joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492640
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e3d4
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4c8094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00410216
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4926a7
mov eax, dword [ecx]
jmp 0x4926a9
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.004058ab
lea ecx, [ebp - 0x40]
call fcn.004102e4
add esp, 0x18
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x492732
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x492717
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x1000
jb 0x49270e
test cl, 0x1f
je 0x4926ea
call fcn.00447cc1
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4926f6
call fcn.00447cc1
sub ecx, eax
cmp ecx, 4
jae 0x492702
call fcn.00447cc1
cmp ecx, 0x23
jbe 0x49270c
call fcn.00447cc1
mov ecx, eax
push ecx
call fcn.00426850
add esp, 4
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00407a1a
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x49277c
mov ecx, dword [ebp - 0x40]
inc eax
cmp eax, 0x1000
jb 0x492773
test cl, 0x1f
je 0x49274f
call fcn.00447cc1
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x49275b
call fcn.00447cc1
sub ecx, eax
cmp ecx, 4
jae 0x492767
call fcn.00447cc1
cmp ecx, 0x23
jbe 0x492771
call fcn.00447cc1
mov ecx, eax
push ecx
call fcn.00426850
add esp, 4
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4927ca
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4927b4
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
inc ecx
push ecx
push edx
push eax
call fcn.0043ecd0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x49281a
mov ecx, dword [ebp - 0x28]
inc eax
cmp eax, 0x1000
jb 0x492811
test cl, 0x1f
je 0x4927ed
call fcn.00447cc1
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4927f9
call fcn.00447cc1
sub ecx, eax
cmp ecx, 4
jae 0x492805
call fcn.00447cc1
cmp ecx, 0x23
jbe 0x49280f
call fcn.00447cc1
mov ecx, eax
push ecx
call fcn.00426850
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426855
mov esp, ebp
pop ebp
ret
Function at 0x495130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e7b9
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x4c8094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x254], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x25c], esi
mov dword [esi + 0x10], 0
jb 0x49519a
mov eax, dword [esi]
jmp 0x49519c
mov eax, esi
xor ecx, ecx
mov word [eax], cx
push 0x20a
push ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 0x254], 1
call fcn.00440a80
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 1
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [ebp - 0x220], 0
jne 0x4951e6
xor ecx, ecx
jmp 0x4951ff
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4951f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x220]
mov ecx, esi
push eax
call fcn.004027a4
mov edx, esi
lea ecx, [ebp - 0x238]
call fcn.00495320
push 1
push 0x4b5250
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00402274
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x250]
call fcn.0040ac87
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00402318
mov eax, dword [ebp - 0x23c]
cmp eax, 8
jb 0x4952af
mov ecx, dword [ebp - 0x250]
inc eax
cmp eax, 0x7fffffff
jbe 0x49526f
call fcn.00447cc1
add eax, eax
cmp eax, 0x1000
jb 0x4952a6
test cl, 0x1f
je 0x495282
call fcn.00447cc1
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x49528e
call fcn.00447cc1
sub ecx, eax
cmp ecx, 4
jae 0x49529a
call fcn.00447cc1
cmp ecx, 0x23
jbe 0x4952a4
call fcn.00447cc1
mov ecx, eax
push ecx
call fcn.00426850
add esp, 4
mov eax, dword [ebp - 0x224]
cmp eax, 0x10
jb 0x4952ff
mov ecx, dword [ebp - 0x238]
inc eax
cmp eax, 0x1000
jb 0x4952f6
test cl, 0x1f
je 0x4952d2
call fcn.00447cc1
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4952de
call fcn.00447cc1
sub ecx, eax
cmp ecx, 4
jae 0x4952ea
call fcn.00447cc1
cmp ecx, 0x23
jbe 0x4952f4
call fcn.00447cc1
mov ecx, eax
push ecx
call fcn.00426850
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00426855
mov esp, ebp
pop ebp
ret
Function at 0x4968f0
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
xor bl, bl
cmp dword [esi + 0x14], 8
jb 0x49690d
mov eax, dword [esi]
jmp 0x49690f
mov eax, esi
test eax, eax
je 0x496a33
cmp word [eax], 0
je 0x496a33
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x496a33
test al, 0x10
jne 0x496a33
cmp dword [esi + 0x14], 8
jb 0x496941
mov esi, dword [esi]
push 0x4b529c
push esi
call fcn.0044ce16
mov esi, eax
add esp, 8
test esi, esi
je 0x496a33
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [esp + 0x18], xmm0
call fcn.0044e774
push 2
push 0
push esi
call fcn.0044e630
lea eax, [esp + 0x24]
push eax
push esi
call fcn.0044e774
lea eax, [esp + 0x34]
push eax
push esi
call fcn.0044e7fa
add esp, 0x24
cmp dword [esp + 0x10], 0x28
jbe 0x496a2a
xor eax, eax
mov dword [esp + 0x20], 0x48535844
push esi
push 1
mov word [esp + 0x40], ax
xorps xmm0, xmm0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x28]
push 0x28
push eax
mov dword [esp + 0x34], 0x28
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
movsd qword [esp + 0x40], xmm0
call fcn.0044d388
add esp, 0x10
test eax, eax
je 0x496a2a
mov eax, dword [esp + 0x2c]
not eax
ror eax, 3
cmp eax, dword [esp + 0xc]
jne 0x496a2a
cmp dword [esp + 0x20], 0x48535844
jne 0x496a2a
cmp dword [esp + 0x24], 0x28
jne 0x496a2a
movzx ecx, word [esp + 0x38]
add ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
add ecx, dword [esp + 0x40]
add eax, 0x28
add eax, ecx
cmp eax, dword [esp + 0x10]
sete bl
push esi
call fcn.0044c6d6
add esp, 4
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402840
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x519728
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402899
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x402899
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x402899
xor eax, eax
inc eax
jmp 0x40289b
xor eax, eax
leave
ret 0x10

Function at 0x405bae
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x405cd1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x405cb5
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x405c07
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x405be5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x419352
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov edi, ecx
mov dword [ebp - 4], esi
jne 0x419375
mov eax, 0x8876086c
jmp 0x41948a
cmp dword [ebp + 0xc], esi
push ebx
je 0x41940d
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x4193ed
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push 0xfde9
call ebx
push eax
mov dword [ebp + 0xc], eax
call fcn.004bf83f
cmp eax, esi
pop ecx
mov dword [ebp - 4], eax
jne 0x4193d1
mov eax, 0x8007000e
jmp 0x419489
push esi
push esi
push dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push 0xfde9
call ebx
mov eax, dword [ebp - 4]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], esi
cmp dword [ebp + 0xc], esi
je 0x41940d
push esi
push 0x10000000
push 3
push esi
push 1
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x419426
push esi
push 0x10000000
push 3
push esi
push 1
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push dword [ebp - 4]
mov dword [edi], eax
call fcn.004bf86f
mov eax, dword [edi]
cmp eax, 0xffffffff
pop ecx
je 0x419477
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x419477
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
je 0x419477
cmp eax, esi
je 0x419484
push esi
push esi
push esi
push 4
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
jne 0x419487
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x419489
mov dword [edi + 8], esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x41e9d0
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x41e9f3
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x41ea19
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x41ea00
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x41ead0
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x41eb07
push esi
call fcn.004263c0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x41eb00
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
pop ebp
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x41eb86
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x41eb70
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x41eb2a
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x41eb69
cmp eax, 2
je 0x41eb70
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41eb20
cmp eax, 3
je 0x41eb4d
cmp eax, 1
jne 0x41eb20
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
cmp eax, dword [ecx + 8]
jl 0x41eb20
mov eax, dword [ecx + 8]
mov edx, dword [esi + 0x144]
add eax, edx
mov dword [ecx + 8], eax
jmp 0x41eb20
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.0041e9d0
pop esi
pop ebp
ret 4
cmp ecx, 0xcc
je 0x41eb9d
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.0041e9d0
pop esi
pop ebp
ret 4

Function at 0x41f02e
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push 0x519728
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x41f09e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x51c7ac
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41f095
cmp dword [ebp - 0xc], 4
jne 0x41f095
cmp dword [ebp - 0x10], edi
je 0x41f095
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x542c48], edi
xor eax, eax
jmp 0x41f0dd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x542c48], edi
jge 0x41f0d8
lea eax, [ebp - 0x34]
push eax
mov dword [0x542c48], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x41f0d8
cmp word [ebp - 0x14], 5
jb 0x41f0d8
call fcn.0041f006
test eax, eax
je 0x41f0d8
emms
mov dword [0x542c48], 1
mov eax, dword [0x542c48]
pop edi
leave
ret
Function at 0x427e96
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x427ea5
xor eax, eax
jmp 0x427f88
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x427f68
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x51e740]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x51e740]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x51e740]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x51e740]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x51e740]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x51e740]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x51e740]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x51e740]
inc edx
dec edi
jne 0x427ec5
pop edi
test eax, eax
je 0x427f82
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x51e740]
inc edx
dec eax
jne 0x427f6c
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x442190
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x542094]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], esi
push edi
mov edi, ecx
test esi, esi
je 0x44232e
cmp dword [ebp + 0x10], 0
je 0x44232e
cmp dword [edi + 4], 0xffffffff
je 0x4421d3
call fcn.00442100
mov al, byte [esi]
sub al, 0x30
push esi
cmp al, 9
ja 0x4421fb
xorps xmm0, xmm0
mov eax, 2
movlpd qword [esp + 0x2c], xmm0
mov word [esp + 0x24], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x24], eax
jmp 0x442233
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x44232e
xorps xmm0, xmm0
lea eax, [esp + 0x24]
movaps xmmword [esp + 0x20], xmm0
movsx ecx, word [esi + 0xa]
push ecx
mov ecx, dword [esi + 0xc]
push dword [ecx]
push eax
call fcn.004c16e0
mov ax, word [esi + 8]
add esp, 0xc
mov word [esp + 0x20], ax
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x2e], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, 0xffffffff
jne 0x442271
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004bf82c
mov esp, ebp
pop ebp
ret 0xc
push 4
lea eax, [esp + 0x3c]
mov dword [edi + 4], esi
push eax
push 0x1002
push 0xffff
push esi
mov dword [esp + 0x4c], 0x40000
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4422d4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 4], 0xffffffff
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004bf82c
mov esp, ebp
pop ebp
ret 0xc
push 0x31
push 0x401
push dword [esp + 0x1c]
push esi
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov eax, dword [esp + 0x14]
mov dword [edi + 8], eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4422f6
sub ecx, esi
push ecx
push edx
lea ecx, [edi + 0xc]
call fcn.00442d40
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x24], eax
xor eax, eax
mov dword [edi + 0x40028], 1
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.004bf82c
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0x3c]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.004bf82c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x442930
Capabilities:
Encode data using xor
Hash data with crc32
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea3fd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x542094]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40058], 0
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
je 0x442aec
cmp dword [ebx + 4], 0xffffffff
je 0x442aec
cmp dword [ebx + 0x40028], 0
je 0x442aec
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
xor eax, eax
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], vtable.DataPack.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
cmp dword [0x551dcc], eax
je 0x442a49
mov eax, dword [0x551dc8]
push esi
inc eax
push edi
push 0x55229c
mov dword [0x551dc8], eax
mov dword [0x552298], eax
call fcn.004c16e0
lea edi, [esi + 4]
add esp, 0xc
or ecx, 0xffffffff
xor edx, edx
test edi, edi
je 0x442a0b
nop dword [eax]
movzx eax, byte [edx + 0x552298]
inc edx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x535ad0]
cmp edx, edi
jb 0x4429f0
push 0x552298
lea eax, [esi + 8]
mov dword [esi + 0x55229c], ecx
push 0x552298
mov esi, eax
push eax
mov dword [ebp - 0x20], esi
call fcn.0045fd10
push esi
mov dword [ebp - 0x18], esi
call fcn.004bf882
push esi
mov edi, eax
mov dword [ebp - 0x24], eax
push 0x552298
push edi
mov dword [ebp - 0x28], edi
call fcn.004c16e0
add esp, 0x10
lea eax, [esi + 6]
cmp eax, 0xc8
jg 0x442ae1
mov esi, dword [sym.imp.WS2_32.dll_htons]
lea edi, [ebx + 0x28]
push 0xaa55
call esi
mov word [edi], ax
mov eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x24]
mov word [edi + 2], ax
add edi, 4
push edi
call fcn.004c16e0
add esp, 0xc
push 0x55aa
call esi
mov ecx, dword [ebp - 0x20]
mov word [ecx + edi], ax
lea esi, [ecx + 6]
xor eax, eax
test esi, esi
jle 0x442adb
push 0
mov edi, eax
lea eax, [ebx + 0x28]
push esi
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x442abf
test ecx, ecx
lea eax, [ecx + edi]
cmove eax, edi
cmp eax, esi
jl 0x442a98
jmp 0x442adb
push 0x151
push str.C:UsersAdministratorDesktopKiraSoftWare_Source_v1098_v1534_v23683___Launcher_Source___KopyaAPISocket.cpp
push str.socket_send_error_
push str.ERROR____s_n_s:__d_n_n
call fcn.00441b30
add esp, 0x10
add dword [ebx + 0x40040], esi
push dword [ebp - 0x28]
call fcn.004bf83a
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bf82c
mov esp, ebp
pop ebp
ret 8