joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445c9c
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
push eax
push dword [ebx]
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x20], xmm0
call fcn.004405ef
mov esi, eax
test esi, esi
js 0x445e05
xor eax, eax
push eax
push eax
push eax
push eax
push str.Burn
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x445d2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x8f
push str.dlutil.cpp
call fcn.0043bf09
jmp 0x445e05
lea eax, [ebp - 4]
push eax
push 0x78
push str.DownloadTimeout
push str.WiXBurn
call fcn.00445020
mov eax, dword [ebp - 4]
test eax, eax
je 0x445d78
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.00445501
mov esi, eax
test esi, esi
js 0x445e05
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call fcn.004455aa
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.004451fe
mov esi, eax
test esi, esi
js 0x445df6
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x445df6
xor ecx, ecx
cmp word [eax], cx
je 0x445df6
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xc], 0xffffffff
je 0x445e05
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x445e12
push eax
call fcn.00444e5d
test edi, edi
je 0x445e1d
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], 0
je 0x445e2b
push dword [ebp - 8]
call fcn.00444e5d
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x448202
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], 4
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x20000005
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x448253
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x448253
push esi
push 0x23
push str.inetutil.cpp
call fcn.0043bf09
jmp 0x44825f
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
and dword [edx + 4], 0
mov dword [edx], ecx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x448399
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x246c
call fcn.004492a0
mov eax, dword [0x469004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2428], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x242c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x241c], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2430], eax
xor esi, esi
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x2420], eax
mov eax, dword [ebp + 0x1c]
push 0x3c
mov dword [ebp - 0x2424], eax
lea eax, [ebp - 0x246c]
push esi
push eax
call fcn.0042b370
add esp, 0xc
mov dword [ebp - 0x246c], 0x3c
cmp dword [ebp - 0x241c], esi
je 0x44842b
lea eax, [ebp - 0x410]
mov dword [ebp - 0x2458], 0x101
mov dword [ebp - 0x245c], eax
mov ecx, 0x81
cmp dword [ebp - 0x2420], esi
je 0x44844a
lea eax, [ebp - 0x108]
mov dword [ebp - 0x244c], ecx
mov dword [ebp - 0x2450], eax
cmp dword [ebp - 0x2424], esi
je 0x448464
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2444], ecx
mov dword [ebp - 0x2448], eax
mov ecx, 0x801
test ebx, ebx
je 0x44847f
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x243c], ecx
mov dword [ebp - 0x2440], eax
test edi, edi
je 0x448495
lea eax, [ebp - 0x2418]
mov dword [ebp - 0x2434], ecx
mov dword [ebp - 0x2438], eax
lea eax, [ebp - 0x246c]
push eax
push 0x90000000
push esi
push dword [ebp - 0x2428]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4484e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x61
push str.uriutil.cpp
call fcn.0043bf09
jmp 0x4485a6
mov ecx, dword [ebp - 0x242c]
test ecx, ecx
je 0x4484f4
mov eax, dword [ebp - 0x2460]
mov dword [ecx], eax
mov eax, dword [ebp - 0x241c]
test eax, eax
je 0x44851a
push dword [ebp - 0x2458]
push dword [ebp - 0x245c]
push eax
call fcn.004405ef
mov esi, eax
test esi, esi
js 0x4485a6
mov eax, dword [ebp - 0x2430]
test eax, eax
je 0x44852e
mov cx, word [ebp - 0x2454]
mov word [eax], cx
mov eax, dword [ebp - 0x2420]
test eax, eax
je 0x448550
push dword [ebp - 0x244c]
push dword [ebp - 0x2450]
push eax
call fcn.004405ef
mov esi, eax
test esi, esi
js 0x4485a6
mov eax, dword [ebp - 0x2424]
test eax, eax
je 0x448572
push dword [ebp - 0x2444]
push dword [ebp - 0x2448]
push eax
call fcn.004405ef
mov esi, eax
test esi, esi
js 0x4485a6
test ebx, ebx
je 0x44858e
push dword [ebp - 0x243c]
push dword [ebp - 0x2440]
push ebx
call fcn.004405ef
mov esi, eax
test esi, esi
js 0x4485a6
test edi, edi
je 0x4485a6
push dword [ebp - 0x2434]
push dword [ebp - 0x2438]
push edi
call fcn.004405ef
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a807
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4757e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x475805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x475878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x47583a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x47586d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x47586b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x475831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4757fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x401c66
pop dword [ebp - 0x3c]
mov eax, 0x401c66
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x2d5a8f27
sub dword [ebp - 0x4c], 0xdf0849dc
mov dword [ebp - 0x48], 0xb09757d9
add dword [ebp - 0x48], 0x819bf46c
mov dword [ebp - 0x44], 0xbebdf4c5
add dword [ebp - 0x44], 0x8d8e4f69
mov dword [ebp - 0x40], 0xb42e74bd
add dword [ebp - 0x40], 0x4bd18b43
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x841b8207
add eax, 0x7c24ae4d
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xdcd6f9eb
add dword [ebp - 0x4c], 0x979b6f6b
mov dword [ebp - 0x48], 0xa2969fcc
add dword [ebp - 0x48], 0x9ed5c1a9
mov dword [ebp - 0x44], 0xddca85f7
add dword [ebp - 0x44], 0x85a4e675
mov dword [ebp - 0x40], 0x436a3ba7
sub dword [ebp - 0x40], 0x436a3ba7
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xbc957265
sub eax, 0xbc554239
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x393da
push 0
call eax
mov ecx, 0xca672354
sub ecx, 0xca66d04a
mov edi, eax
mov esi, 0x407000
add esi, dword [ebp - 0x3c]
mov ebx, 0x11b2f2c2
xor dword [ebp - 0xc], 0x69911fb
mov edx, dword [esi]
sub dword [ebp - 0x18], eax
xor edx, ebx
add dword [ebp - 4], 0xfdabbd1f
mov dword [edi], edx
add dword [ebp - 0x24], ecx
add edi, 0x2265e12c
add edi, 0xdd9a1ed8
add esi, 0x22531098
sub esi, 0x22531094
loop 0x401d77
add eax, 0x13efb
mov ebx, eax
add eax, 0xf28f35ce
sub eax, 0xf28f35c9
mov ecx, 0xc6954cb3
sub ecx, 0xc6554cb3
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x426cd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push ecx
lea edi, [ebp - 0x114]
mov ecx, 0x45
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x50b7a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
push 0x100
push 0
lea eax, [ebp - 0x10c]
push eax
call fcn.00452f00
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp + 0x14]
push ecx
push 0x80
lea edx, [ebp - 0x10c]
push edx
push 0x4e3424
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.00452f80
lea edx, [ebp - 0x10c]
push edx
call fcn.00459660
add esp, 4
fstp dword [ebp - 0x114]
fld dword [ebp - 0x114]
fcomp qword [0x4e2718]
fnstsw ax
test ah, 0x44
jp 0x426d6f
fld dword [ebp + 0x10]
fstp dword [ebp - 0x114]
fld dword [ebp - 0x114]
push edx
mov ecx, ebp
push eax
lea edx, [0x426da8]
call fcn.00452fb0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453800
add esp, 0x114
cmp ebp, esp
call fcn.00452f80
mov esp, ebp
pop ebp
ret 0x10
Function at 0x427110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push esi
push edi
push ecx
lea edi, [ebp - 0x438]
mov ecx, 0x10e
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x50b7a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
xor eax, eax
mov word [ebp - 0x214], ax
push 0x206
push 0
lea ecx, [ebp - 0x212]
push ecx
call fcn.00452f00
add esp, 0xc
push 0x208
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.0040137a
test eax, eax
jne 0x42717e
xor eax, eax
jmp 0x427300
mov dword [ebp - 0x21c], 0x4e3604
push 0x4e360c
push 0xffff
mov ecx, dword [0x50d230]
push ecx
call fcn.0040256d
add esp, 0xc
push 0x18
push str.___Loading_Hash_Table______u___n
push 0xffff
mov edx, dword [0x50d230]
push edx
call fcn.0040256d
add esp, 0x10
mov dword [ebp - 0x430], 0
jmp 0x4271d7
mov eax, dword [ebp - 0x430]
add eax, 1
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x18
jge 0x4272e3
mov esi, esp
push 0x104
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp - 0x430]
imul edx, edx, 0x214
add edx, str.Engine
push edx
call fcn.00453810
add esp, 4
push eax
mov eax, dword [ebp - 0x430]
imul eax, eax, 0x214
add eax, str.Engine
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, esp
call fcn.00452f80
mov dword [ebp - 0x434], eax
xor ecx, ecx
mov edx, dword [ebp - 0x434]
mov word [ebp + edx*2 - 0x428], cx
mov esi, esp
lea eax, [ebp - 0x214]
push eax
push 0
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.00452f80
mov ecx, dword [ebp - 0x430]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x171c], eax
mov dword [ebp - 0x438], 0xff00
mov eax, dword [ebp - 0x430]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax*4 + 0x171c], 0
jne 0x4272a4
mov dword [ebp - 0x438], 0xff
mov edx, dword [ebp - 0x430]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx*4 + 0x171c]
push ecx
lea edx, [ebp - 0x428]
push edx
mov eax, dword [ebp - 0x430]
push eax
push str.___d_:___s______u__n
mov ecx, dword [ebp - 0x438]
push ecx
mov edx, dword [0x50d230]
push edx
call fcn.0040256d
add esp, 0x18
jmp 0x4271c8
push str.____________________________n
push 0xffff
mov eax, dword [0x50d230]
push eax
call fcn.0040256d
add esp, 0xc
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x427330]
call fcn.00452fb0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453800
add esp, 0x438
cmp ebp, esp
call fcn.00452f80
mov esp, ebp
pop ebp
ret 4
Function at 0x427a00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
push ecx
lea edi, [ebp - 0x218]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x50b7a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], str.LOBBY_SERVER
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0x3a9b
push str.LobbyUserPort
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.00452f80
mov edx, dword [ebp - 8]
mov dword [edx + 0x10b0], eax
mov dword [ebp - 0x10], 0
jmp 0x427a6f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x14
jae 0x427ab1
mov ecx, dword [ebp - 0x10]
add ecx, 1
push ecx
push str.Lobby_Server__u
push 0x200
lea edx, [ebp - 0x214]
push edx
call fcn.00401e15
add esp, 0x10
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 8]
call fcn.00401a5a
jmp 0x427a66
mov eax, dword [ebp - 8]
mov dword [eax + 0x10b4], 0
mov dword [ebp - 0x10], 0
jmp 0x427ad0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x14
jae 0x427b06
mov edx, dword [ebp - 0x10]
add edx, 4
shl edx, 6
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xe44]
cmp dword [ecx + edx + 0x3c], 1
jne 0x427b04
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10b4]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10b4], eax
jmp 0x427ac7
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x427b3c]
call fcn.00452fb0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453800
add esp, 0x218
cmp ebp, esp
call fcn.00452f80
mov esp, ebp
pop ebp
ret 4
Function at 0x427bc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push esi
push edi
push ecx
lea edi, [ebp - 0x224]
mov ecx, 0x89
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x50b7a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x218], 0
jmp 0x427c07
mov eax, dword [ebp - 0x218]
add eax, 1
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xa
jge 0x427c26
mov ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 0x10b8], 0xffffffff
jmp 0x427bf8
mov dword [ebp - 0xc], str.LOBBY_REGION
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push str.RegionCount
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.00452f80
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xa
jl 0x427c66
mov dword [ebp - 0x224], 9
jmp 0x427c72
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], 0
jmp 0x427c99
mov ecx, dword [ebp - 0x220]
add ecx, 1
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp - 0x21c]
jge 0x427d56
mov eax, dword [ebp - 0x220]
push eax
push str.RegionID__u
push 0x200
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401e15
add esp, 0x10
mov esi, esp
mov edx, dword [ebp + 8]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.00452f80
mov edx, dword [ebp - 0x220]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 0x10b8], eax
mov edx, dword [ebp - 0x220]
push edx
push str.RegionName__u
push 0x200
lea eax, [ebp - 0x210]
push eax
call fcn.00401e15
add esp, 0x10
mov esi, esp
mov ecx, dword [ebp + 8]
push ecx
push 0x20
mov edx, dword [ebp - 0x220]
imul edx, edx, 0x42
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x10e0]
push ecx
push 0
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.00452f80
jmp 0x427c8a
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x427d8c]
call fcn.00452fb0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453800
add esp, 0x224
cmp ebp, esp
call fcn.00452f80
mov esp, ebp
pop ebp
ret 4
Function at 0x4281f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9d8
push esi
push edi
push ecx
lea edi, [ebp - 0x9d8]
mov ecx, 0x276
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x50b7a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
push 0x80
push 0
lea eax, [ebp - 0x8c]
push eax
call fcn.00452f00
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x194]
push ecx
call fcn.00452f00
add esp, 0xc
mov ecx, 0xa
mov esi, str.Nation_IP_WhiteList
lea edi, [ebp - 0x1c4]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x9d8], 0
jmp 0x42827f
mov edx, dword [ebp - 0x9d8]
add edx, 1
mov dword [ebp - 0x9d8], edx
cmp dword [ebp - 0x9d8], 0x100
jge 0x4283a9
mov eax, dword [ebp - 0x9d8]
push eax
push str.IP__d
push 0x80
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00401e15
add esp, 0x10
mov esi, esp
mov edx, dword [ebp + 8]
push edx
push 0x80
lea eax, [ebp - 0x194]
push eax
push 0x4e3c7c
lea ecx, [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x1c4]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp esi, esp
call fcn.00452f80
test eax, eax
jne 0x4282e7
jmp 0x428270
xor eax, eax
mov word [ebp - 0x96], ax
lea ecx, [ebp - 0x194]
push ecx
call fcn.00401fdc
add esp, 4
movzx edx, word [ebp - 0x194]
test edx, edx
jne 0x42830f
jmp 0x428270
mov eax, dword [ebp - 0x1cc]
lea ecx, [ebp + eax*8 - 0x9d0]
push ecx
lea edx, [ebp - 0x194]
push edx
call fcn.004012ee
add esp, 8
movzx eax, al
test eax, eax
je 0x428374
mov ecx, dword [ebp - 0x1cc]
add ecx, 1
mov dword [ebp - 0x1cc], ecx
cmp dword [0x50d230], 0
je 0x428372
lea edx, [ebp - 0x194]
push edx
mov eax, dword [ebp - 0x9d8]
push eax
push str.___Nation_IP_whitelist_entry__d______s___n
push 0xff00
mov ecx, dword [0x50d230]
push ecx
call fcn.0040256d
add esp, 0x14
jmp 0x4283a4
cmp dword [0x50d230], 0
je 0x4283a4
lea edx, [ebp - 0x194]
push edx
mov eax, dword [ebp - 0x9d8]
push eax
push str.___Nation_IP_whitelist_entry__d_is_invalid______s___n
push 0xff
mov ecx, dword [0x50d230]
push ecx
call fcn.0040256d
add esp, 0x14
jmp 0x428270
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1cc]
mov dword [edx + 0x1b8c], eax
push 0x800
lea ecx, [ebp - 0x9d0]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x1b90
push edx
call fcn.00454530
add esp, 0xc
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x42840c]
call fcn.00452fb0
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00453800
add esp, 0x9d8
cmp ebp, esp
call fcn.00452f80
mov esp, ebp
pop ebp
ret 4
Function at 0x4297f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push ecx
lea edi, [ebp - 0x2c]
mov ecx, 0xb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov esi, esp
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
cmp esi, esp
call fcn.00452f80
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x429872
cmp dword [ebp - 8], 0xffffffff
jne 0x42984a
mov esi, esp
push str.___GetMessage_return__1___n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, esp
call fcn.00452f80
jmp 0x429870
mov esi, esp
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp esi, esp
call fcn.00452f80
mov esi, esp
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp esi, esp
call fcn.00452f80
jmp 0x42980c
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x429898]
call fcn.00452fb0
pop eax
pop edx
pop edi
pop esi
add esp, 0x2c
cmp ebp, esp
call fcn.00452f80
mov esp, ebp
pop ebp
ret
Function at 0x453800
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x50b7a4]
jne 0x45380a
repz ret
jmp fcn.00469410
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x401690
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edx + 0x3c]
add ecx, edx
mov edx, 0x10b
movzx eax, word [ecx + 0x18]
cmp ax, dx
je 0x4016b8
mov edx, 0x20b
cmp ax, dx
jne 0x401720
movzx eax, word [ecx + 0x14]
lea esi, [ecx + 0x18]
movzx ebx, word [ecx + 6]
add esi, eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], ebx
cmp edi, dword [esi + 0x14]
jae 0x4016d9
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
xor eax, eax
cmp cx, bx
jae 0x401720
movzx edx, ax
lea ecx, [edx + edx*4]
mov esi, dword [esi + ecx*8 + 0xc]
cmp edi, esi
jb 0x401700
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + ecx*8 + 0x10]
mov ebx, dword [ebp - 8]
add ecx, esi
cmp edi, ecx
jb 0x40170b
inc eax
cmp ax, bx
jae 0x401720
mov esi, dword [ebp - 4]
jmp 0x4016e2
mov ecx, dword [ebp - 4]
lea eax, [edx + edx*4]
mov eax, dword [ecx + eax*8 + 0x14]
sub eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret