dll
mov byte [esp + 0x17], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x42a91d
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x234
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IcmpCreateFile
push esi
call edi
mov ebp, eax
push str.IcmpCloseHandle
push esi
call edi
push str.IcmpSendEcho
push esi
mov dword [esp + 0x1c], eax
call edi
mov ebx, eax
lea eax, [esp + 0xb4]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x42a966
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x234
ret
call ebp
lea ecx, [esp + 0x18]
mov edi, eax
push 0x7d0
push 0x9c
push ecx
push 0
push 0
push 0
push str.www.sierra.com
call sub.WSOCK32.dll_inet_addr
push eax
push edi
call ebx
test eax, eax
jne 0x42a995
xor bl, bl
jmp 0x42a999
mov bl, byte [esp + 0x13]
push edi
call dword [esp + 0x18]
call sub.WSOCK32.dll_WSACleanup
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret
Function at 0x432450
Capabilities:
Enumerate pe sections

Disassembly:
mov al, byte [esp + 4]
push esi
test al, al
mov esi, ecx
je 0x432467
mov byte [esi + 5], 1
mov byte [esi + 6], 0
pop esi
ret 4
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
push eax
mov eax, dword [esi + 0xc]
push ecx
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi + 0x10]
push eax
call fcn.004171f0
test al, al
je 0x432498
mov edx, dword [esi]
mov ecx, esi
call dword [edx]
mov al, 1
mov byte [esi + 5], al
mov byte [esi + 6], al
pop esi
ret 4
mov al, byte [esi + 6]
test al, al
je 0x4324a7
mov byte [esi + 6], 0
mov byte [esi + 5], 1
pop esi
ret 4
Function at 0x435410
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWARESierra_On_Line3D_Ultra_Cool_Pool
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4354a8
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push 0x4963ac
push eax
push eax
push str.CDPath
push edx
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43549d
mov ecx, 0x4963ac
call fcn.004634b0
cmp eax, 1
jbe 0x43548e
mov ecx, 0x4963ac
call fcn.004634b0
cmp byte [eax + 0x4963ab], 0x5c
jne 0x43548e
mov ecx, 0x4963ac
call fcn.004634b0
mov byte [eax + 0x4963ab], 0
mov edx, str.CoolPool
mov ecx, 0x4963ac
call fcn.00463540
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret