joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431b1e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [0x44a280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov esi, ecx
xor eax, eax
push esi
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x108]
push 0x44cf38
push eax
mov dword [ebp - 0x14c], 0x44
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x144], edi
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x13c], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x10c], edi
call fcn.0041b6cd
add esp, 0xc
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x14c]
push eax
push edi
push edi
push 0x8000000
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 1
jne 0x431bf7
push dword [ebp - 0x15c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x158]
call esi
xor eax, eax
jmp 0x431c04
mov ecx, str.spawn:_Spawn_failed
call fcn.00431ce0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041b6be
leave
ret

Function at 0x431c12
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00422ee0
mov eax, dword [0x44a280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x44ced8
push ecx
mov esi, edx
call fcn.0041ca67
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x431c4f
mov ecx, str.copyfile:_Cant_open_src_file
call fcn.00431ce0
or eax, 0xffffffff
jmp 0x431cc3
push ebx
push 0x44cefc
push esi
call fcn.0041ca67
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x431ca5
mov ecx, str.copyfile:_Cant_open_dst_file
call fcn.00431ce0
push edi
call fcn.0041dc72
or eax, 0xffffffff
jmp 0x431cc1
push edi
push 0x1000
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.0041cc3f
mov esi, eax
push ebx
push esi
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.0041d167
add esp, 0x20
cmp eax, esi
jne 0x431cd1
push edi
call fcn.0041b74f
pop ecx
test eax, eax
je 0x431c78
xor esi, esi
push edi
call fcn.0041dc72
push ebx
call fcn.0041dc72
pop ecx
mov eax, esi
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041b6be
leave
ret
mov ecx, str.copyfile:_Write_failed
call fcn.00431ce0
or esi, 0xffffffff
jmp 0x431cb2
Function at 0x431e2a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x44a280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0x44cea4
push edi
call fcn.0041ca67
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x431ecc
push 2
push 0
push esi
call fcn.0041da52
push esi
call fcn.0041d680
add esp, 0x10
cmp eax, 0x2000
jle 0x431edb
push 2
push 0xffffff00
push esi
call fcn.0041da52
push esi
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push 1
push eax
call fcn.0041cc3f
push esi
mov ebx, eax
call fcn.0041dc72
push 0x44cea8
push edi
call fcn.0041ca67
add esp, 0x28
mov esi, eax
test ebx, ebx
je 0x431edb
push 0x44ceac
push esi
call fcn.0041cceb
push esi
push ebx
lea eax, [ebp - 0x104]
push 1
push eax
call fcn.0041d167
add esp, 0x18
jmp 0x431edb
push 0x44ceb0
push edi
call fcn.0041ca67
pop ecx
pop ecx
mov esi, eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b6be
leave
ret
Function at 0x431fa1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x44a280]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
lea edx, [ebp - 0x20c]
mov ecx, str.AUTHENTIC_TAG
mov dword [ebp - 0x214], eax
xor esi, esi
call fcn.0043224b
test eax, eax
jne 0x431fe0
lea esi, [ebp - 0x20c]
jmp 0x431fec
xor edx, edx
mov ecx, str.iao_getbinary:_AUTHENIC_TAG_variable_not_embedded
call fcn.00431daf
push edi
mov edx, str._getbinary___
mov ecx, 0x4504c8
call fcn.00432b22
mov ebx, eax
pop ecx
test ebx, ebx
jns 0x43200b
or eax, 0xffffffff
jmp 0x4320fc
mov eax, dword [edi]
lea edx, [ebp - 0x210]
mov ecx, str._binary_authentic_
mov dword [ebp - 0x210], eax
call fcn.0043221f
test eax, eax
je 0x432042
mov ecx, str.iao_getbinary:__binary__tag_invalid
xor edx, edx
call fcn.00431daf
push dword [edi]
call fcn.0041be48
or eax, 0xffffffff
jmp 0x4320fb
test esi, esi
je 0x43205c
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.0043221f
test eax, eax
je 0x432074
jmp 0x43210b
push 0x44cce4
push dword [ebp - 0x210]
call fcn.0041c020
pop ecx
pop ecx
mov dword [ebp - 0x210], eax
lea edx, [ebp - 0x210]
mov ecx, 0x44cce4
call fcn.0043221f
test eax, eax
je 0x43208f
mov ecx, str.iao_getbinary:__binary__tag__invalid__closing_
jmp 0x43202c
mov edx, str.__binary_
mov esi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x432099
mov eax, dword [edi]
sub esi, ecx
sub eax, esi
push esi
add eax, ebx
push eax
push edx
call fcn.0041bdd0
add esp, 0xc
test eax, eax
je 0x4320c1
mov ecx, str.iao_getbinary:___binary__tag_invalid
jmp 0x43202c
mov eax, dword [edi]
sub eax, esi
push ebx
mov byte [eax + ebx], 0
call fcn.0041be80
mov edx, dword [ebp - 0x210]
mov esi, eax
pop ecx
mov ecx, esi
call fcn.004338b6
mov ecx, dword [ebp - 0x214]
mov edx, eax
mov dword [ecx], eax
mov ecx, esi
call fcn.00432127
push dword [edi]
call fcn.0041be48
mov dword [edi], esi
xor eax, eax
pop ecx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b6be
leave
ret
xor edx, edx
mov ecx, str.iao_getbinary:_binary_not_authentic
call fcn.00431daf
push dword [edi]
call fcn.0041be48
pop ecx
push 0xffffffffffffffff
call fcn.0041e0c6
int3
Function at 0x432b6d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x3a74
call fcn.00422ee0
mov eax, dword [0x44a280]
xor eax, esp
mov dword [esp + 0x3a70], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, edx
mov edi, ecx
call fcn.00432ff0
test eax, eax
je 0x432ba6
or eax, 0xffffffff
jmp 0x432d0b
cmp dword [0x44f7a8], 1
lea eax, [esp + 0x10]
push eax
jne 0x432c18
sub esp, 0x10
call fcn.004340f3
add esp, 0x14
test eax, eax
jne 0x432b9e
lea ecx, [esp + 0x10]
call fcn.00432d4b
lea eax, [esp + 0x1278]
push ebx
push eax
lea edx, [esp + 0x18]
mov ecx, edi
call fcn.00432f0e
pop ecx
pop ecx
lea ecx, [esp + 0x1278]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432bec
sub ecx, edx
push ecx
lea eax, [esp + 0x127c]
push eax
lea ecx, [esp + 0x18]
call fcn.00433f55
pop ecx
pop ecx
lea ecx, [esp + 0x10]
test eax, eax
je 0x432c2e
call fcn.0043443c
jmp 0x432b9e
mov edx, dword [0x44fc94]
push 1
mov ecx, 0x44f808
call fcn.0043428f
pop ecx
pop ecx
jmp 0x432bbf
mov edx, esi
call fcn.00433970
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.0043443c
test edi, edi
js 0x432b9e
mov edx, dword [esi]
push edi
mov ecx, str.iaop
call fcn.00432df6
mov edi, eax
or ebx, 0xffffffff
pop ecx
cmp edi, ebx
jne 0x432c96
mov ecx, dword [esi]
xor edx, edx
call fcn.00431daf
xor edx, edx
mov ecx, str.iao_post:_response_not_IAOP_compliant
call fcn.00431daf
push dword [esi]
call fcn.0041be48
mov eax, dword [0x44f798]
pop ecx
mov ecx, eax
inc eax
mov dword [0x44f798], eax
cmp ecx, 0x7d0
jne 0x432cc1
jmp 0x432d20
and dword [0x44f798], 0
push 7
push str._error_
push dword [esi]
call fcn.0041bdd0
add esp, 0xc
test eax, eax
jne 0x432cc5
mov ecx, dword [esi]
call fcn.00432d96
push dword [esi]
call fcn.0041be48
pop ecx
mov eax, ebx
jmp 0x432d0b
mov ecx, str._directive_die:
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x432ccd
sub ecx, edx
push ecx
push str._directive_die:
push dword [esi]
call fcn.0041bdd0
add esp, 0xc
test eax, eax
jne 0x432d09
mov ecx, dword [esi]
xor edx, edx
call fcn.00431daf
xor edx, edx
mov ecx, str.iao_post:_Was_asked_to_die_by_server._Bailing_out...
call fcn.00431daf
push dword [esi]
call fcn.0041be48
pop ecx
jmp 0x432d44
mov eax, edi
mov ecx, dword [esp + 0x3a7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041b6be
mov esp, ebp
pop ebp
ret
xor edx, edx
mov ecx, str.iao_post:_response_not_IAOP_compliant_for_200_times_in_a_row
call fcn.00431daf
xor edx, edx
mov ecx, str.iao_post:_There_could_be_a_firewall_issue.
call fcn.00431daf
xor edx, edx
mov ecx, str.iao_post:_Bailing_out.
call fcn.00431daf
push ebx
call fcn.0041e0c6
int3
Function at 0x43433c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x44a280]
xor eax, esp
mov dword [esp + 0x19c], eax
cmp dword [0x44f7dc], 0
jne 0x434428
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4343bf
sub eax, 0x271e
je 0x4343b0
sub eax, 0x16
je 0x4343a9
sub eax, 0x1f
je 0x4343a2
sub eax, 0x18
je 0x43439b
dec eax
je 0x434394
mov ecx, str.iao_tcpinit:_Unknow_reason
jmp 0x4343b5
mov ecx, str.iao_tcpinit:_WinSock_version__not_supported
jmp 0x4343b5
mov ecx, str.iao_tcpinit:_Underlying_network_subsystem_is_not_ready
jmp 0x4343b5
mov ecx, str.iao_tcpinit:_Maximum_WinSock_tasks_reached
jmp 0x4343b5
mov ecx, str.iao_tcpinit:_A_blocking_Windows_Sockets_1.1_operation_is_in_progress
jmp 0x4343b5
mov ecx, str.iao_tcpinit:_Invalid_pointer
call fcn.00431ce0
or eax, 0xffffffff
jmp 0x43442a
call fcn.00401570
push 4
pop ecx
call fcn.00409ea0
test eax, eax
je 0x4343e5
mov word [esp + 4], 0x303
mov cx, word [esp + 4]
mov word [eax], cx
mov word [eax + 2], 0x101
mov ecx, eax
call section..text
mov dword [0x44f7e4], eax
test eax, eax
jne 0x434403
mov ecx, str.Failed_creating_ssl_context
xor edx, edx
call fcn.00431daf
jmp 0x4343ba
and dword [eax + 0x15c], 0
mov word [eax + 0x144], pe_nt_image_headers32
call fcn.00434cc1
mov dword [0x44f7dc], eax
test eax, eax
jne 0x434428
mov ecx, str.Cant_create_gethostbyname_mutex
jmp 0x4343fa
xor eax, eax
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0041b6be
mov esp, ebp
pop ebp
ret

Function at 0x4345f8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x44a280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 2
pop eax
mov edi, ecx
mov word [ebp - 0x14], ax
movzx eax, word [edi + 0xc18]
push eax
mov esi, edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
mov eax, dword [edi + 0xc28]
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 8]
push esi
push dword [edi]
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43465f
mov ecx, str.udpsend:_sendto_returned_with_an_error
mov dword [edi + 0xc20], 0xfffffffa
call fcn.00431ce0
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041b6be
leave
ret

Function at 0x43466f
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.004348ea
pop ecx
test eax, eax
jne 0x434688
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.0043468a
pop ebp
ret
Function at 0x43468a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44a280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x44f7e4]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x20c], eax
test eax, eax
je 0x4346db
mov ecx, 0x740
call fcn.00409ea0
mov esi, eax
test esi, esi
je 0x4346dd
mov edx, dword [ebp - 0x20c]
mov ecx, esi
call fcn.00402ad0
test eax, eax
jns 0x4346dd
mov ecx, esi
call fcn.004035c0
xor esi, esi
mov dword [edi + 0xc24], esi
test esi, esi
je 0x4347b0
mov dword [esi + 0x3ec], 0x15180
mov esi, dword [edi + 0xc24]
mov edx, dword [edi]
lea ecx, [esi + 0xf8]
lea eax, [esi + 0xfc]
mov dword [ecx], edx
mov dword [esi + 0x110], ecx
xor ebx, ebx
mov ecx, edi
inc ebx
mov dword [eax], edx
mov dword [esi + 0x114], eax
call fcn.0043484e
test eax, eax
je 0x4347b0
push 2
mov dword [ebp - 0x20c], ebx
pop ebx
lea eax, [ebp - 0x20c]
push eax
push 0x8004667e
push dword [edi]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x4347b0
mov ecx, dword [edi + 0xc24]
call fcn.004015c0
mov edx, eax
mov ecx, edx
sub ecx, 0
je 0x4347a7
dec ecx
je 0x43481b
test edx, edx
jle 0x43476f
xor eax, eax
jmp 0x43477a
mov ecx, dword [edi + 0xc24]
call fcn.00401190
lea ecx, [eax - 1]
dec ecx
je 0x434793
dec ecx
jne 0x4347f3
mov ecx, edi
call fcn.00434b59
neg eax
sbb eax, eax
inc eax
push 6
jmp 0x4347ab
push ecx
mov edx, edi
xor ecx, ecx
call fcn.00434b66
neg eax
pop ecx
sbb eax, eax
inc eax
push 5
jmp 0x4347ab
xor eax, eax
push 4
pop ebx
test eax, eax
jne 0x43474c
push ebx
lea eax, [ebp - 0x208]
push str.iao_sslconnect:_SSL_connect_failed__stage__d_
push eax
call fcn.0041b6cd
add esp, 0xc
lea ecx, [ebp - 0x208]
call fcn.00431ce0
mov ecx, edi
mov dword [edi + 0xc20], 0xfffffff9
call fcn.0043443c
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b6be
leave
ret
push eax
push edx
lea eax, [ebp - 0x208]
push str.iao_sslconnect:_SSL_get_error__d__d
push eax
call fcn.0041b6cd
add esp, 0x10
xor edx, edx
lea ecx, [ebp - 0x208]
call fcn.00431daf
push 7
pop ebx
jmp 0x4347b0
mov ecx, edi
call fcn.00434826
xor eax, eax
jmp 0x4347e4
Function at 0x4348ea
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get hostname
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x44a280]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 0x10
call fcn.0043433c
mov ecx, edi
call fcn.00434a70
lea edx, [edi + 0x818]
mov ecx, esi
call fcn.00434aa9
test eax, eax
jne 0x43494b
mov ecx, str.iao_connect:_Cant_translate_host_to_ip
call fcn.00431ce0
mov dword [edi + 0xc20], 0xfffffffe
or eax, 0xffffffff
jmp 0x434a61
lea edx, [edi + 0x418]
sub edx, esi
mov cl, byte [esi]
mov byte [edx + esi], cl
inc esi
test cl, cl
jne 0x434953
push 2
pop esi
push ebx
mov dword [ebp - 0x14], eax
mov word [ebp - 0x18], si
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push esi
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_socket]
or esi, 0xffffffff
mov dword [edi], eax
cmp eax, esi
jne 0x43499d
mov ecx, str.iao_connect:_Cant_obtain_file_descriptor
call fcn.00431ce0
mov dword [edi + 0xc20], esi
mov eax, esi
jmp 0x434a61
push 4
lea ecx, [ebp - 0x30]
push ecx
push 8
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, esi
jne 0x4349ce
mov ecx, str.iao_connect:_Set_keep_alive_on_socket_failed
call fcn.00431ce0
mov ecx, edi
mov dword [edi + 0xc20], esi
call fcn.0043443c
jmp 0x434996
push 0x10
lea eax, [ebp - 0x18]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, esi
jne 0x434a19
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
cmp esi, 0x274d
setne al
mov ecx, str.iao_connect:_Remote_host_unreachable
add eax, 0xfffffffc
mov dword [edi + 0xc20], eax
call fcn.00431ce0
mov ecx, edi
call fcn.0043443c
jmp 0x434943
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, esi
je 0x434a3b
mov ecx, dword [ebp - 0x24]
lea edx, [edi + 0x404]
call fcn.00434c74
mov dword [edi + 0xc18], ebx
push 0x400
add edi, 4
push edi
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x434a5f
mov esi, str.undetermined
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b6be
leave
ret
Function at 0x434aa9
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [0x44f7dc]
xor edi, edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov esi, edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x434ad0
call fcn.00434cb3
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x434ae2
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
mov eax, 0x44b474
mov cl, byte [ebx]
cmp cl, byte [eax]
jne 0x434b05
test cl, cl
je 0x434b0a
mov cl, byte [ebx + 1]
cmp cl, byte [eax + 1]
jne 0x434b05
add ebx, 2
add eax, 2
test cl, cl
jne 0x434ae7
jmp 0x434b0a
sbb edi, edi
or edi, 1
test edi, edi
jne 0x434b20
test esi, esi
jne 0x434b1a
mov esi, dword [0x44f7bc]
jmp 0x434b20
mov dword [0x44f7bc], esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x434b30
mov edx, eax
mov ecx, esi
call fcn.00434c74
push dword [0x44f7dc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp eax, 1
je 0x434b46
call fcn.00434ca5
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x434cdd
Capabilities:
Create thread

Disassembly:
mov ecx, 0x4305fb
call fcn.00434d30
xor ecx, ecx
push ecx
push ecx
push eax
push 0x434d0a
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x434d09
mov ecx, str.iao_spawnthread:_Failed_creating_thread
call fcn.00431ce0
xor eax, eax
ret
Function at 0x10202d05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x41e0fbca
jmp 0x102037bf
shr edi, 0xd
mov edi, dword [edx + 0x1c]
stc
cmp cl, ah
jmp 0x1013f4f0
test cl, ch
add edi, eax
pushfd
pushfd
mov dword [esp + 4], ecx
mov edi, dword [edi + ecx*4]
clc
test edi, edi
jmp 0x1013e1e0
cmp bx, sp
push esp
push dword [esp]
sub ecx, dword [edx + 0x10]
test dx, di
clc
cmp ecx, dword [edx + 0x14]
mov byte [esp + 4], 0xd9
lea esp, [esp + 8]
jae 0x10206d77
pushfd
pushfd
pushal
lea esp, [esp + 0x28]
jmp 0x1013ee4c
pushfd
cmp eax, edx
mov byte [esp], 0x4f
pushal
mov byte [esp], 0x74
pushal
lea esp, [esp + 0x44]
jb 0x10206d81
cmc
pushfd
cmc
cmp eax, dword [ebp - 0x10]
lea esp, [esp + 4]
jno 0x102076e2
pushfd
push dword [esp]
push dword [esp + 4]
lea esp, [esp + 0xc]
jae 0x10206d81
and bl, 0x95
mov ebx, eax
pushfd
bsr ecx, ebp
mov edi, eax
lea ecx, [esi + 0x39bfa4b6]
mov ecx, 0x104
bt cx, 8
sub al, al
pushfd
mov byte [esp + 4], bh
pushal
repne scasb al, byte es:[edi]
push ebp
call fcn.10205cd5
lea esp, [esp + 0x28]
je 0x10206d77
lea ecx, [ecx*4 + 0x6911e010]
neg ecx
add edx, eax
movzx cx, bl
shr ch, 4
neg ch
mov ecx, dword [esi + 0x7c]
cmp cx, sp
add ecx, edx
cmp ecx, 0x5289f278
pushfd
cmc
clc
mov dword [ebp - 0x10], ecx
and ch, cl
ror cx, cl
mov ecx, dword [ebp + 0xc]
pushfd
cmp dl, 0x5f
cmp ecx, 0xffff
mov byte [esp], 0x1d
lea esp, [esp + 8]
jbe 0x102079a7
adc edi, 0x4b8bf7eb
mov edi, dword [edx + 0x24]
and bh, cl
call fcn.1014056f
and dx, 0xd08e
add esi, eax
jmp 0x10206dbb
pushal
lea esp, [esp + 0x2c]
je 0x10206d77
cmp ch, 3
add eax, edi
jmp 0x101fc87e
test sp, ax
clc
mov edx, dword [esi + 0x78]
pushfd
test dh, dl
mov byte [esp + 0x18], bh
mov byte [esp + 8], cl
test edx, edx
jmp 0x10202731
call fcn.10205634
inc ebx
retf 0x9c3d
jmp 0x101fc62e
Function at 0x10205714
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x2c]
je 0x1020561b
call int.102059aa
pushfd
shr bx, cl
shld ebx, ebx, cl
pushal
mov ebx, eax
mov byte [esp + 4], 0xab
cmp byte [edi], 0x23
pushal
pushfd
lea esp, [esp + 0x48]
jne 0x1013f9fe
push 0x125b9d77
neg ah
neg ax
xor edx, edx
xor ah, bl
mov eax, edx
cmp di, ax
fmul qword [ecx - 0x38c69930]
and al, ch
rcr al, cl
add edi, 1
rcr al, 6
mov al, byte [edi]
cmp ch, ch
test al, al
call fcn.102073a4
mov fs, word [edi - 0x68f44e6]
add dword [edi], 0xfffffffd
in eax, 0x7b
out dx, al
push ss
push 3
call 0xd0b513ac
sbb eax, edx
mov eax, 0x8396ac96
sti
mov cl, 0xfb
xchg ecx, eax
xor ecx, dword [ebx - 0x69]
cld
xchg edi, eax
pop ebx
xor byte [esi], dh
out dx, eax
je 0x10205769
cmp bh, al
clc
sub eax, 0xaf2e0d34
bound ebp, qword [ecx - 0x4e]
cmp edi, eax
mov dh, 0x45
inc ebp
sub edi, dword [ecx]
mov dword [ebx], esp
sti
adc byte [edx + 0x3458ac96], bh
pop ebx
cmp dword [ecx - 0x45ef04dd], ecx
xchg esi, eax
lodsb al, byte [esi]
pop eax
xor al, 0x5b
sbb dl, al
cld
xchg ecx, eax
xor eax, esp
jno 0x1020573f
mov cl, 0x48
mov bl, 0x93
scasd eax, dword es:[edi]
pushal
push ds
sub eax, 0xa5628f85
call 0x7ea08239
cld
leave
mov ebx, 0xb732f970
in al, dx
mov bl, 0x69
nop
add ebp, dword [edi + edi]
push edi
jge 0x10205797
mov bl, 0xa1
mov ebx, 0xac96ba35
pop eax
movsb byte es:[edi], byte [esi]
mov dword [ecx + 0x3391fd3f], ecx
cmpsd dword [esi], dword es:[edi]
inc ebx
cld
adc eax, 0xce09e1bd
bound eax, qword [eax + esi*2 - 0x25]
fadd qword [edi*2 - 0x4c1984b1]
sbb al, 0x55
jmp [edx + 0x6d41abc9]
pushal
mov byte [esp], 0xa3
jmp 0x10205705
Function at 0x401170
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x284
mov eax, dword [0x423190]
push ebx
push esi
push edi
mov dword [esp + 0x28c], eax
xor eax, eax
mov word [esp + 0x80], 0
mov ecx, 0x81
lea edi, [esp + 0x82]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x84]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...XLaccService.exe
lea ecx, [esp + 0x84]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
je 0x401223
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x94]
push edx
push 1
push 2
push 0x110
push 0xf01ff
push str.XLaccService
push str.XLaccService
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
jne 0x401238
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov ecx, dword [esp + 0x28c]
call fcn.0040c26e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x19
mov esi, 0x41c380
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
push ecx
push 1
lea eax, [esp + 0x20]
push ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, dword [esp + 0x28c]
mov eax, 1
call fcn.0040c26e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4015a0
Capabilities:
Check mutex on windows

Disassembly:
push str.xlgameacc_app_mutex
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
ret

Function at 0x4016f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x423190]
push ebx
push esi
push edi
mov dword [esp + 0x224], eax
xor ebx, ebx
xor eax, eax
mov word [esp + 0x18], bx
mov ecx, 0x81
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
je 0x401798
lea eax, [edi + edi]
push eax
call fcn.0040bd9e
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x401798
push esi
push edi
push ebx
lea ecx, [esp + 0x24]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40178f
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x41c4bc
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x4017ad
push esi
call fcn.0040c611
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x224]
call fcn.0040c26e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
push 0x41c4a4
push 0x168
push 0x423df0
call fcn.0040c5a1
push esi
call fcn.0040c611
mov ecx, dword [esp + 0x244]
add esp, 0x20
mov eax, 0x423df0
call fcn.0040c26e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret