joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4038c0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1330
call fcn.0040d570
mov eax, dword [0x431d70]
xor eax, esp
mov dword [esp + 0x132c], eax
push ebx
push ebp
push esi
mov esi, ecx
cmp byte [esi + 4], 0
push edi
je 0x403a13
cmp dword [esi + 8], 0
je 0x403980
mov eax, dword [esi + 0xc]
test eax, eax
je 0x403980
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.VDMEnumTaskWOWEx
push eax
call edi
mov eax, dword [esi + 8]
push str.EnumProcesses
push eax
call edi
mov ecx, dword [esi + 8]
push str.GetModuleFileNameExA
push ecx
call edi
mov edx, dword [esi + 8]
push str.GetModuleBaseNameA
push edx
mov ebp, eax
call edi
mov eax, dword [esi + 8]
push str.EnumProcessModules
push eax
call edi
mov edi, eax
test ebp, ebp
je 0x403980
test edi, edi
je 0x403980
mov ecx, dword [esp + 0x1344]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x403980
lea edx, [esp + 0x10]
push edx
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ebx
call edi
shr dword [esp + 0x10], 2
test eax, eax
jne 0x40399d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x133c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040d55f
add esp, 0x1330
ret 4
xor edi, edi
cmp dword [esp + 0x10], edi
jbe 0x403a02
jmp 0x4039b0
mov edx, dword [esp + edi*4 + 0x14]
push 0x104
lea ecx, [esp + 0x123c]
push ecx
push edx
push ebx
call ebp
test eax, eax
je 0x403979
lea eax, [esp + 0x1238]
push 0x5c
push eax
call fcn.0040e554
add esp, 8
test eax, eax
je 0x4039e0
inc eax
mov ecx, dword [esp + edi*4 + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0xc]
push eax
lea eax, [esp + 0x123c]
push eax
push ecx
mov ecx, esi
call edx
test eax, eax
je 0x403a02
inc edi
cmp edi, dword [esp + 0x10]
jb 0x4039b0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x403982
push 0x426b58
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Module32First
push edi
mov ebp, eax
call ebx
push str.Module32Next
push edi
mov dword [esp + 0x18], eax
call ebx
mov ebx, eax
test ebp, ebp
je 0x403980
cmp dword [esp + 0x10], 0
je 0x403980
test ebx, ebx
je 0x403980
mov eax, dword [esp + 0x1344]
push eax
push 8
mov dword [esp + 0x101c], 0x224
call ebp
lea ecx, [esp + 0x1014]
mov edi, eax
push ecx
push edi
call dword [esp + 0x18]
mov edx, dword [esi]
mov edx, dword [edx + 0xc]
lea eax, [esp + 0x1034]
push eax
mov eax, dword [esp + 0x1034]
lea ecx, [esp + 0x1138]
push ecx
push eax
mov ecx, esi
call edx
test eax, eax
je 0x403af4
lea eax, [esp + 0x1014]
push eax
push edi
call ebx
test eax, eax
je 0x403af4
jmp 0x403ac0
mov edx, dword [esi]
mov edx, dword [edx + 0xc]
lea eax, [esp + 0x1034]
push eax
mov eax, dword [esp + 0x1034]
lea ecx, [esp + 0x1138]
push ecx
push eax
mov ecx, esi
call edx
test eax, eax
je 0x403af4
lea eax, [esp + 0x1014]
push eax
push edi
call ebx
test eax, eax
jne 0x403ac0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x403982
Function at 0x404000
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0x426c20
xor esi, esi
push eax
mov dword [esp + 0x14], esi
call fcn.0040eef0
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x404027
or edi, 0xffffffff
jmp 0x40409c
push ebx
mov ebx, dword [esp + 0x20]
lea esp, [esp]
mov ecx, dword [esp + 0x1c]
push ebp
push ebx
push 1
push ecx
xor edi, edi
call fcn.0040ee0f
mov esi, eax
add esp, 0x10
cmp esi, ebx
jae 0x40406b
push ebp
call fcn.0040eb07
add esp, 4
test eax, eax
jne 0x40406b
mov edx, dword [esp + 0x18]
push edx
push str.error_in_reading__s_n
call fcn.0040ea42
add esp, 8
or edi, 0xffffffff
test esi, esi
jbe 0x404086
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push esi
push eax
push ecx
call fcn.004046a0
add esp, 0xc
mov dword [esp + 0x10], eax
test edi, edi
jne 0x40408e
test esi, esi
ja 0x404030
push ebp
call fcn.0040e9c6
mov esi, dword [esp + 0x14]
add esp, 4
pop ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push esi
push eax
push str.file__s_crc__x_n
mov dword [edx], esi
call fcn.0040ea42
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x4040c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 0x4000
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
call fcn.0040e885
mov edi, dword [esp + 0x44]
mov ebp, eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x20]
push ecx
push edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call fcn.00403f60
add esp, 0x10
cmp dword [esi + 4], ebx
je 0x404133
lea edx, [esp + 0x10]
push edx
push 0x4000
push ebp
push edi
call fcn.00404000
add esp, 0x10
mov eax, dword [esp + 0x44]
cmp eax, ebx
jne 0x40413d
mov eax, edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 4]
push ecx
push edx
push ebx
push 8
mov edx, dword [esi]
push 0xfffffffffffffff1
push ebx
push 0xffffffffffffffff
push 8
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x4c]
push ecx
push eax
push edx
call fcn.004087c0
add esp, 0x40
test eax, eax
jne 0x404180
push 0x426c20
push edi
call fcn.0040eef0
add esp, 8
mov dword [esp + 0x44], eax
cmp eax, ebx
jne 0x404194
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x2c
ret 8
mov eax, dword [esp + 0x44]
push eax
push 0x4000
push 1
push ebp
xor esi, esi
call fcn.0040ee0f
mov edi, eax
add esp, 0x10
cmp edi, 0x4000
jge 0x4041d7
mov eax, dword [esp + 0x44]
push eax
call fcn.0040eb07
add esp, 4
test eax, eax
jne 0x4041d7
mov ecx, dword [esp + 0x40]
push ecx
push str.error_in_reading__s_n
call fcn.0040ea42
add esp, 8
or esi, 0xffffffff
cmp edi, ebx
jle 0x404204
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push edi
push ebp
push eax
call fcn.004082c0
mov esi, eax
add esp, 0xc
cmp esi, ebx
jge 0x404206
mov ecx, dword [esp + 0x40]
push ecx
push str.error_in_writing__s_in_the_zipfile_n
call fcn.0040ea42
add esp, 8
cmp esi, ebx
jne 0x40420c
cmp edi, ebx
jg 0x404190
mov edx, dword [esp + 0x44]
push edx
call fcn.0040e9c6
add esp, 4
cmp esi, ebx
jl 0x404245
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push ecx
call fcn.004085a0
add esp, 4
test eax, eax
je 0x404245
push ebp
call fcn.0040e7a8
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x2c
ret 8
push ebp
call fcn.0040e7a8
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x2c
ret 8
Function at 0x404270
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x40428a
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x40439a
push ebp
jmp 0x4042a0
mov eax, ebx
cmp ebx, 0x15b0
jb 0x4042af
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x40435b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x4042d0
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x4042d0
test eax, eax
je 0x40436d
nop
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x404360
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x4042a0
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret
Function at 0x407900
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi]
mov edx, ecx
xor edx, eax
shr ecx, 8
and edx, 0xff
mov edx, dword [edi + edx*4]
xor edx, ecx
movzx ecx, dl
add ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [edi + ecx*4]
mov dword [esi + 8], edx
ret

Function at 0x407980
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x431d70]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [esp + 0x24], 0xc
mov eax, dword [esp + 0x20]
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov esi, edx
jge 0x4079c0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040d55f
add esp, 0x1c
ret
mov eax, dword [0x4351f4]
inc eax
mov dword [0x4351f4], eax
cmp eax, 1
jne 0x4079e5
push 0
call fcn.0040f623
xor eax, 0xbb40e64e
push eax
call fcn.0040d64d
add esp, 8
push ebp
mov eax, edi
mov ecx, esi
mov edx, ebx
call fcn.00407940
xor ebp, ebp
call fcn.0040d65f
mov ebx, eax
sar ebx, 7
mov eax, esi
and ebx, 0xff
call fcn.004078e0
mov dword [esp + 0x10], eax
mov eax, ebx
call fcn.00407900
xor bl, byte [esp + 0x10]
inc ebp
cmp ebp, 0xa
mov byte [esp + ebp + 0x1b], bl
jl 0x4079f3
mov edx, dword [esp + 0x18]
mov eax, edi
mov ecx, esi
call fcn.00407940
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
xor ebp, ebp
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, esi
call fcn.004078e0
mov bl, byte [esp + ebp + 0x1c]
mov dword [esp + 0x10], eax
movzx eax, bl
call fcn.00407900
mov edx, dword [esp + 0x18]
xor bl, byte [esp + 0x10]
add edx, ebp
inc ebp
cmp ebp, 0xa
mov byte [esp + edx + 0x1c], bl
jl 0x407a40
mov eax, esi
call fcn.004078e0
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
shr ebx, 0x10
mov eax, ebx
and eax, 0xff
call fcn.00407900
xor bl, byte [esp + 0x10]
mov eax, dword [esp + 0x14]
mov byte [eax + ebp], bl
mov eax, esi
inc ebp
call fcn.004078e0
mov ebx, eax
mov eax, dword [esp + 0x3c]
shr eax, 0x18
call fcn.00407900
mov ecx, dword [esp + 0x14]
xor al, bl
mov byte [ecx + ebp], al
mov ecx, dword [esp + 0x28]
lea eax, [ebp + 1]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040d55f
add esp, 0x1c
ret
Function at 0x408220
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [ebx + 0x4090], 0
je 0x408280
cmp dword [ebx + 0x6c], 0
jbe 0x408280
push ebp
mov eax, 0xffffff78
push esi
sub eax, ebx
push edi
lea esi, [ebx + 0x4094]
lea ebp, [ebx + 0x88]
mov dword [esp + 0x10], eax
lea esp, [esp]
mov eax, esi
call fcn.004078e0
mov edi, dword [ebx + 0x40a0]
mov dword [esp + 0xc], eax
movzx eax, byte [ebp]
call fcn.00407900
mov al, byte [esp + 0xc]
xor byte [ebp], al
mov ecx, dword [esp + 0x10]
inc ebp
add ecx, ebp
cmp ecx, dword [ebx + 0x6c]
jb 0x408250
pop edi
pop esi
pop ebp
mov edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x20]
push edx
mov edx, dword [ebx + 0x1c]
lea eax, [ebx + 0x88]
push eax
mov eax, dword [ebx + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, dword [ebx + 0x6c]
mov dword [ebx + 0x6c], 0
je 0x4082ae
or eax, 0xffffffff
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x4083a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
xor edi, edi
cmp ebx, edi
jne 0x4083b4
pop edi
mov eax, 0xffffff9a
pop ebx
ret
cmp dword [ebx + 0x2c], edi
je 0x4083ac
cmp dword [ebx + 0x80], 8
push ebp
push esi
mov dword [ebx + 0x34], edi
jne 0x408410
cmp dword [ebx + 0x84], edi
jne 0x408410
lea ebp, [ebx + 0x30]
cmp dword [ebx + 0x40], 0
jne 0x4083ed
call fcn.00408220
lea eax, [ebx + 0x88]
mov dword [ebx + 0x40], 0x4000
mov dword [ebx + 0x3c], eax
mov esi, dword [ebx + 0x44]
push 4
push ebp
call fcn.00404740
mov ecx, dword [ebx + 0x44]
sub ecx, esi
add dword [ebx + 0x6c], ecx
mov edi, eax
add esp, 8
test edi, edi
je 0x4083d2
cmp edi, 1
jne 0x408410
xor edi, edi
cmp dword [ebx + 0x6c], 0
jbe 0x408426
test edi, edi
jne 0x408426
call fcn.00408220
cmp eax, 0xffffffff
jne 0x408426
or edi, eax
cmp dword [ebx + 0x80], 8
jne 0x40844d
cmp dword [ebx + 0x84], 0
jne 0x408467
lea edx, [ebx + 0x30]
push edx
call fcn.00404b40
add esp, 4
mov edi, eax
mov dword [ebx + 0x68], 0
cmp dword [ebx + 0x84], 0
jne 0x408467
mov eax, dword [ebx + 0x408c]
mov ecx, dword [ebx + 0x38]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov esi, dword [ebx + 0x74]
mov ebp, dword [ebx + 0x40a4]
mov ecx, dword [esp + 0x1c]
add ebp, dword [ebx + 0x44]
add esi, 0x10
mov edx, 4
call fcn.00407c00
mov esi, dword [ebx + 0x74]
add esi, 0x14
mov ecx, ebp
call fcn.00407c00
mov ecx, 1
cmp dword [ebx + 0x5c], ecx
jne 0x4084a9
mov esi, dword [ebx + 0x74]
add esi, 0x24
lea edx, [ecx + 1]
call fcn.00407c00
mov esi, dword [ebx + 0x74]
mov ecx, dword [esp + 0x18]
add esi, 0x18
mov edx, 4
call fcn.00407c00
test edi, edi
jne 0x4084d7
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x74]
push edx
push eax
lea ecx, [ebx + 0x24]
push ecx
call fcn.00407b30
add esp, 0xc
mov edi, eax
mov edx, dword [ebx + 0x74]
push edx
call fcn.0040e7a8
add esp, 4
test edi, edi
jne 0x408582
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0xc]
push eax
push ecx
call edx
mov ecx, dword [ebx + 0x20]
mov edx, dword [ebx + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x70]
push edi
add eax, 0xe
push eax
mov eax, dword [ebx + 0x10]
push ecx
push edx
call eax
add esp, 0x18
test eax, eax
je 0x40851d
or edi, 0xffffffff
jmp 0x408564
mov ecx, dword [ebx + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
mov esi, 4
mov edx, ebx
call fcn.00407bd0
mov edi, eax
add esp, 4
test edi, edi
jne 0x408564
mov edx, dword [ebx + 0x20]
push edx
mov ecx, ebp
mov edx, ebx
call fcn.00407bd0
mov edi, eax
add esp, 4
test edi, edi
jne 0x408564
mov eax, dword [ebx + 0x20]
mov ecx, dword [esp + 0x18]
push eax
mov edx, ebx
call fcn.00407bd0
add esp, 4
mov edi, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x1c]
push 0
push ecx
mov ecx, dword [ebx + 0x10]
push edx
push eax
call ecx
add esp, 0x10
test eax, eax
je 0x408582
or edi, 0xffffffff
inc dword [ebx + 0x40b0]
pop esi
pop ebp
mov eax, edi
pop edi
mov dword [ebx + 0x2c], 0
pop ebx
ret
Function at 0x408dd0
Capabilities:
Check for time delay via gettickcount
Create raw socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x814
mov eax, dword [0x431d70]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x824]
mov ecx, dword [esp + 0x828]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
push 1
push 0
push 0
push 1
push 3
push 2
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x408e35
pop esi
or eax, eax
pop ebp
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0040d55f
add esp, 0x814
ret
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [esp + 0x830]
push edx
push 4
push 0
push esi
call edi
cmp eax, 0xffffffff
je 0x408eb2
push 4
lea eax, [esp + 0x10]
push eax
push 0x1006
push 0xffff
push esi
mov dword [esp + 0x20], 0x64
call edi
cmp eax, 0xffffffff
je 0x408eb2
push 4
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0xffff
push esi
mov dword [esp + 0x2c], 1
call edi
cmp eax, 0xffffffff
je 0x408eb2
push 4
lea edx, [esp + 0x10]
push edx
push 0x1005
push 0xffff
push esi
mov dword [esp + 0x20], 0x3e8
call edi
cmp eax, 0xffffffff
jne 0x408ecd
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0040d55f
add esp, 0x814
ret
push ebx
mov byte [esp + 0x20], 8
mov byte [esp + 0x21], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [esp + 0x24], ax
xor eax, eax
xor ecx, ecx
mov word [esp + 0x22], ax
mov word [esp + 0x26], cx
call edi
mov dword [esp + 0x28], eax
mov ax, word [0x4551f8]
mov word [esp + 0x26], ax
inc ax
mov word [0x4551f8], ax
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov eax, 0x2c
lea ecx, [esp + 0x20]
call fcn.00408d60
mov word [esp + 0x22], ax
call edi
push 0x10
push ebp
push 0
push 0x2c
lea edx, [esp + 0x30]
push edx
push esi
mov ebx, eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x408f86
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push 0
push 0x400
lea edx, [esp + 0x430]
push edx
push esi
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
jne 0x408f8b
or eax, 0xffffffff
jmp 0x408f8f
call edi
sub eax, ebx
mov ecx, dword [esp + 0x820]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040d55f
add esp, 0x814
ret
Function at 0x409370
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x428
mov eax, dword [0x431d70]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [esp + 0x42c]
push ebp
push esi
push eax
mov ebp, 1
mov dword [0x4551fc], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x40950a
cmp word [esi + 8], 2
jne 0x40950a
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
movsx eax, word [esi + 0xa]
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
push eax
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0040d190
mov eax, dword [0x455228]
mov cx, word [esi + 8]
add esp, 0xc
mov word [esp + 0xc], cx
cmp eax, dword [0x455224]
je 0x409407
xor edx, edx
mov word [eax], dx
mov eax, dword [0x455228]
mov dword [0x455224], eax
push edi
push 0x426344
push 0x426344
mov ecx, 0x455204
call fcn.00408ff0
push str.ip_time_host_n
mov ecx, 0x455200
call fcn.004092e0
mov edi, dword [sym.imp.WS2_32.dll_gethostbyaddr]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
push ebp
lea eax, [esp + 0x1c]
push 0x10
push eax
mov dword [esp + 0x20], 0x10
call fcn.00408dd0
mov esi, eax
add esp, 0x14
test esi, esi
jl 0x4094c8
mov ecx, dword [0x4551fc]
cmp ecx, 0xffffffff
je 0x4094c8
movzx edx, byte [esp + 0x27]
movzx eax, byte [esp + 0x26]
push esi
push edx
push eax
mov eax, dword [esp + 0x30]
movzx ecx, ah
movzx edx, al
push ecx
push edx
lea eax, [esp + 0x44]
push str._d._d._d._d__d_
push eax
call fcn.0040e41b
add esp, 0x1c
push 2
push 4
lea ecx, [esp + 0x2c]
push ecx
call edi
test eax, eax
je 0x4094b3
mov edx, dword [eax]
push edx
lea eax, [esp + 0x34]
push str.__s_
push eax
call fcn.0040e41b
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov ecx, 0x455200
call fcn.004092e0
inc dword [0x4551fc]
inc ebp
test esi, esi
jl 0x4094e6
mov edx, dword [0x4551fc]
cmp edx, 0xffffffff
je 0x4094e6
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x24]
jne 0x409431
pop edi
pop esi
mov dword [0x4551fc], 0xffffffff
mov al, 1
pop ebp
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.0040d55f
add esp, 0x428
ret
mov ecx, dword [esp + 0x42c]
pop esi
pop ebp
xor ecx, esp
xor al, al
call fcn.0040d55f
add esp, 0x428
ret

Function at 0x4095a0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0
push 0x409530
call fcn.0040d855
add esp, 0xc
ret 4
Function at 0x4095c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x98
mov eax, dword [0x431d70]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
mov esi, dword [esp + 0xa0]
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftDirectX
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409687
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.Version
push ecx
mov dword [esp + 0x28], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40967c
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push 0x42ab4c
push ecx
call fcn.0040fb8d
mov edx, dword [esp + 0x14]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x409670
jmp 0x409687
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x98]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0040d55f
add esp, 0x98
ret

Function at 0x4096b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x98
mov eax, dword [0x431d70]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
mov esi, dword [esp + 0xa0]
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409777
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.Version
push ecx
mov dword [esp + 0x28], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40976c
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push 0x42ab4c
push ecx
call fcn.0040fb8d
mov edx, dword [esp + 0x14]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x409760
jmp 0x409777
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x98]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0040d55f
add esp, 0x98
ret
Function at 0x40a1e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x431d70]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push edi
mov edi, dword [esp + 0x218]
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x14], 0
call fcn.0040d5a0
push 0x103
lea ecx, [esp + 0x11d]
push 0
push ecx
mov byte [esp + 0x124], 0
call fcn.0040d5a0
mov ecx, dword [0x43108c]
mov eax, dword [ecx]
add esp, 0x18
push 0
push 0
push 0x104
lea edx, [esp + 0x118]
push edx
mov edx, dword [eax + 0x20]
push 0xffffffffffffffff
call edx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x110]
push ecx
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirA]
push 1
push 0
push str.heroes_.mdmp
lea edx, [esp + 0x14]
push edx
mov eax, edx
push eax
push edi
mov ecx, esi
call fcn.0040a000
push 1
push 0
push str.heroes_.jpg
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
push edi
mov ecx, esi
call fcn.0040a000
push 1
push 0
push str.heroes_.log
lea eax, [esp + 0x14]
push eax
mov ecx, eax
push ecx
push edi
mov ecx, esi
call fcn.0040a000
push 1
push 0
push str.launcher_.log
lea edx, [esp + 0x14]
push edx
mov eax, edx
push eax
push edi
mov ecx, esi
call fcn.0040a000
push 1
push 0
push str.unsupportedIME.txt
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
push edi
mov ecx, esi
call fcn.0040a000
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
call fcn.0040d55f
add esp, 0x20c
ret 4